Cyber security developments for Wednesday the 27th of May 2026 covering articles added to the BlueTeamSec community on infosec.pub. Today we have 16 articles to cover. All attribution is by the article authors. All article analysis is automated.
The Insider reports that Putin has appointed Andrei Kozlov, a Rostec cybersecurity specialist with documented ties to GRU Military Unit 26165, better known as Fancy Bear, as aide to Sergei Shoigu in Russia's Security Council. Kozlov replaces another General who also had GRU connections, formalising the integration of state-sponsored cyber-espionage personnel into high-level government policy roles.
Fox-IT has written up RemotePE, a sophisticated three-stage memory-only toolset from a Lazarus subgroup targeting financial and cryptocurrency organisations. The toolkit uses environmental keying via Windows data protection APIs, direct syscalls, and event trace suppression to evade forensics and endpoint detection, with an actor-in-the-loop delivery model for high-value targets requiring long-term stealthy access.
Yonhap News Agency reports that North Korean hackers from the 313 General Bureau and Reconnaissance General Bureau's 5th Bureau collaborated with a South Korean criminal organisation to develop 16 illegal gambling platforms across 71 domains between 2022 and 2024. The operation generated approximately 23.5 billion won in illegal revenue, with North Korean entities providing the technical infrastructure as a service to generate foreign currency.
Palo Alto Networks reports that nation-state actors including Midnight Blizzard and Curious Serpens have weaponised the open-source ROADtools framework to conduct malicious operations within Microsoft Entra ID environments. Adversaries are using the tool's legitimate API interactions to perform reconnaissance, register rogue devices for persistent access that bypasses multi-factor authentication, and evade detection by blending malicious activity with benign administrative traffic.
NetAskari obtained access to a Chinese Public Security Bureau surveillance system demonstrating the Sharp Eyes mass surveillance project targeting foreign nationals in China. The system contains real data on foreign journalists and long-term residents, specifically tracking citizens from Five Eyes countries, including passport numbers, ID photos, and phone numbers, enabling automated real-time tracking and predictive policing.
Google's TAG reports active exploitation of a ViewState deserialization vulnerability in KnowledgeDeliver learning management system, leveraging hardcoded encryption keys shared across customer deployments. Attackers are deploying the BLUEBEAM web shell within IIS worker processes for persistence and command execution, with organisations running instances deployed before late February affected.
And another in-the-wild exploitation story. Trend Micro released security updates for Apex One and Vision One endpoint protection on the 21st of May addressing eight vulnerabilities, with the company observing at least one of these being actively exploited. Worth flagging if you're running either product.
Aikido Security reports that attackers compromised the Laravel-Lang ecosystem by publishing 233 malicious version tags across three popular repositories. The attack exploited GitHub's tagging feature to point to commits from a malicious fork, deploying a two-stage credential stealer that executed via Composer's autoloader without committing malicious code to the official repositories, which is rather clever.
A security researcher has disclosed a vulnerability in Apple's dynamic linker on arm64e systems that allows attackers to exploit chained fixup handling to force the linker to act as a pointer authentication code signing oracle. A proof-of-concept demonstrates how a malicious library can manipulate this process to write valid function pointers to attacker-controlled memory locations, tested on iPhone 14 running iOS 18.5.
A pull request to NetExec clarifies that the NTLM reflection vulnerability tracked as CVE-2025-33073 is only exploitable on Windows NT 10.0 and later, which is to say Windows 10 and Server 2016 onwards. Legacy Windows versions are architecturally immune due to the absence of a particular function in the authentication library, so defenders should focus patching efforts exclusively on modern Windows environments.
The Relay Bible repository provides a comprehensive technical reference for NTLM and Kerberos relay attack techniques. It documents a newly discovered primitive enabling Kerberos relay via DNS name record abuse to poison DNS and force clients to request service tickets for attacker-controlled targets, with detailed mechanics including signing limitations and preferred attack vectors through HTTP and WebDAV.
Ghost Wolf Lab reports that attackers are weaponising the legacy SYLK file format to execute malicious Excel 4.0 macros while bypassing Protected View, email gateway filters, and anti-malware scanning. The technique exploits SYLK's trusted status in Microsoft Office, with particularly severe risks for unsupported versions like Office 2011 for Mac which silently execute macros without user interaction.
Security researcher Abdul Mhanni advocates for analysing leaked Windows Server 2003 and XP source code to understand actual protocol implementations versus official Microsoft documentation. The article demonstrates how Windows-specific behaviours like Kerberos flag defaults and ticket lifetime sentinel values differ from specifications, enabling both detection evasion and more accurate defensive signatures.
The HoneySlop project introduces code canaries, which are deliberate decoy code snippets embedded in repositories to help open-source maintainers quickly identify and filter AI-hallucinated vulnerability reports. When automated scanners or language-model-based tools ingest these decoys, they generate reports with unique identifiers that reveal the report as false, allowing maintainers to dismiss automated noise instantly.
Eric Priezkalns reports that YouTube advertisements are promoting illegal SMS blasters, which are portable base stations manufactured in China that allow criminals to broadcast fraudulent text messages by impersonating legitimate telecommunications operators. Demonstrations show these devices being used to impersonate Globe and Smart in the Philippines for smishing campaigns, bypassing traditional network security filters by injecting messages directly into the radio environment near victims' devices.
And finally, Dutch police arrested two 23-year-old men from Bergschenhoek for operating a Phishing as a Service operation that sold ready-to-use phishing panels to criminals. The suspects marketed these tools via social media to international buyers, who used them to create convincing replicas of banking websites to harvest credentials from victims across Europe.
That concludes today's briefing.