🕵️ RESEARCH & DEEP DIVES
Volt Typhoon used covert 'Silent Train' network of rotating compromised devices in four zero-day campaigns
Lumen's Black Lotus Labs has revealed Volt Typhoon's covert 'Silent Train' framework of disposable compromised-device chains used for zero-day exploitation of US critical infrastructure.- Victims include telecom providers, government agencies, defense contractors, satellite and communications services, universities, IT/MSP firms, and critical infrastructure in water, energy, transportation, maritime, rail, aviation and emergency services; Hawaii, California and Texas were focal points.
- Silent Train, active since late 2023, uses one-time-use chains of compromised SOHO, IoT and enterprise devices assembled in under two minutes, with sessions averaging about four hours and full artifact cleanup afterward.
- Chains start from foreign VPS servers, relay through non-US SOHO/IoT devices, and exit via US-based compromised devices to evade geofencing and IP blocklists; 27+ device classes were exploited, including TP-Link, Netgear, Intelbras, Fortinet, Cisco, Zyxel and Cambium.
- Four confirmed zero-day campaigns: CVE-2024-39717 (Versa Director), CVE-2025-8875/CVE-2025-8876 (N-able N-central), CVE-2026-20127 (Cisco Catalyst SD-WAN Controller), and CVE-2026-16812 (Arista VeloCloud Orchestrator), plus a likely Quest KACE zero-day.
- Activity surged after the KV-botnet takedowns in late 2023 and early 2024, targeting endpoint/network management platforms, SD-WAN orchestrators and control-plane systems for credentials, data exfiltration and persistent access.
Sources 📄 Source: lumen.com · 📎 Coverage: zetter-zeroday.com · 👁 via BleepingComputer, The Hacker News (+1)DEVCORE's Orange Tsai publishes logic-only Microsoft Edge sandbox escape that won $175,000 at Pwn2Own
DEVCORE's Orange Tsai has published the logic-bug-only Microsoft Edge full-chain exploit that won $175,000 at Pwn2Own Berlin 2026.- Applies to Microsoft Edge on Windows; the chain escapes the browser sandbox and achieves code execution outside it
- Uses only logic bugs, no memory corruption — the first Chromium sandbox escape at Pwn2Own since 2016, built in about two months with no AI, under 100 lines of code
- The chain abuses a conditional access navigation throttle mismatch for UXSS, bypasses popup and origin checks via a hardcoded allowed list, reads the victim's email from assets.msn.com, then abuses Immersive Reader (read://) and a diagnostic zip function to write files anywhere on disk
- File write leads to RCE by overwriting a protocol-handler config file and planting a fake telnet binary in a user-writable path
- Fixed in Edge Stable 148.0.3967.70 on May 15, 2026 (CVE-2026-45492, CVE-2026-45494, CVE-2026-45495); no exploitation seen in the wild
Researcher claims 0-click Telegram sticker bugs chained to code execution on iOS
A researcher says new zero-click bugs in Telegram stickers can be chained to run code on iOS, days after ZDI disclosed a related rlottie flaw.- Affects Telegram apps on iOS, Android, and Desktop, which all render animated stickers via the rlottie library.
- Researcher Saifeldeen Aziz says he bypassed Telegram's server-side sticker checks and chained logic flaws with memory-corruption bugs for code execution on Telegram for iOS.
- Related flaw ZDI-26-757 (CVE-2026-111105) is a numeric truncation bug in rlottie causing a buffer underwrite, potentially leading to code execution; Telegram disputed it and ZDI published it as a zero-day on October 15.
- Aziz found the bugs by fuzzing rlottie with LLM assistance; the work was presented October 28 at OffensiveCon in Tokyo.
- A separate 269-byte sticker crash bug was fixed in Telegram Desktop 7.2.7.
Sources 📄 Source: zerodayinitiative.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security NewsLumen's Black Lotus Labs reveals Volt Typhoon's 'Silent Train' one-time daisy-chain infection infrastructure
Lumen's Black Lotus Labs has published a report detailing 'Silent Train,' Volt Typhoon's constantly changing chains of compromised devices used to breach US targets.- Targets include US government agencies, defense contractors, telecoms, emergency communication providers, universities, MSPs, and energy, water, rail, and shipping critical infrastructure operators, concentrated in Hawaii, California, and Texas.
- Silent Train is a daisy chain of compromised SOHO routers and IoT devices, used once per target then discarded and replaced, with each session often lasting only minutes to hours before artifacts are erased.
- Attack chain: compromise a VPS outside the US, pivot to a second VPS in a different region, then hop through a US-based SOHO router or IoT device to reach the target — assembled in under two minutes, suggesting automation.
- Devices compromised in early hops outside the US differ from those used inside the US, likely to thwart vendor visibility and defenders tracing the full infection path.
- Victims have had military documents and network structures exfiltrated and credentials stolen for long-term access; researchers say activity combines pre-positioning with espionage.
Researcher claims zero-click Telegram sticker flaws chained for iOS code execution
Security researchers have disclosed zero-click remote code execution flaws in Telegram's animated sticker processing, which Telegram denies.- Affects Telegram users, with confirmed impact on Telegram for Android and Telegram Desktop for Linux; iOS impact claimed by researcher Saifeldeen Aziz.
- Flaws lie in the rlottie animated sticker (TGS) rendering library, including a numeric truncation bug tracked as ZDI-CAN-30207 / advisory ZDI-26-757 (CVE-2026-111105) causing a buffer underwrite and code execution.
- Attack works by sending a crafted animated sticker; the app parses it automatically for preview generation on receipt, so no user click or download is required and disabling auto-download does not help.
- Aziz says he used LLM-assisted fuzzing to find memory-corruption bugs in iOS, Android, and Desktop clients, then chained them with logic flaws in sticker delivery to bypass Telegram's server-side checks and achieve code execution on iOS.
- Trend Micro ZDI originally scored the flaw 9.8, lowered it to 7.0 citing Telegram's server-side checks, and Telegram publicly called the vulnerability fake; Italy's ACN/CSIRT issued an official alert.
SEO poisoning campaign targets DeepSeek searchers with Kong RAT via multi-stage attack
A Chinese threat actor is using SEO poisoning to deliver Kong RAT to users searching for the DeepSeek AI tool.- Targets Chinese-speaking developers and IT professionals searching for DeepSeek; continues an April 2026 campaign that abused searches for FinalShell, Xshell, and Clash proxy
- DeepSeek lookalike domains (e.g., deepseekcn[.cyou]) rank on first-page search results and serve a 100MB+ 'DeepSeekV20.66-Setup.zip' with a weaponized MSI installer
- Multi-stage chain: MSI drops signed DeepSeekV20.66.exe and malicious Setupapp.exe, which downloads 'mao.mp4' shellcode from yyuupkk789.oss-cn-hongkong.aliyuncs[.]com
- Legitimate Cyglaunch.exe is DLL side-loaded via a scheduled task; persistence is achieved by modifying the Userinit registry value
- Kong RAT communicates with m.tysdt123[.]com on port 5947 using a custom protocol and includes keylogger functionality; attribution hints from a PDB path referencing the Chinese forum '52pojie'
iot-proxy-abuse-report — Cybersecurity Dive
gitee-secrets-scanning — r/netsec
owasp-chatgpt-hacking-test — cryptika.com (discovered)
📋 ADVISORIES
TeamViewer patches three high-severity client flaws enabling code execution and macOS root access
TeamViewer has patched three high-severity vulnerabilities in its remote desktop clients that could allow code execution or macOS root escalation.- Affects client components in TeamViewer Remote, Tensor, and ONE; fixes shipped in bulletin TV-2026-1011 on October 27, 2026, with version 15.83 or latest release
- CVE-2026-92372 (CVSS 8.8): heap overflow in the screen-image decoder of Full Client for Linux and macOS before 15.83; crafted screen-image data or a malicious .tvs session recording can cause arbitrary code execution
- CVE-2026-111585 (CVSS 8.8): integer overflow leading to heap-based buffer overflow in screen processing; a malicious remote host can crash the viewer or execute code with viewer privileges on Windows, Linux, macOS Full Client, Windows Portable, and Android Remote Control app before 15.83
- CVE-2026-92374 (CVSS 7.8): TOCTOU race plus symlink handling flaw in the privileged macOS helper lets a local low-privilege attacker bypass package verification and escalate to root
- Legacy branches 15.64.10 (Windows 7/8), 14.7, and 13.2 also received fixes; TeamViewer said no active exploitation was known at publication
WordPress 7.1.4 security release fixes 22 vulnerabilities, including unauthenticated upgrade RCE
WordPress has released 7.1.4 fixing 22 vulnerabilities across 17 advisories,