Good morning. This is your security briefing for Friday, April 10, 2026, covering thirteen articles analyzed overnight. All attribution is by the article authors. All article analysis is automated.
According to a joint advisory from the Canadian Centre for Cyber Security, FBI, NSA, and international partners, Russian GRU threat actors have been exploiting vulnerable small office and home office routers worldwide to conduct DNS hijacking and steal sensitive information from military, government, and critical infrastructure entities. International law enforcement recently disrupted the compromised router network, and defenders are urged to remediate vulnerabilities, upgrade end-of-life devices, and disable remote management.
JUMPSEC reports that the Iranian MuddyWater threat group is a customer of TAG-150, a Russian-developed Malware-as-a-Service platform that deploys ChainShell, a previously undocumented Node.js blockchain command and control agent. The investigation linked Iranian infrastructure to this multi-tenant platform through scripts found on MuddyWater servers, with targets including Israeli IP ranges and FortiOS systems.
Lookout has identified a hack-for-hire campaign linked to BITTER APT that has been targeting civil society members in the Middle East since at least 2022. The operation uses social engineering and spearphishing to deliver ProSpy Android spyware disguised as secure messaging apps, primarily affecting journalists and opposition politicians in Egypt, with additional targets in Bahrain, UAE, Saudi Arabia, the UK, and potentially the US.
Aikido reports that the GlassWorm threat actor group deployed a trojanized OpenVSX extension impersonating WakaTime that uses a Zig-compiled native binary dropper to infect multiple development environments on a victim's machine. The dropper enumerates installed IDEs supporting VS Code extension format and injects a second-stage malicious extension that exfiltrates data, communicates with a Solana-based command and control server, and can install a persistent remote access tool and malicious Chrome extension.
Microsoft has introduced new Kusto graph functions, Lift underscore To underscore Graph and Graph underscore Render underscore View, that transform tabular security data into visual graph representations within Azure Data Explorer. The functions enable security analysts and threat hunters to visualize executable behavior patterns and Service Principal activities for detection, hunting, and incident response.
Microsoft announced a preview of custom graphs in Microsoft Sentinel, a new capability that enables security analysts to build tailored security graphs for enhanced investigations. The feature uses Jupyter notebooks, Python for Spark, and Graph Query Language to visualize complex entity relationships and uncover hidden attack patterns, helping defenders assess incident blast radius and detect behavioral attack chains.
The U.S. Department of the Treasury has launched a cybersecurity information sharing initiative targeting the digital asset industry. The program provides eligible U.S. digital asset firms with the same actionable threat intelligence shared with traditional financial institutions to help detect, prevent, and respond to cyber threats, with firms able to contact OCCIP at no cost.
A breach of Oracle Cloud infrastructure exposed approximately 6 million records belonging to over 140,000 tenants in an incident labeled 'Oracle SSO, SOS.' The widespread data exposure affected Oracle Cloud customers, though technical details about the attack method were not disclosed.
The ASTRA64.sys driver by EnTech Taiwan and Sysinfo Lab contains vulnerabilities that expose dangerous kernel primitives to user mode without validation, enabling arbitrary physical memory read and write, port I/O operations, and model-specific register access. These flaws allow attackers to bypass kernel address space layout randomization, steal credentials, evade endpoint detection and response and antivirus solutions, and manipulate kernel memory on 64-bit Windows systems.
Security researcher Richard Warren details two NSIS installer framework vulnerabilities that were exploited to achieve SYSTEM-level privilege escalation on Windows systems running Zscaler Client Connector. The vulnerabilities involve insecure temporary directory handling during uninstallation and a race condition in plugin loading, exploitable through DotLocal redirection, NTFS junctions, and RPC callback bypass techniques.
Jamf Threat Labs reports a new macOS malware campaign dubbed ClickFix that delivers Atomic Stealer infostealer by using Script Editor application instead of Terminal to evade security controls. The attack uses deceptive webpages mimicking Apple notifications and leverages the applescript URL scheme to execute obfuscated scripts that download and run the payload, bypassing macOS's Terminal-focused command scanner security feature.
Security researchers developed an automated tool using symbolic execution and the Z3 theorem prover to generate magic packets that trigger dormant Linux malware like BPFDoor. The technique reduces analysis time of sophisticated Berkeley Packet Filter socket programs from hours to seconds, targeting malware previously used against telecommunications, education, and government sectors in Asia and the Middle East.
That concludes today's briefing.