Cyber security developments for Saturday the 6th of June 2026 covering articles added to the BlueTeamSec community on infosec.pub. Today we have 10 articles to cover. All attribution is by the article authors. All article analysis is automated.
Volexity have written up VerdantBamboo, an eighteen-month intrusion campaign targeting edge network appliances including pfSense firewalls, Synology NAS boxes, and Egnyte storage sync devices. The threat actor deployed specialised tooling in Golang, Rust, and Python specifically designed to operate from the network edge and evade endpoint detection β one for anyone running these devices in production.
Following on from the GammaPhish and GammaWorm stories we covered earlier this week, Sekoia have now published parts two and three of their Gamaredon matryoshka series. GammaLoad and GammaSteel both use nested multi-stage obfuscation, with registry payloads bound to the user profile and dead drop resolvers hosted on Mastodon to dynamically fetch command-and-control addresses β the architecture is deliberately designed so that even if you kill one backdoor, the others will reinfect the system.
The National Cyber Security Centre have published guidance on software supply chain attacks, covering how adversaries inject malicious code into trusted dependencies, build pipelines, and third-party libraries. It's aimed at developers and organisations running continuous integration workflows β worth a look if you're responsible for dependency management or build security.
And another supply chain incident β OX Security have detailed the IronWorm campaign, which compromised developer accounts associated with the WeaveDB project and injected malicious code into thirty-six legitimate npm packages. Anyone who updated their dependencies automatically pulled down and executed the payload, which was designed to exfiltrate sensitive information from development environments.
Sophos have written up a rather unusual incident involving Hola Browser, where a compromised update mechanism was used to distribute crypto-mining malware. The payload established persistence as a Windows service, disabled Defender, and mined only during idle time to avoid detection β turns out even signed software distribution pipelines aren't immune to compromise.
A security researcher has documented a rather clever quirk in Active Directory ACL processing β if you manipulate security descriptors at a low level using raw binary LDAP, you can create non-canonical ACL orders where Allow entries precede Deny entries. Because Windows evaluates ACLs sequentially, the Deny rules are simply ignored. This affects organisations using backup tools, migration scripts, or anything that manipulates security descriptors programmatically.
TrueCyber have released AzureRedOps, an offensive security toolkit for red-team assessments of Microsoft Entra ID and Azure environments. It automates reconnaissance, credential harvesting, privilege escalation, and post-exploitation through a command-line interface that talks to the Graph API β centralises most of the common attack workflows you'd see in a cloud engagement.
The ZMap team have released zannotate, a command-line utility for enriching IP address datasets with contextual metadata from MaxMind GeoIP, ASN databases, reverse DNS, WHOIS, Censys, and threat intelligence feeds like GreyNoise. It's designed for network research and security analysis, supports both live API queries and offline enrichment, and handles large-scale datasets β useful for reconnaissance or contextualising telemetry, depending on which side of the fence you're on.
And finally, Origin have published internals on Microsoft's eXecution Container project, which provides cross-platform sandbox isolation for AI agent code execution using native OS primitives. The architecture translates high-level policies into platform-specific controls via a broker, though it's positioned more as an auditing framework than a hardened security boundary β probably best treated as a logging and detection tool for agentic workflows rather than something you'd rely on to stop a determined breakout attempt.
That concludes today's briefing.