Good morning. This is your security briefing for Tuesday, April 14, 2026, analyzing 14 articles. All attribution is by the article authors. All article analysis is automated.
CloudSEK has published analysis revealing that Iran-linked Charming Kitten conducted extensive cyber reconnaissance across Gulf Cooperation Council nations prior to coordinated missile strikes in retaliation for Operation Epic Fury. The group exploited multiple critical vulnerabilities to breach infrastructure in the UAE, Saudi Arabia, Jordan, Kuwait, and Israel, deploying custom malware including BellaCiao webshell and Sagheb RAT to pre-position access that directly facilitated kinetic targeting.
Following on from coverage earlier this week, Panther has detailed a North Korean OtterCookie infostealer campaign conducted through npm between April 6 and 9, 2026, using obfuscated malicious packages to steal credentials and files. The malware employed benign wrapper packages impersonating legitimate libraries, custom encoding, and established persistence on Linux systems via SSH backdoors with exfiltration through Vercel-hosted command and control infrastructure.
Genians Security Center has analyzed an APT37 pretexting campaign that used fake Facebook profiles to establish trust with targets before tricking them into installing a tampered Wondershare PDF installer containing shellcode. Attackers then delivered follow-up payloads disguised as image files through a compromised Japanese real estate website, targeting individuals with interest in military affairs based on the weapons-themed lures used.
Lawrence Douglas has published analysis of a Kimsuky APT Group phishing campaign targeting South Korean military and defense sector personnel. The attack deployed malicious link files to execute VBScript and PowerShell payloads, establishing persistence via scheduled tasks, escalating privileges through UAC bypass, and ultimately installing Google Chrome Remote Desktop for remote access, with an eight-hour observation period before deploying privilege escalation components.
A technical dossier details how DPRK-linked threat actor PolinRider has compromised over 1,950 public GitHub repositories affecting more than 1,000 owners through heavily obfuscated JavaScript payloads injected into legitimate project configuration files. The campaign leverages compromised npm packages and weaponized coding test projects, representing a major supply chain attack merged with the TasksJacker cluster.
Analysis has been published on the collaboration between EvilCorp, a sanctioned Russian cybercriminal enterprise, and RansomHub, a prominent Ransomware-as-a-Service operation. EvilCorp uses SocGholish JavaScript malware for initial access followed by RansomHub ransomware deployment, raising concerns about sanctions violations as payments to EvilCorp are illegal, which could lead to RansomHub facing similar sanctions and increased law enforcement scrutiny.
Montysecurity's C2 Tracker project, a community-driven threat intelligence feed that collected IP addresses of malware, botnets, and command and control infrastructure by searching platforms like Shodan, has been archived and is no longer actively maintained. The project historically tracked frameworks like Cobalt Strike and Metasploit, various malware families, and botnets, though it can still be run locally for historical analysis.
Google has integrated a memory-safe Rust DNS parser into the cellular baseband modem firmware for Pixel 10 phones to mitigate memory-safety vulnerabilities. The implementation uses the hickory-proto Rust crate compiled as a static library and integrated into the existing C and C plus plus build system, proactively targeting a critical attack surface exposed to network-level threats.
Cyera Research has disclosed a high-severity authorization bypass vulnerability in Docker Engine versions prior to 29.3.1 affecting deployments using authorization plugins. The flaw allows attackers to bypass authorization middleware by padding request bodies beyond one megabyte, enabling creation of privileged containers with root access to the host filesystem for data exfiltration and privilege escalation.
A security researcher has identified a vulnerability in Microsoft's driver that allows local administrators to bypass protections and access sensitive data in Protected Processes like lsass through IOCTL code. The flaw stems from insufficient validation of service configurations and IOCTL origin, enabling credential theft and system compromise, though Microsoft does not currently consider this a security vulnerability requiring immediate patching.
Microsoft has detailed a sophisticated phishing campaign exploiting the device code authentication flow that is actively compromising organizational accounts using the EvilTokens phishing-as-a-service toolkit. Attackers use AI-driven infrastructure and browser-in-the-browser techniques to bypass multi-factor authentication, then establish persistence through device registration and malicious inbox rules while exfiltrating sensitive data, with the campaign targeting high-value roles in financial, executive, and administrative positions.
InfoGuard Labs has published a deep dive into VIPERTUNNEL, a Python backdoor used by threat actors linked to UNC2165 and EvilCorp, notably deployed during DragonForce ransomware operations. The malware establishes a SOCKS5 proxy tunnel to command and control servers for network pivoting, using sophisticated persistence via sitecustomize auto-import and obfuscated DLL execution, targeting Windows systems in association with FAKEUPDATES infections and ShadowCoil credential-stealing malware.
Security researchers have analyzed a .NET crypter delivering XWorm RAT payloads containing a UEFI bootkit with BlackLotus DBX bypass and LogoFAIL exploitation, an r77 userland rootkit, driver infection capabilities, and a zero-day UAC bypass exploiting Windows Error Reporting. The crypter contained hardcoded decryption keys and deployed dual-architecture payloads targeting both x64 and x86 Windows systems, combining multiple advanced persistence and evasion techniques including bootkit installation, kernel driver modification, and Windows Defender disablement.
Calif has reported that an AI model named Claude successfully developed a full remote kernel exploit chain for FreeBSD 14, achieving root-level remote code execution. The exploit leveraged vulnerabilities in NFS kernel threads and exploited the absence of KASLR and stack canaries in FreeBSD, representing a significant advancement in AI-assisted exploit development capabilities.
That concludes today's briefing.