Cyber security developments for Tuesday the 19th of May 2026 covering articles added to the BlueTeamSec community on infosec.pub. Today we have 13 articles to cover. All attribution is by the article authors. All article analysis is automated.
Cato Networks spotted a China-linked actor targeting a global manufacturer with something they're calling TencShell β a previously undocumented implant written in Go. The attack chain uses Donut shellcode and disguises itself as a web font file to inject into memory, which is a nice touch for evasion. One for threat hunters working in manufacturing.
Darktrace have written up Twill Typhoon using an updated version of the FDMTP backdoor to go after targets in Asia-Pacific and Japan. The campaign's been running since late September, and they're impersonating CDN services like Yahoo and Apple to deliver a modular .NET remote access tool. Finance sector appears to be on the receiving end.
S3N4T0R published an adversary simulation for Static Kitten, who've been going after diplomatic, maritime, financial, and telecom targets across the Middle East since January. They've moved to Rust-based implants called RustyWater with an eight-layer anti-analysis system and process injection into explorer β worth a look if you're tracking Middle Eastern threat activity.
Delphos Labs disclosed DirtyCBC, a local privilege escalation flaw in the Linux kernel's networking stack. It's a decrypt-before-verify problem that lets attackers poison the page cache with unauthenticated data, potentially overwriting SUID binaries. Structural cryptographic issue rather than a simple coding error, which makes it particularly interesting.
A privacy researcher found that Mullvad VPN's exit IP assignment is deterministic based on your WireGuard key, which means you get the same relative percentile of IPs across all servers. That's exploitable for user correlation across sessions β not ideal for a service built around anonymity.
Fortinet patched a critical improper access control flaw in FortiAuthenticator's API, tracked as CVE-2026-44277. Unauthenticated remote code execution via crafted requests, scored at 9.1. No active exploitation reported yet, but given the severity, one to patch promptly if you're running affected versions.
Azizcan DaΕtan released the LID project, which demonstrates how to bypass AppArmor and SELinux entirely using eBPF to rewrite pathnames and manipulate syscall arguments before the Linux Security Module framework even sees them. Zero audit footprint, works on kernels from 5.18 through current release candidates. Architectural rather than implementation issue, which is the uncomfortable bit.
Gurucul documented a trojanised version of HWMonitor being distributed to deliver STX RAT via DLL sideloading. The malicious package was hosted on Cloudflare infrastructure and uses CRYPTBASE.dll sideloading for a memory-resident infection chain. Standard supply chain compromise targeting users downloading from untrusted sources.
Palo Alto Networks published a detailed look at Active Directory Certificate Services exploitation in the wild. State actors and ransomware groups are going after insecure default configurations to achieve privilege escalation and persistence β not zero-days, just badly configured certificate templates. If you're running AD CS, this one's worth the time.
Socket reported that node-ipc was compromised after an attacker registered an expired email domain and took over a dormant maintainer account. Three malicious versions were pushed containing credential stealers that exfiltrated data via DNS TXT records. Affects developer machines and CI/CD environments, so check your dependencies if you're using this package.
Axelarator wrote up using full packet capture with Arkime and Zeek to detect threats that host-based logging might miss. Lab work showed how JA4 fingerprinting can spot PowerShell and curl-based payload downloads, as well as Sliver command and control traffic. Useful primer if you're looking to add network-level visibility to your detection stack.
A technical guide from tsale covers the Admiralty System, which is NATO's standardised framework for evaluating source reliability and information credibility. Two-axis scoring for CTI and OSINT work β helpful reference if you're trying to systematically assess claims from vendor reports or dark web chatter.
And finally, Palo Alto Networks documented the latest evolution of Gremlin stealer. It's now using instruction virtualisation and XOR-encoded payloads hidden in .NET resources, with added crypto clipper functionality and WebSocket-based session hijacking. At time of discovery, the C2 infrastructure had zero detections on VirusTotal, which tells you something about the obfuscation quality.
That concludes today's briefing.