Good morning. This is your security briefing for Monday, April 13, 2026, covering 15 articles. All attribution is by the article authors. All article analysis is automated.
CloudSEK reports that APT35, also known as Charming Kitten and linked to Iran's IRGC, conducted extensive cyber reconnaissance and pre-positioning operations across GCC countries between February and April 2026. The campaign exploited ProxyShell and Log4j vulnerabilities to deploy BellaCiao malware and Sagheb RAT, establishing persistent access in Jordan, UAE, Saudi Arabia, Israel, and Kuwait, apparently designed to support potential kinetic military operations following Operation Epic Fury.
According to Tracking Adversaries CTI blog and InfoGuard Labs, EvilCorp, a sanctioned Russian cybercriminal group, has been identified as an affiliate of the RansomHub ransomware-as-a-service operation. EvilCorp uses SocGholish malware for initial access and deploys the VIPERTUNNEL Python backdoor, a sophisticated tool that uses layered obfuscation and functions as a SOCKS5 proxy for network pivoting, before delivering RansomHub ransomware payloads, creating significant sanctions risks for victims who pay ransoms.
Multiple reports detail North Korean threat actor campaigns. Breakglass Intelligence and Lawrence Douglas describe Kimsuky APT group targeting South Korean Naver users and military institutions with CHM phishing payloads that execute three-stage infection chains using legitimate Windows tools for reconnaissance, persistence via scheduled tasks, and keylogging. Panther identified a separate campaign by DPRK's FAMOUS CHOLLIMA deploying OtterCookie infostealer through malicious npm packages between April 6 and 9, targeting credentials and establishing SSH backdoors on Linux systems. Genians Security Center reports APT37 conducted social engineering via Facebook to deliver a trojanized Wondershare PDF installer employing advanced evasion techniques including process injection and encrypted command and control communication. Most significantly, an open source investigation documented DPRK-linked threat actor PolinRider compromising over 1,951 GitHub repositories and 1,047 unique owners by injecting obfuscated JavaScript malware into legitimate project configuration files, representing a significant supply chain attack with potential widespread impact.
Monty Security announced that the C2 Tracker project, a community-driven initiative that collected IP addresses of malware, botnet, and command and control infrastructure using Shodan searches, has been archived and is no longer actively maintained. Organizations relying on this feed for real-time threat intelligence must now seek alternative actively maintained sources.
Google announced it has integrated Rust into the Pixel 10 modem firmware's DNS parser to reduce memory-safety vulnerabilities in the baseband. The implementation uses the hickory-proto library integrated as a static library via FFI with existing C and C++ code, reducing the memory-unsafe attack surface and potential for remote code execution through malformed DNS queries.
Cyera Research discovered a critical authorization bypass vulnerability in Docker Engine's authorization middleware, rated 8.8 High severity. The flaw allows attackers to exploit a size check on request bodies exceeding one megabyte to bypass security policies and create privileged containers, affecting all enterprise Docker deployments using authorization policies including CI/CD systems and multi-tenant environments.
A GitHub researcher documented a vulnerability in Microsoft's KslD driver, part of Microsoft Antimalware, that allows local administrators to exploit specific IOCTL code to access sensitive data in protected processes like lsass. The driver fails to adequately verify configuration tampering or validate that requests originate from legitimate Microsoft Antimalware processes, enabling attackers to bypass security protections through custom service configurations, though Microsoft does not currently classify this as critical.
Microsoft reports a sophisticated phishing campaign observed in April 2026 that exploits the legitimate OAuth 2.0 device code authentication flow to bypass multi-factor authentication and gain unauthorized access to user accounts. Threat actors send deceptive emails prompting users to authorize malicious sessions via microsoft.com/devicelogin, granting attackers access without credentials, with post-compromise activities focusing on high-value targets for data exfiltration and establishing persistence through malicious inbox rules.
Calif documented a significant development in AI security research: an AI system named Claude autonomously discovered and developed a working remote kernel remote code execution exploit for FreeBSD within 8 hours, achieving root shell access. The exploit involved stack overflow, ROP chains, and multi-round shellcode delivery targeting the RPCSEC_GSS service, representing the first known instance of AI independently completing full exploit development for a remote kernel vulnerability.
A reverse engineer analyzed a .NET crypter that revealed two embedded XWorm RAT payloads part of the 'Superiority' campaign. The malware incorporates advanced capabilities including a UEFI bootkit, r77 userland rootkit, driver infection, and a zero-day UAC bypass for deep system persistence, using hardcoded decryption keys and PowerShell to disable Windows Defender before deploying both 64-bit and 32-bit payloads.
That concludes today's briefing.