Good morning. This is your security briefing for Sunday, May 17, 2026, analyzing 18 articles. All attribution is by the article authors. All article analysis is automated.
Tencent reports on APT-C-55, also known as Kimsuky, a North Korean state-sponsored threat actor conducting attack campaigns that distribute malicious payloads through legitimate cloud services GitHub and Dropbox. The analysis examines the group's operational tactics and infrastructure abuse for payload delivery.
Bitdefender reports on FamousSparrow APT group, linked to Earth Estries, which conducted a multi-wave espionage campaign against an Azerbaijani oil and gas company from December 2025 to February 2026. The attackers exploited ProxyNotShell vulnerabilities in Microsoft Exchange servers and deployed Deed RAT and Terndoor backdoors with evolved DLL sideloading techniques, persistently re-entering the environment three times over two months using compromised domain administrator credentials despite remediation efforts.
Broadcom researchers discovered Fast16, a sophisticated sabotage framework dating to approximately 2005 that predates Stuxnet. The malware used kernel-level file system filters to covertly manipulate engineering simulation software, with the strategic objective of disrupting nuclear weapons research by introducing subtle inconsistencies into simulation results.
ReliaQuest reports that KongTuke, a financially motivated initial access broker, is using Microsoft Teams social engineering to impersonate help-desk staff and deploy ModeloRAT. The threat actor exploits Unicode whitespace to spoof display names and tricks victims into running a malicious Python-based toolkit via PowerShell, achieving persistence in under five minutes across multiple sectors with external Teams federation enabled.
Google Cloud reports on the UNC6671 threat actor conducting the BlackFile extortion operation using vishing to impersonate IT staff and deploy Adversary-in-the-Middle techniques to capture credentials and multi-factor authentication codes in real-time. The campaign targets organizations in North America, Australia, and the UK using Microsoft 365 and Okta, with attackers using automated scripts to exfiltrate data from SaaS platforms for extortion purposes.
Intezer reports on OrBit, a Linux userland rootkit that evolved over four years from Medusa, an open-source LD_PRELOAD rootkit available on GitHub. Multiple distinct threat actors have repackaged and weaponized this rootkit, transforming it from a passive standalone implant into a more aggressive multi-stage threat.
The FBI issued a public service announcement regarding a cyber-attack on a Learning Management System by ShinyHunters, a cyber-criminal group known for large-scale data breaches and extortion. The attack caused nationwide service interruptions for educational institutions, and the group employed aggressive tactics including harassment, threatening communications, and swatting to coerce ransom payments.
Sastu Insights reports on Microsoft's 2026 Secure Boot certificate update, which transitions Windows devices to a new boot manager signed by Windows UEFI CA 2023. IT-managed environments with deferred or blocked Windows Updates may not receive this update automatically, so administrators can manually trigger the update using Intune Remediations by setting specific registry keys to deploy necessary certificates.
V12 Security disclosed QEMUtiny, a critical memory corruption vulnerability in QEMU's CXL Type-3 device emulation that chains two out-of-bounds flaws to achieve arbitrary code execution. The vulnerability combines an out-of-bounds read and write in the CXL mailbox utility, allowing attackers to leak memory addresses and forge internal QEMU state for full system compromise in versions as of May 2026.
Akamai researchers discovered security vulnerabilities in three Model Context Protocol server implementations: Apache Doris MCP, Apache Pinot MCP, and Alibaba RDS MCP. The flaws include SQL injection, missing authentication, and unauthorized data exposure that could allow attackers to achieve full remote takeover of connected database instances, stemming from insufficient security validation between MCP servers and back-end systems.
According to reports from Rapid7 and Cisco Talos, a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller is being actively exploited in the wild. Remote unauthenticated attackers can bypass authentication by presenting a self-signed certificate and claiming to be a vHub, then inject SSH keys into the vmanage-admin account for persistent privileged access. Threat actors have been exploiting a chain of three vulnerabilities throughout March 2026, deploying web shells, command and control implants, cryptocurrency miners, and credential harvesters across ten distinct activity clusters.
V12 Security disclosed Fragnesia, a critical local privilege escalation vulnerability in the Linux XFRM ESP-in-TCP subsystem. The exploit allows unprivileged users to perform arbitrary byte writes into the kernel page cache of read-only files without requiring race conditions, enabling attackers to modify system binaries like su in memory to gain root access. All Linux kernels released before May 13, 2026 are affected, with mitigation requiring disabling specific kernel modules.
The kiddo-pwn team detailed the FFFFirefox project, a renderer remote code execution exploit developed for Pwn2Own Berlin 2026 targeting Firefox 150. The exploit leverages a use-after-free vulnerability in the Ion JIT compiler's array copy lowering and wasm garbage collection out-of-line storage path to achieve arbitrary code execution. Mozilla has patched the vulnerability in Firefox version 150.0.3.
Nightmare-Eclipse disclosed MiniPlasma, a Local Privilege Escalation exploit that achieves SYSTEM-level access on fully patched Windows 11 and Windows Server 2025 systems. The vulnerability exists in the Cloud Filter driver due to an ineffective patch for a previous vulnerability, with a public proof-of-concept now available on GitHub.
memN0ps reports on DoublePulsar, a sophisticated User-Defined Reflective Loader written in Rust that enhances stealth for adversary simulation frameworks like Cobalt Strike. The tool replaces default Cobalt Strike loaders to bypass file-based and memory-based security products, representing an evolution in offensive tradecraft as part of modular frameworks targeting Windows-based environments.
Sizeable-Bingus researchers demonstrate advanced call stack evasion techniques that remain effective against Intel's Control-flow Enforcement Technology. The method uses function proxying through legitimate loader artifacts and Windows Fibers to maintain clean call stacks, bypassing both traditional stack-scanning detection and hardware-level shadow stack protections.
Paul Newton identified a sophisticated operator panel that integrates with Evilginx Pro to automate Microsoft 365 account takeovers through Adversary-in-the-Middle attacks. The tool provides a user-friendly interface for managing stolen session tokens, uses refresh tokens for persistent access, and can be exported for sale in criminal marketplaces, significantly lowering the barrier for low-skill threat actors to execute high-impact attacks against M365 environments.
That concludes today's briefing.