🚨 ACTIVE EXPLOITATION
- FBI and Secret Service warn FortiBleed campaign against Fortinet firewalls and VPNs remains active
The FBI and Secret Service warn that the FortiBleed credential compromise campaign targeting Fortinet firewalls and VPN gateways remains active and can lead to ransomware attacks.- Fortinet firewall and SSL VPN gateway customers are targeted; SOCRadar verified more than 86,644 compromised devices across 194 countries, with an estimated 74,000-86,000 devices affected and 400,000-450,000 firewalls targeted by the wider operation.
- Attackers can disable accounts or change passwords to lock organizations out of their systems, and the FortiBleed attack chain has been observed as an initial entry point for ransomware affiliates including INC/Lynx and Payload.
- The campaign, believed linked to Russian-speaking threat actors, uses automated tools to scan for exposed devices and authenticates with credentials from previous breaches, password reuse, credential harvesting, and brute-force attacks.
- Legacy password storage with weaker hashing in older FortiOS versions can persist even after upgrades, leaving patched systems at risk.
- Victims span technology, telecommunications, construction, manufacturing, and government sectors worldwide, with the US among the most heavily affected.
🕵️ RESEARCH & DEEP DIVES
Linux backdoors mimic Korean and Taiwanese email security tools to evade detection
Rapid7 has uncovered Linux backdoors targeting telecom and network-edge appliances in South Korea and Taiwan that disguise their traffic as email and impersonate legitimate mail security products.- Rapid7 tracked a new BPFDoor variant and a BPF Rekoobe build against South Korean targets, plus a dropper and six builds of a previously unreported implant called AVERAT against Taiwanese appliances.
- The backdoors impersonate SpamSniper (Jiran Group's Korean anti-spam product) and ShareTech mail security appliances, copying PID files, process names, and services; one BPFDoor sample mimics Oracle telecom platform processes ("ora_ppmond").
- BPFDoor abuses Berkeley Packet Filter functionality to activate only on a magic packet; a controller now wraps the trigger in HTTPS POST requests to evade deep packet inspection, and launches TinyShell sessions for shell, upload, and download commands.
- AVERAT uses SMTP over TCP port 25 for C2 (beaconing every 600–699 seconds to mx.zxopfds[.]com), supporting file transfers, process termination, up to 10 concurrent shells, proxying, and shared-object module loading; its dropper derives an encryption key from the string "ShareTech."
- AVERAT relays run on compromised Taiwanese devices including a Synology NAS, a small-business appliance, and a Dahua video recorder, matching the CISA profile for China-nexus ORB networks, though attribution remains ongoing.
ClickFix Attacks Evolve to Hide Payloads via DNS TXT Records and Browser Cache
Threat actors are evolving ClickFix attacks to conceal payloads using DNS TXT records and browser cache pre-fetching, per new Flare and Microsoft Threat Intelligence research.- Targets are Windows users lured by fake CAPTCHA/verification pages into pasting attacker commands into Windows Run or PowerShell.
- Flare documented a CrocoRat RAT and crypto-stealer campaign where the pasted PowerShell command queries a DNS TXT record on an attacker-controlled server to fetch the next-stage instruction, keeping it out of the clipboard.
- The CrocoRat package includes a Python launcher that selects persistent remote access on corporate-looking systems and RAT plus credential/crypto stealers on personal systems.
- Microsoft Threat Intelligence found compromised websites pre-fetching a VBScript payload into the browser cache disguised as a PNG before the user runs the pasted command, hiding the payload and bypassing the ~260-character Run dialog limit.
- The cached payload is located by matching file size (files named 'f_'), run via wscript.exe, fetches PowerShell from cocojambo[.]us[.]com/alfa, injects into timeout.exe, and persists via a scheduled task; later stages contact capsysnet[.]vg and ciliabula[.]cc.
Rockstar Games hit by repeated breaches since 2018, none involving zero-days
Rockstar Games has been compromised four times since 2018, each via a different non-zero-day access path.- Affects Rockstar Games and parent Take-Two: source code, GTA VI dev build, and Snowflake data were stolen across incidents in 2022, early 2023, April 2026, and August 2026.
- 2022 Lapsus$: MFA fatigue push-notification spam against an employee, then plaintext hardcoded credentials and API keys found in Slack and Confluence; ~90 dev videos and source code exfiltrated.
- Early 2023: GTA Online PC P2P netcode reverse-engineered into RCE via malicious packets; fixed with kernel-level BattlEye.
- April 2026 ShinyHunters: long-lived OAuth service account tokens stolen from SaaS analytics vendor Anodit/Anodot replayed into Rockstar's Snowflake, exfiltrating 78.6M records of financial and player spending data; no Snowflake vulnerability exploited.
- August 2026 Cyberleek: exfiltrated a playable GTA VI dev build, 13+ gameplay videos, and full 'Leonida' map data from an unsegmented dev subnet; actor promoted a $CYBERLEEK memecoin, and fake 113GB 'build' downloads are padded malware with a 50KB payload.
🔓 CVEs & KEV
CVE-2026-86360 — Dell System Update — CVSS 9.6 — Dell System Update Path Traversal Leads to Unauthenticated Remote Root
CVE-2026-104070 — SPIP Crayons Plugin — CVSS 9.3 — Crayons Plugin for SPIP Missing Authorization Leads to Unauthenticated RCE
📋 ADVISORIES
📄 Source for Hackers exploit Ninja Forms and WPC Product Bundles XSS flaws to backdoor WordPress sites — bleepingcomputer.com
📄 Source for Fake ChatGPT, Gemini, and Claude AI Ads Portals Steal Credentials and MFA Codes via BitB Phishing — island.io