Cyber security developments for Monday the 18th of May 2026 covering articles added to the BlueTeamSec community on infosec.pub. Today we have 13 articles to cover. All attribution is by the article authors. All article analysis is automated.
S3N4T0R have published an adversary simulation writeup on Static Kitten, a threat actor targeting diplomatic, maritime, financial, and telecommunications organisations across the Middle East since early this year. The campaign uses Word documents with obfuscated macros to drop a Rust-based implant called RustyWater, which represents a shift toward more modular and stealthy tooling. One for those tracking Middle Eastern threat landscapes or Rust-based malware development.
Cato Networks have written up a suspected Chinese operation from April targeting a global manufacturer with TencShell, a previously undocumented implant based on the open-source Rshell framework. The attackers came in via a third-party connection and used Donut shellcode disguised as a web font file for in-memory execution. Worth a look if you're tracking supply chain entry points or Go-based tooling in espionage campaigns.
Thoma Bravo have reported on Twill Typhoon, a Chinese group conducting espionage in the Asia-Pacific region using an updated version of the FDMTP backdoor. The attack chain leverages DLL sideloading with legitimate executables and infrastructure mimicking Yahoo and Apple CDNs to deploy a heavily obfuscated .NET remote access tool. Particularly relevant if you're monitoring Chinese activity in that region or tracking DLL sideloading techniques.
A technical guide from tsale covers the Admiralty System, the NATO intelligence assessment framework used to evaluate source reliability and information credibility in threat intelligence work. It provides a structured alphanumeric rating system for assessing breach claims, threat actor advertisements, and dark web intelligence. Adds useful context if you're developing or refining CTI processes.
Delphos Labs have disclosed DirtyCBC, a critical Linux kernel vulnerability in the network protocol implementation that exploits a decrypt-before-MAC flaw to enable page-cache poisoning. Attackers can write arbitrary data into the page cache before authentication is verified, potentially hijacking SUID-root binaries without touching the disk. This demonstrates how authenticated encryption falls apart when mutable operations happen on unauthenticated data, which is notable for anyone working on kernel-level security.
Researchers have identified a fingerprinting vulnerability in Mullvad VPN where the exit IP selection algorithm uses the user's public key as a seed, causing the same exit IPs to be chosen consistently. This creates a persistent fingerprint that undermines anonymity across different servers. One for privacy-focused organisations or anyone evaluating VPN implementations.
Fortinet have disclosed a critical improper access control vulnerability in FortiAuthenticator API endpoints that allows unauthenticated attackers to execute code via crafted requests. Affected versions include 8.0.0 through 8.0.2, 6.6.0 through 6.6.8, and 6.5.0 through 6.5.6, with patches now available. No active exploitation observed as of publication, but flag this if you're running FortiAuthenticator in your environment.
The LID project from Azizcan DaΕtan reveals three critical Linux kernel vulnerabilities where security operations bypass the LSM framework entirely, affecting AppArmor, SELinux, and Smack. These include eBPF pathname rewriting, io_uring file descriptor transfers without security hooks, and the new mount API lacking proper LSM coverage. The flaws allow unauthorized file access and privilege escalation whilst evading audit logging on kernel versions 5.18 through 7.1-rc3, which is rather problematic for anyone relying on these security modules.
Gurucul have documented a campaign distributing a trojanized version of HWMonitor 1.63 hardware monitoring software to deploy STX RAT via DLL sideloading. The malicious package bundles a legitimate application with a weaponised CRYPTBASE.dll to bypass security controls and establish remote access. This targets users downloading software from untrusted third-party sources, which remains a reliable entry point.
Palo Alto have published analysis on how state-sponsored actors and ransomware groups are actively exploiting insecure default configurations in Active Directory Certificate Services for privilege escalation. Attackers leverage misconfigured certificate templates and permissive enrollment rights to impersonate privileged accounts and achieve domain-wide access without needing any zero-days. Worth reading if you're managing AD CS in your environment or reviewing certificate template configurations.
Socket have reported that the popular node-ipc npm package was compromised after an attacker registered an expired email domain and gained control of a dormant maintainer account. Three malicious versions were published containing credential-harvesting malware targeting cloud provider configurations, SSH keys, and developer credentials, exfiltrating data via DNS TXT queries. Flag this if you're using node-ipc or conducting software supply chain risk assessments.
Palo Alto have written up a new variant of Gremlin Stealer employing instruction virtualisation via commercial packing utilities, string encryption in embedded resources, and control-flow obfuscation to evade detection. The stealer targets credentials from browsers, cryptocurrency wallets, FTP and VPN clients, and payment cards, exfiltrating to a newly identified command and control server. The use of identifier renaming and runtime decryption makes both static and dynamic analysis rather more tedious than usual.
And finally, axelarator have documented building a network threat hunting lab using Proxmox, Zeek, and Arkime for full packet capture analysis. The lab demonstrated detection of simulated attacks including Nmap scanning, SMB enumeration, Nishang reverse shells, and Sliver command and control communications through network-level telemetry. This one's useful background if you're setting up packet capture capabilities or expanding your threat hunting toolkit.
That concludes today's briefing.