エピソード

  • RadioCSIRT English Edition – Adobe ZeroDay - CVE-2026-34621 - Ep.78

    RadioCSIRT English Edition – Adobe ZeroDay - CVE-2026-34621 - Ep.78
    2026/04/12
    On April 9, 2026, researcher Haifei Li, founder of EXPMON — a sandbox-based exploit detection system — publicly disclosed the existence of a zero-day vulnerability in Adobe Acrobat Reader actively exploited in the wild for at least five months. Adobe was notified on April 7. The vulnerability has since been confirmed by Adobe, assigned CVE-2026-34621, rated Critical at CVSS 9.6, and addressed in emergency security update APSB26-43. All Adobe Reader users must apply this patch immediately.The attack vector is a specially crafted PDF requiring no user interaction beyond opening the file. Heavily obfuscated JavaScript executes automatically, abusing two sandboxed Acrobat APIs outside their expected context: util.readFileIntoStream to collect local files and sensitive system data, and RSS.addFeed to exfiltrate that data to a C2 server and receive additional AES-encrypted JavaScript payloads. The exploitation chain has three identified phases. Phase one — confirmed — performs system fingerprinting: OS version, language settings, local file paths, Adobe Reader version, transmitted to the C2 for server-side victim filtering. Sandbox environments receive empty C2 responses and leave no trace; only real targets proceed. Phase two — confirmed — enables local file exfiltration on systems the operator determines are of interest. Phase three — remote code execution combined with sandbox escape — is not yet confirmed but assessed as probable by the research community.Two known samples define the campaign timeline. Version one, uploaded to VirusTotal on November 28, 2025: prototype phase, lighter obfuscation, C2 on a bare IP, broad OS targeting, initial detection rate of two out of sixty-four VirusTotal engines. Version two, uploaded March 23, 2026: production phase, hardened obfuscation, domain-based C2, focused Windows 10 targeting. A third version is inferred from an observed /S12 endpoint targeting Reader version 25.x — which runs on Windows 11 — confirming active ongoing development at the time of disclosure. The lure documents contain Russian-language content referencing current events in Russia's oil and gas sector, consistent with targeted energy sector espionage rather than commodity malware distribution.The confirmed C2 IP is 188.214.34.20 on port 34123 — currently offline. The network-level behavioral IOC to block is any outbound HTTP request whose user-agent header contains the string adobe synchronizer. Known malicious filenames include Invoice540.pdf alongside generic decoy names. SHA-256 hashes for both confirmed samples are published in the EXPMON and N3mes1s forensic reports. The retroactive threat hunting window is November 2025 to the present — five months of potential undetected exposure in organizations where PDF workflows are standard.Immediate actions: apply Adobe emergency patch APSB26-43 covering CVE-2026-34621. Block outbound HTTP traffic with user-agent containing adobe synchronizer. Block C2 IP 188.214.34.20 on port 34123. Monitor for outbound network connections initiated by AcroRd32.exe or Acrobat.exe toward non-standard ports. Run retroactive IOC search in SIEM and EDR covering the full five-month exposure window. Alert staff to the risk of PDF attachments regardless of sender — lure documents in this campaign are contextually plausible invoices and sector-relevant content.SourcesEXPMON / Haifei Li – EXPMON detected sophisticated zero-day fingerprinting attack targeting Adobe Reader users : https://justhaifei1.blogspot.com/2026/04/expmon-detected-sophisticated-zero-day-adobe-reader.htmlBleepingComputer – Hackers exploiting Acrobat Reader zero-day flaw since December : https://www.bleepingcomputer.com/news/security/hackers-exploiting-acrobat-reader-zero-day-flaw-since-december/Security Affairs – Malicious PDF reveals active Adobe Reader zero-day in the wild : https://securityaffairs.com/190558/hacking/malicious-pdf-reveals-active-adobe-reader-zero-day-in-the-wild.htmlDon't think, patch!Your feedback is welcome.Email: radiocsirt@gmail.comWebsite: https://www.radiocsirt.com WeeklyNewsletter: https://radiocsirtenglishedition.substack.com/#RadioCSIRT #CyberSecurity #ThreatIntelligence #CTI #AdobeReader #ZeroDay #CVE202634621 #PDF #EXPMON #Malware
    続きを読む 一部表示
    12 分
  • RadioCSIRT English Edition - Update about Cyber situation on middle East - Ep. 77

    RadioCSIRT English Edition - Update about Cyber situation on middle East - Ep. 77
    2026/04/12
    In this episode: the cyber dimension of the Iran conflict — a six-week retrospective from the initial strikes of February 28 through the fragile ceasefire of April 9, 2026, covering the full evolution of Iranian and pro-Iranian cyber operations from the first hacktivist DDoS waves to confirmed exploitation of industrial control systems inside the United States.On February 28, 2026, the United States and Israel launched joint military strikes against Iranian strategic sites under Operations Epic Fury and Roaring Lion. Within hours, two things happened simultaneously in cyberspace: Iran's domestic internet connectivity collapsed to between one and four percent of normal capacity, and a coordinated multi-vector cyber counteroffensive was launched combining state APT operations with a coalition of over sixty hacktivist groups. In the first seventy-two hours, more than 149 attack claims were recorded against 110 distinct organizations across sixteen countries. Two groups accounted for seventy percent of total DDoS volume: Keymous Plus targeting GCC governments and financial institutions, and DieNet hitting Bahrain and Sharjah airports, Riyadh Bank, Bank of Jordan, and UAE infrastructure. In parallel, APT34/OilRig was conducting active credential harvesting against regional telecoms and government institutions, with confirmed exploitation of CVE-2026-22719 — a CVSS 8.1 unauthenticated command injection in VMware Aria Operations, added to the CISA KEV catalog on March 4. MuddyWater was conducting Operation Olalampo against META-region IT providers. UNC1549 was operating against defense, aerospace, and telecoms targets. APT35 and APT42 were running cloud credential theft campaigns against M365 and Google Workspace environments.A supply chain dimension emerged in week one: state actors began injecting malicious code into npm and PyPI packages, activating payloads only within production CI/CD pipelines, with AI-generated code designed to evade conventional detection tools. On March 31, the npm axios library — over one billion monthly downloads — was compromised via maintainer credential theft. Malicious versions 1.14.1 and 0.30.4 incorporated a hidden dependency, plain-crypto-js 4.2.1, executing a post-install dropper deploying a cross-platform RAT targeting Windows, macOS, and Linux. Any development environment that installed or updated axios during the compromise window should be treated as potentially affected.Also on March 31, the IRGC formally designated Western technology and financial entities as legitimate targets for retaliatory operations effective April 1. Named targets include Cisco, HP, Intel, Oracle, Microsoft, Apple, Google, Meta, IBM, Dell, Nvidia, and Palantir in the technology sector — all classified high threat level — JPMorgan Chase in finance, Boeing and General Electric in defense and industry. This designation transformed the threat from opportunistic hacktivist activity into a declared targeting posture against named Western entities.The most operationally significant escalation occurred on April 8, 2026. The FBI, CISA, NSA, EPA, Department of Energy, and USCYBERCOM published a joint advisory confirming active exploitation of programmable logic controllers in US water, wastewater, energy, and government facility sectors by Iranian-affiliated APT actors, with confirmed operational disruption and financial loss. Targeted devices include Rockwell Automation CompactLogix and Micro850 PLCs, with activity indicating possible extension to Siemens S7 devices. Actors accessed internet-facing PLCs using overseas infrastructure and Rockwell's Studio 5000 Logix Designer software, manipulating project files and HMI/SCADA displays. This is not an assessment — it is a confirmed joint government advisory with confirmed operational impact. The shift from DDoS and data exfiltration to confirmed OT/PLC exploitation with operational consequences represents a qualitative escalation in threat level that every industrial operator must integrate into their defensive posture immediately.For detection priorities: audit all npm and PyPI installations for the compromised axios versions and the plain-crypto-js dependency. Integrate the FBI/CISA/NSA April 8 IOC set into SIEM and EDR platforms, with enhanced monitoring of SCADA and ICS systems and internet-exposed OT connections on ports 44818, 2222, 102, 22, and 502. For enterprise environments: APT34 DNS hijacking and APT35/42 cloud credential theft remain active — monitor M365 and Google Workspace for anomalous authentication patterns. Any organization explicitly named in the IRGC March 31 designation should treat that condition as a confirmed elevated threat, not background risk.SourcesCISA – Joint advisory AA26-097A: Iranian-affiliated cyber actors exploit programmable logic controllers across US critical infrastructure : https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097aCybersecurity Dive – Iran-linked hackers target water and...
    続きを読む 一部表示
    14 分
  • RadioCSIRT English Edition –Patch Tuesday April 2026 Preview - Episode 76

    RadioCSIRT English Edition –Patch Tuesday April 2026 Preview - Episode 76
    2026/04/12

    On April 14, 2026, Microsoft releases its monthly security update cycle. This Patch Tuesday warrants direct attention from every patch management team and every operations team running Windows infrastructure. The maximum severity is critical. The primary impact is remote code execution. The affected surface covers the most widely deployed platforms in enterprise environments simultaneously: all active Windows 11 versions, the entire still-supported Windows Server range from 2016 through 2025, Remote Desktop Services, Microsoft Office, and the .NET runtime. Thirteen product families are addressed in this cycle across three deployment priority tiers.

    Seven families are classified priority one — immediate deployment. Windows 11, all active versions — 23H2, 24H2, 25H2, and 26H1 — receive critical patches with remote code execution impact. Windows Server 2025, 2022, 2019, and 2016 follow the same pattern: all rated critical, all with remote code execution impact, all priority one. Remote Desktop Services also land at critical severity with remote code execution impact and deserve specific attention beyond the standard label. The exploitation history of RDS vulnerabilities is well documented — BlueKeep and DejaBlue in 2019, both wormable, both actively exploited within weeks of disclosure. Any entity exposing RDS over the internet or through VPN concentrators should treat this component as the highest-urgency item in this cycle. Microsoft Office is priority one with critical severity — the exploitation vector is consistently phishing, the dominant initial access vector in campaigns targeting the financial sector. The .NET and .NET Framework entry is rated critical with denial of service impact: a vulnerability rated critical on .NET can crash or render unavailable any application or web service running on these runtimes without code execution — a direct availability risk that can be triggered remotely.

    Three families are priority two — deployment within seven days: SQL Server with important severity and remote code execution impact, SharePoint with important severity and spoofing impact, and Azure components with important severity and elevation of privilege impact. Three families are priority three — standard cycle: Visual Studio, Dynamics 365, and System Center, all rated important.

    Additionally, this April cycle introduces a kernel driver trust enforcement change for Windows 11 24H2, 25H2, 26H1, and Windows Server 2025: systems will no longer treat legacy cross-signed drivers as a blanket trust path. Environments with dependencies on older unsigned driver binaries should audit their driver inventory before deployment. All Windows 11 and Windows Server updates in this cycle are cumulative. Detailed CVE-level disclosure and CVSS scores will be available on the Microsoft Security Response Center from April 14.

    Sources

    • Help Net Security – April 2026 Patch Tuesday forecast: spring cleaning of a preview : https://www.helpnetsecurity.com/2026/04/10/april-2026-patch-tuesday-forecast/
    • Zecurit – Patch Tuesday April 2026: security updates and CVE analysis : https://zecurit.com/endpoint-management/patch-tuesday/
    • Microsoft Security Response Center – Security Update Guide : https://msrc.microsoft.com/update-guide/

    Don't think, patch!

    Your feedback is welcome.

    Email: radiocsirt@gmail.com
    Website: https://www.radiocsirt.com
    Weekly Newsletter: https://radiocsirtenglishedition.substack.com/

    #RadioCSIRT #CyberSecurity #PatchTuesday #Microsoft #ThreatIntelligence #CTI #Windows #RDS #Office #dotNET
    続きを読む 一部表示
    9 分
  • RadioCSIRT English Edition – a new ransomware group operating under the name Payload -Ep.74

    RadioCSIRT English Edition – a new ransomware group operating under the name Payload -Ep.74
    2026/04/12
    On April 7, 2026, Gen Threat Labs, the research arm of Gen Digital, published a detailed technical analysis of Remus, a new 64-bit infostealer attributed to the Lumma Stealer family. Active campaigns involving Remus have been observed since February 2026 — directly following a doxxing campaign between August and October 2025 that exposed the presumed core members of the Lumma organization and significantly disrupted its operations. Remus is not a replacement for Lumma — both families are currently coexisting in the wild — but a deliberate evolution, most likely born from a fork or rebranding operation initiated during the period of maximum operational pressure on the original group.The attribution case built by Gen Threat Labs rests on six technical indicators establishing codebase continuity. The most distinctive is the Application-Bound Encryption bypass for Chromium browsers: both Lumma and Remus inject a compact shellcode into the browser process to locate the v20_master_key directly in memory and call CryptUnprotectMemory from within the browser's process context. The difference between the two implementations is eleven bytes — 51 bytes for Remus versus 62 for Lumma. This level of implementation parallelism is not coincidental. Additional shared indicators include near-identical string obfuscation via stack assembly and MBA-reinforced decryption loops, direct syscall dispatch via runtime ntdll hash-to-SSN lookup tables, identical antiVM CPUID checks against five hypervisor signatures in the same order, a shared crypter presence check via NtRaiseHardError, and overlapping control flow obfuscation patterns. The attribution chain is anchored by transitional builds labeled Tenzor, compiled September 16, 2025 — at the peak of the disruption period — which carry both a Steam dead drop resolver matching confirmed Lumma samples and artifacts exclusive to Remus.The most operationally significant evolution in Remus is the abandonment of Steam and Telegram dead drop resolvers in favor of EtherHiding. At runtime, Remus sends a JSON-RPC eth_call request to a hardcoded Ethereum smart contract address via a public RPC endpoint and extracts the C2 URL from the hex-encoded response. The decentralized and immutable nature of the blockchain makes this infrastructure effectively resistant to traditional takedown procedures. Remus also introduces two additional anti-analysis checks before any C2 connection: sandbox DLL detection via CRC32 hashing of loaded module names against eleven known sandbox DLL hashes, and honeypot PST detection via enumeration of a specific Outlook PST filename. If either check triggers, the binary terminates silently via ExitProcess zero.For detection: monitor for JSON-RPC eth_call requests toward public Ethereum endpoints originating from workstations — anomalous behavior with a very low false positive rate. Monitor for hidden desktop creation via CreateDesktopW combined with browser process launch. Deploy the Remus-specific detection rules published by SOCPrime covering direct syscall usage, API hashing, and stealth execution artifacts. Any organization that has relied on Steam or Telegram dead drop blocking as a Lumma detection signal should treat that control as deprecated.SourcesGen Digital – Remus: Unmasking the 64-bit variant of the infamous Lumma Stealer : https://www.gendigital.com/blog/insights/research/remus-64bit-variant-of-lumma-stealerGBHackers – Remus infostealer debuts with stealthy new credential-theft tactics : https://gbhackers.com/remus-infostealer-debuts/CyberPress – Remus infostealer emerges with credential theft and advanced evasion tricks : https://cyberpress.org/remus-infostealer-emerges-fast/Don't think, patch!Your feedback is welcome.Email: radiocsirt@gmail.comWebsite: https://www.radiocsirt.comWeekly Newsletter: https://radiocsirtenglishedition.substack.com/#RadioCSIRT #CyberSecurity #ThreatIntelligence #CTI #Remus #LummaStealer #Infostealer #EtherHiding #Malware
    続きを読む 一部表示
    13 分
  • RadioCSIRT English Edition – A new ransomware group operating under the name Payload - Ep.74

    RadioCSIRT English Edition – A new ransomware group operating under the name Payload - Ep.74
    2026/04/12

    Since February 2026, a new ransomware group operating under the name Payload has been conducting active double extortion campaigns against organizations across multiple sectors and geographies. In less than two months of observed activity, the group has claimed twenty-six victims across seven countries, declared 2,603 gigabytes of exfiltrated data, and demonstrated a level of technical sophistication that places it well above opportunistic ransomware operations. The combination of ESXi-specific encryption logic, ETW patching, and a fully operational Tor-based infrastructure from the outset indicates either experienced operators or access to a mature toolkit.

    Payload operates two distinct binaries sharing a common cryptographic scheme: Curve25519 ECDH combined with ChaCha20 for per-file key generation. The ESXi variant is a Linux ELF64 binary of approximately 39,904 bytes. Strings are RC4-obfuscated with the three-byte key FBI. Before any encryption activity, the binary performs an anti-debug check via /proc/self/status, then parses VMware's vmInventory.xml to enumerate all datastores and VMDK paths. Virtual machines are powered off via vim-cmd before encryption begins. Thread pool workers are named FBIthread-pool — a forensic artifact visible in standard process listing. The ransom note replaces the ESXi web management interface at /usr/lib/vmware/hostd/docroot/ui/welcome.txt.

    The Windows variant, compiled on February 17, 2026, is derived from the Babuk codebase that leaked in September 2021, with HC-128 replaced by ChaCha20 and significant anti-forensic additions. Key capabilities include ETW patching of four ntdll.dll functions — EtwEventWrite, EtwEventWriteFull, EtwEventWriteTransfer, and EtwRegister — silently blinding EDR solutions that depend on ETW telemetry. The mutex MakeAmericaGreatAgain is a reliable operator fingerprint. The binary terminates thirty-four services including Veeam, Acronis, BackupExec, Symantec, and Sophos, wipes Windows event logs, deletes shadow copies, and self-deletes via NTFS alternate data stream without spawning a child process.

    For detection: deploy the YARA rule published by Abdullah Islam covering the ESXi variant. Monitor for MakeAmericaGreatAgain mutex, .payload extension, and ETW function patches in ntdll.dll. Any EDR stack relying exclusively on ETW-based telemetry should be reviewed immediately. ESXi management interfaces must sit behind a dedicated management VLAN. Immutable or air-gapped backup storage remains the only reliable recovery path if encryption completes before detection.

    Sources

    • GBHackers – Payload ransomware hits Windows and ESXi with Babuk-style encryption : https://gbhackers.com/payload-ransomware/
    • CyberSecurityNews – New Payload ransomware uses Babuk-style encryption against Windows and ESXi systems : https://cybersecuritynews.com/new-payload-ransomware-uses-babuk-style-encryption/
    • CyberPress – Payload hits Windows and ESXi : https://cyberpress.org/payload-hits-windows-esxi/

    Don't think, patch!

    Your feedback is welcome.
    Email: radiocsirt@gmail.com
    Website: https://www.radiocsirt.com

    Weekly Newsletter: https://radiocsirtenglishedition.substack.com/

    #RadioCSIRT #CyberSecurity #Ransomware #ThreatIntelligence #CTI #Payload #ESXi #VMware #Windows
    続きを読む 一部表示
    12 分
  • RadioCSIRT English Edition – Emergency meeting between the US Treasury - Episode 73

    RadioCSIRT English Edition – Emergency meeting between the US Treasury - Episode 73
    2026/04/12

    In this episode, a single artificial intelligence model became the subject of an emergency meeting between the US Treasury, the Federal Reserve, and the CEOs of America's largest systemically important financial institutions. That model is Claude Mythos Preview, developed by Anthropic. This marks the first time in American financial history that frontier AI capabilities have been treated at this regulatory level as a systemic risk event, rather than a sectoral technology concern.

    Anthropic restricted access to Mythos to approximately forty partner organizations under Project Glasswing — including Microsoft, Google, Apple, and Amazon — citing the risk of exposing critical vulnerabilities at scale. The model's documented capabilities include autonomous identification and exploitation of flaws across all major operating systems and browsers, real-time payload construction, and functional exploit generation without human guidance. Anthropic is simultaneously engaged in litigation with the Pentagon, which has classified the organization as a supply chain risk.

    Six risk vectors were identified in connection with Mythos: zero-day exploitation rated critical, systemic SIFI risk rated critical, algorithmic convergence rated high, DeFi and smart contract infrastructure exposure rated high, customer data exfiltration rated high, and cyber-insurance portfolio disruption rated medium. For security teams, the operational implication is direct: the traditional forty-eight to seventy-two hour window between CVE publication and weaponization is no longer the relevant threat timeline when autonomous exploit generation compresses that cycle to minutes.

    Sources

    • CNBC – Powell and Bessent convened Wall Street CEOs on Anthropic Mythos cyber risk : https://www.cnbc.com/2026/04/10/powell-bessent-us-bank-ceos-anthropic-mythos-ai-cyber.html
    • Fortune – Bessent and Powell convened Wall Street leaders in an emergency meeting on Claude Mythos Preview : https://fortune.com/2026/04/10/bessent-powell-anthropic-mythos-ai-model-cyber-risk/
    • Euronews – Why Anthropic's most powerful AI model Mythos Preview is too dangerous for public release : https://www.euronews.com/next/2026/04/08/why-anthropics-most-powerful-ai-model-mythos-preview-is-too-dangerous-for-public-release

    Don't think, patch!

    Your feedback is welcome.
    Email: radiocsirt@gmail.com
    Website: https://www.radiocsirt.com Weekly
    Newsletter: https://radiocsirtenglishedition.substack.com/

    #RadioCSIRT #CyberSecurity #AI #ThreatIntelligence #CTI #ClaudeMythos #FinancialSector #Anthropic
    続きを読む 一部表示
    10 分
  • RadioCSIRT English Version - Special Edition Claude IA - Cyber Security Podcast, (Show 72)

    RadioCSIRT English Version - Special Edition Claude IA - Cyber Security Podcast, (Show 72)
    2026/04/11

    🎧🎙️Large Language Models & Cybersecurity Claude 4.6, Project Glasswing & Claude Mythos Preview

    Welcome to this special edition of RadioCSIRT ⚡️

    🤖 Claude 4.6 Family — A Cybersecurity Perspective Claude Opus 4.6, Sonnet 4.6 and Haiku 4.5 share a context window of up to one million tokens, multimodal text/image support and extended thinking capabilities. Direct implications for SOC teams: complete code repository analysis, massive IOC correlation, attack chain reconstruction — but also a significant reduction in the entry barrier for producing high-quality offensive artifacts.

    🔓 Economic Asymmetry of the Threat At five dollars per million tokens, Claude Opus 4.6 makes expert-level analytical reasoning accessible to a broad range of actors that previously required costly human expertise. The window between CVE publication and exploit availability is compressing. LLM-generated phishing lures no longer display the linguistic markers traditionally used for detection.

    🔬 Project Glasswing — Restricted Access Anthropic launched Claude Mythos Preview under an access framework limited to approximately forty partner organizations (Microsoft, Google, Amazon confirmed), by invitation only, following prior consultation with US authorities. The European Commission publicly endorsed this restriction.

    ⚠️ Claude Mythos Preview — Documented Capabilities The model can autonomously identify and exploit flaws across all major operating systems and web browsers, and construct sophisticated payloads and exploits in real time at low cost. On April 7, 2026, Treasury Secretary Scott Bessent and Jerome Powell convened an emergency meeting with the CEOs of major US banks (Bank of America, Citigroup, Goldman Sachs, Morgan Stanley, Wells Fargo) — the first meeting of this level motivated by the capabilities of a single AI model.

    🎯 Identified Risk Vectors Six dimensions covered in this episode: zero-day exploitation, systemic SIFI risk, algorithmic convergence, DeFi/smart contract exposure, customer data exfiltration, impact on cyber-insurance portfolios.

    ⚖️ Regulatory and Legal Context Anthropic is in active litigation with the Pentagon, which classified the organization as a supply chain risk. The forty Glasswing partners constitute a new indirect attack surface. The AI Act, DORA and ENISA guidelines create a compliance framework that applies now to LLM deployments in high-risk contexts.

    🛡️ Documented Defensive Use Cases Automatic generation of YARA/Sigma rules, alert enrichment, large-scale forensic analysis, assisted threat modeling, adversary simulation — the same capabilities serve both sides. LLMs remain analytical augmentation tools: human verification on high-impact operational outputs remains mandatory.

    🔗 Sources

    • Project Glasswing — Anthropic: https://www.anthropic.com/glasswing
    • Claude Models — Overview and Pricing: https://platform.claude.com/docs/en/about-claude/models/overview

    📩 Contact: radiocsirt@gmail.com

    ⚡️ We don't think, we patch!

    #RadioCSIRT #Cybersecurity #LLM #Claude #Anthropic #Glasswing #Mythos #ThreatIntelligence #SOC #CERT #CISO #AI #CyberSecurity #ProjectGlasswing #ZeroDay #SIFI
    続きを読む 一部表示
    25 分
  • RadioCSIRT English Version - Your Cyber Security Podcast, Feb 29th, 2026 (Ep.71)

    RadioCSIRT English Version - Your Cyber Security Podcast, Feb 29th, 2026 (Ep.71)
    2026/02/28

    We open this recap with the Winter Olympic Games in Milano Cortina, facing a wave of cyberattacks attributed to Russia. According to The Register, Italy’s Minister of Foreign Affairs confirmed the targeting of diplomatic offices and Olympic infrastructure. The defensive posture is further strained by supply chain tensions, as Cloudflare’s CEO threatened to withdraw pro bono protection services following a regulatory dispute with Italian authorities.

    In France, ZDNet reported an espionage case in Gironde involving a clandestine interception station operated from a rented Airbnb property. Two Chinese nationals were charged. The seized equipment was designed for sniffing Starlink communications and intercepting military frequencies, illustrating direct risk at the physical communications layer.

    We then move to active exploitation and emergency response requirements around Cisco Catalyst SD-wan. Australia’s cyber authorities published an alert on exploitation of Cisco SD-wan appliances. Cisa added CVE 2026 20127 and CVE 2022 20775 to the Known Exploited Vulnerabilities catalog and issued Emergency Directive twenty-six zero three, requiring immediate inventory, forensic artifact collection, patching, and compromise assessment, with a deadline of February twenty-seventh, twenty twenty-six. certfr confirmed active exploitation through alert certfr twenty twenty-six ALE zero zero two, and BleepingComputer reported exploitation activity dating back to twenty twenty-three.

    On the malware front, multiple campaigns highlight attacker focus on routers, developers, and stealth tooling. Cisco Talos detailed the dismantling of the DKnife interception framework used since twenty nineteen. Talos also documented the Dohdoor backdoor campaign using DNS over HTTPS through Cloudflare, delivered via DLL sideloading and process hollowing, with EDR bypass techniques involving syscall unhooking in ntdll dot dll. Kaspersky GReAT reported Arkanix Stealer operating as Malware as a Service, with both Python and C plus plus implementations, AES GCM communications, and indications of LLM-assisted development.

    Developer ecosystems remain a key battleground. Microsoft warned of fake Next dot js repositories used as job interview lures delivering in-memory JavaScript payloads, and GitLab banned one hundred thirty-one accounts linked to the Contagious Interview operation and the Wagemole scheme. Socket identified the SANDWORM underscore MODE campaign abusing at least nineteen malicious npm packages through typosquatting, including a module targeting AI coding assistants via malicious MCP server injection combined with prompt injection.

    We also cover phishing at industrial scale. As reported by KrebsOnSecurity, the Starkiller phishing as a service platform dynamically loads real login pages and acts as a reverse proxy, relaying keystrokes, form submissions, and session tokens through attacker infrastructure, effectively defeating multi-factor authentication by capturing the full authentication flow.

    Finally, critical vulnerabilities affected AI development environments. Check Point Research documented vulnerabilities in Anthropic’s Claude Code enabling command execution via project hooks, MCP consent bypass through project configuration, and clear-text exfiltration of Anthropic API keys by redirecting the ANTHROPIC underscore BASE underscore URL variable to an attacker-controlled endpoint. In parallel, Linux ecosystem updates included Linux seven point zero entering release candidate status, while incident response and law enforcement actions included Eurojust’s takedown of a fraudulent call centre in Dnipro.

    All sources are available on https://www.radiocsirt.com/podcast/your-cybersecurity-news-for-saturday-february-28-2026-ep-71/

    Don’t think, patch!

    Your feedback is welcome.
    Email: radiocsirt@gmail.com
    Website:https://www.radiocsirt.com
    Weekly Newsletter:https://radiocsirtenglishedition.substack.com/
    続きを読む 一部表示
    32 分