🕵️ RESEARCH & DEEP DIVES
China-nexus UAT-11587 targets Asian government and policy orgs with Antino backdoor
Cisco Talos uncovered a China-nexus actor, UAT-11587, targeting government and policy organizations across Asia with a previously undocumented Rust backdoor called Antino.- Targets include government, defense, diplomatic, legislative, and civil society organizations in Taiwan, India, the Philippines, and Cambodia — at least 16 institutional environments across eight countries and roughly 350 compromised endpoints by July 2026.
- Antino is a Rust-compiled Windows backdoor supporting reconnaissance, shell and PowerShell execution, file transfer, in-memory shellcode loading, and persistence.
- Its C2 channel operates exclusively through Microsoft 365, using Microsoft Graph to interact with Outlook and OneDrive as dead drops instead of a dedicated command server.
- Delivery begins with spear-phishing emails and tailored decoy documents leading into a five-stage infection chain, relying heavily on Cloudflare infrastructure for staging and tracking.
- Attribution to a China-nexus actor is based on Simplified Chinese decoy metadata, UTC+8 timestamps, use of the rsproxy.cn Rust mirror, and targeting aligned with Chinese intelligence interests.
FBI's Operation Blackout Dismantles Overseas Scam Compounds, Seizes ~$17 Billion
The FBI's Operation Blackout has disrupted overseas scam compounds targeting Americans, seizing roughly $17 billion and arresting hundreds.- Targets American consumers via cryptocurrency investment fraud, romance scams, and impersonation schemes run from industrial-scale compounds in Southeast Asia
- Roughly $17 billion seized or restrained, hundreds of suspects arrested, and thousands of trafficked workers freed
- 10,406 potential victims were warned pre-loss; 77% didn't know they were being scammed
- Fraud chains typically begin with unsolicited messages or seemingly accidental contact
- Operations expanding into central and sub-Saharan Africa signal network displacement
US-Focused CSuite Phishing Steals Microsoft 365 Sessions and Deploys RMM Tools
ANY.RUN researchers traced a US-focused CSuite phishing campaign that steals Microsoft 365 sessions and deploys remote-access tools.- Targets organizations in technology, manufacturing, government, and consulting, with 51% of 351 sandbox submissions from the US and 18% from India.
- Attacks start with business-themed lures impersonating Adobe, DocuSign, Zoom, Google Meet, Dropbox, and Microsoft 365.
- One path delivers BAT/VBS droppers or installers that deploy legitimate RMM tools like ScreenConnect or Action1 for persistent remote access.
- The other path uses credential-harvesting or device-code phishing to capture Microsoft 365 credentials and active sessions.
- A recurring /m/js/utils.js path on CSuite lure pages serves as a pivot artifact for identifying related activity.
Sanctions force CAs to revoke TLS certs for Russian and Iranian entities
US sanctions have led certificate authorities to revoke TLS certificates for government and critical-sector entities in Russia and Iran.- Affects government agencies, banks, and critical-sector organizations in US-sanctioned countries, mainly Russia and Iran.
- GlobalSign mass-revoked TLS certs for Russian customers in June; Iranian banks switched to Chinese providers and Russian banks to a state-run CA to stay online.
- The May US Treasury sanctions prohibit CAs from issuing certificates to governmental or restricted parties, though non-governmental users remain covered by exemptions.
- Consumers using Western browsers and OSes often don't trust the replacement state-run CAs, causing trust issues for end users.
📋 ADVISORIES
📄 Source for Bitget says $387.5M crypto heist began with zero-day exploits of third-party security appliances — x.com
📄 Source for WordPress WPMobile.App plugin <= 11.83 exposes sensitive data via missing authorization (CVE-2026-96342) — patchstack.com
🔓 CVEs & KEV
CVE-2026-77185 — Apache Software Foundation Apache MINA SSHD — CVSS 9.1 — Authentication bypass in sshd-core in Apache MINA SSHD ve...
CVE-2026-94053 — Apache Software Foundation Apache MINA SSHD — CVSS 9.1 — Apache MINA SSHD Pre-Auth LDAP Injection Enables Critical Bypass
CVE-2026-94052 — Apache Software Foundation Apache MINA SSHD — CVSS 9.1 — Apache MINA SSHD LdapPasswordAuthenticator Bypass Enables Unauthenticated Access
CVE-2026-76992 — CODESYS Development System 3 — CVSS 8.7 — Uncontrolled Memory Allocation in CODESYS Gateway ClientThe CODESYS Gateway C...
CVE-2026-103239 — MISP — CVSS 8.6 — MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Inject...
CVE-2026-10739 — Cato Networks SDP Client — CVSS 8.5 — Cato Networks SDP Client for Windows is vulnerable to Local Privilege Escalat...
CVE-2026-62146 — Red Hat OpenShift Container Platform 4 — CVSS 7.8 — Cri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime ...
CVE-2026-103242 — Red Hat Enterprise Linux 10 — CVSS 7.1 — Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_fil...
CVE-2026-10726 — Cato Networks SDP Client — CVSS 6.8 — Cato Windows SDP Client arbitrary file disclosure due to improper TLS certifi...
CVE-2026-81862 — Apache Software Foundation Apache Airflow Teradata provider — CVSS 6.5 — Apache Airflow Teradata provider: Teradata transfer operators embed cloud sto...
CVE-2026-86843 — Apache Software Foundation Apache Airflow Teradata provider — CVSS 6.3 — Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in...
CVE-2026-81930 — Apache Software Foundation Apache Airflow Snowflake provider — CVSS 6.3 — Apache Airflow Snowflake provider: Unvalidated account field redirects SQL AP...