💥 BREACHES & INCIDENTS
- Cyberattack forces University of New Mexico Health to divert ambulances and close clinics
A cyberattack forced the University of New Mexico Health System to divert ambulances, close clinics, and shut down its largest academic medical center.- UNM Health System, operator of New Mexico's only Level 1 trauma center with ~900,000 outpatient and 100,000 ER visits annually, was hit Monday, October 26
- All ambulance traffic was diverted to other hospitals, appointments at more than 30 clinics were canceled, and Health Sciences Center classes were called off
- Hacked computers played audio messages claiming hackers had stolen students' and employees' personal information, Social Security numbers, private documents, and emails
- Employees were told to shut off and unplug computers and switch to paper processes; hospitals and clinics began resuming operations in phases Monday evening
- The FBI is assisting in the investigation; UNM previously suffered a 2021 attack that compromised data of more than 1.2 million people
🕵️ RESEARCH & DEEP DIVES
DarkCore RAT Sold With Session-Hijacking Browser That Routes Traffic Through Victims' IP Addresses
BlackFog researchers uncovered DarkCore, a Windows RAT marketed with a browser that reuses stolen Gmail and WhatsApp sessions while disguising access behind victims' IP addresses.- Targets Windows users; the malware is sold on a cybercrime marketplace (listing dated August 11, 2026) with credential theft, file transfer, reverse proxy, and hidden desktop (HVNC) capabilities.
- Advertised browser injects stolen session cookies to access Gmail, WhatsApp, YouTube, and MediaFire, routing traffic through the infected machine's IP so unauthorized access looks legitimate; some browser features remain seller claims, not fully verified.
- Delivery uses a PDF-themed shortcut (PdfView.lnk) that runs obfuscated commands to download a real World Bank report as a decoy plus an executable, and strips the Zone.Identifier mark to reduce warnings.
- The unsigned 64-bit sample uses direct TCP C2 (217.156.8[.]148:43592), with Tor and WebSocket disabled; modules load in memory or via temporary DLLs.
- IOCs include hxxps://update[.]cdnlinks[.]org/ReportPDFReader.exe and SHA-256 hashes for ReportPDFReader.exe (2deedea0...), PdfView.lnk (5102c02a...), and an embedded DLL (0530f782...).
TRUST#GRAFT attack abuses logged-in WordPress admin sessions to install hidden PHP backdoor
A JavaScript loader named TRUST#GRAFT hijacks signed-in WordPress admin browser sessions to silently install a PHP backdoor plugin.- Applies to WordPress sites whose administrators browse other websites while signed in to wp-admin in the same browser profile.
- The attack requires the visitor to already be an administrator with plugin-install rights; it is not a standalone login bypass.
- The JavaScript shows a fake Cloudflare 'Just a moment' screen, collects device details, then reuses the admin's cookies and nonce to upload and activate a malicious plugin ZIP (wm.zip).
- The fake 'Web Media Optimizer 2.1' plugin copies itself to wp-content/mu-plugins/wmedia-recovery.php for persistence, injects remote JavaScript, disables TLS checks, and can set an admin login cookie via a hardcoded token.
- IOCs include loader domains gerlace[.]com, vtevens[.]icu, caapman[.]me and C2 domain vilialobos[.]lol; Securonix has not confirmed how the initial script is delivered.
Sources 📄 Source: securonix.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)Attackers abuse VLC and VMware Tools via DLL side-loading in Brazil/Portugal malware campaigns
WatchGuard researchers found three malware campaigns using DLL side-loading of legitimate VLC Media Player and VMware components to deliver Overlord RAT and Lampion banking malware.- Targets users in Brazil and Portugal via fake legal notices, financial documents, and invoice download pages; campaigns deliver Overlord RAT and Lampion banking malware
- Attackers place malicious DLLs beside legitimate executables (vlc.exe, a .NET Framework utility, a VMware network utility) so trusted apps load the malicious library, often from a temp folder named Adobe
- Overlord RAT arrives via phishing emails impersonating Brazilian notary offices with obfuscated VBScript downloading MSI installers from Google Cloud Storage or Dropbox; batch scripts add Defender exclusions and create scheduled tasks
- The VMware chain uses a fake CAPTCHA on a Portuguese invoice page to deliver an ISO containing VBScript, a genuine VMware utility, and a malicious DLL that XOR-decrypts a Pascal RAT payload with remote control, screen capture, and persistence
- IOCs include C2 IPs 191[.]96[.]225[.]125, 45[.]158[.]8[.]213, 148[.]224[.]62[.]243:7777 and notary-impersonation domains like cartorioquintela[.]com and tabelionatojoinville[.]com
Sources 📄 Source: watchguard.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)
🔓 CVEs & KEV
CVE-2026-116838 — Ubiquiti Inc airMAX M — CVSS 8.8 — A malicious actor who lures an authenticated user to a malicious page could e...
CVE-2026-116837 — Ubiquiti Inc airMAX M — CVSS 8.8 — A malicious actor with access to the adjacent network could exploit a Heap-ba...
CVE-2026-116836 — Ubiquiti Inc airMAX M — CVSS 8.8 — A malicious actor with access to the adjacent network and under certain condi...
CVE-2026-116843 — mistralai mistral-vibe — CVSS 8.7 — Mistral Vibe before 3.0.3 RCE via Git Filter Drivers in Worktree ModeMistral ...
CVE-2026-116839 — Ubiquiti Inc airMAX M — CVSS 7.1 — A malicious actor who lures an authenticated user to a malicious page could e...
📰 UNDER-REPORTED
- 📄 Source for BlackX UEFI bootkit revives BlackLotus techniques to bypass Windows Secure Boot in APT41-linked espionage attacks — securelist.ru