Cyber security developments for Monday the 8th of June 2026 covering articles added to the BlueTeamSec community on infosec.pub. Today we have 30 articles to cover. All attribution is by the article authors. All article analysis is automated.
CISA and partner agencies are warning about active compromises of Automatic Tank Gauge systems — the industrial control hardware that monitors storage tank levels in fuel depots and similar facilities. Attackers are getting command execution and modifying operations, so if you're managing critical infrastructure with internet-exposed tank gauges, this one needs flagging.
Google's threat intelligence group have written up a rapid-tempo extortion campaign by a cluster they're calling UNC3753, targeting US law firms and financial services organisations between January and May this year. The attackers are using vishing — impersonating IT staff to talk employees into installing legitimate remote access tools over screen shares — and completing the entire attack lifecycle, from initial call to data theft, within a single business day. Worth reading if you're wondering how social engineering is bypassing technical controls including multi-factor authentication.
ReliaQuest have identified a previously unknown China-linked espionage cluster they're calling OP-512, which compromised an IIS server for at least 75 days using a custom web shell framework with RSA-signed and RC4-encrypted command handlers. The cluster used reflective .NET assembly loading, timestomping, and randomised code generation to stay under the radar — one for organisations still running legacy IIS infrastructure.
BlueCyber have analysed a January 2026 campaign by Mustang Panda deploying PlugX RAT through a multi-stage infection chain. The attacks used fake browser update lures and DLL sideloading techniques, primarily targeting officials and entities involved in diplomacy, elections, and international coordination.
LAC, a Japanese security firm, have tracked a sustained spearphishing campaign running since April targeting Japanese organisations, attributed to the Chinese group Poison Carp. The campaign delivers a RAT called PoisonX that uses bring-your-own-vulnerable-driver techniques to get kernel-level access, disable endpoint protection, and enable lateral movement via SOCKS5 proxies. Particularly relevant if you're defending Japanese infrastructure.
Threat Review Journal have published an investigation into a six-person team within PLA Troop 61786, linked to the group known as APT 5, conducting network exploitation against telecoms providers in Southeast Asia and the United States. The team has been misusing military command-and-control infrastructure for personal cryptocurrency mining whilst also attempting to access US Government networks — which has inadvertently compromised operations by more sophisticated Chinese actors like Volt Typhoon who were targeting the same infrastructure.
Arctic Wolf have written up the expansion of Kali365, a phishing-as-a-service platform we first saw in April. It's moved beyond Microsoft 365 to target Outlook, Okta, Xerox DocuShare, and Russian platforms including MAX Messenger, Mail.ru, and Yandex. The operation abuses OAuth 2.0 device authorisation flow to steal access tokens and bypass multi-factor authentication without needing passwords.
Check Point have disclosed that law enforcement seized the hosting infrastructure used by WorkTitans, which has disrupted multiple Iranian-nexus cyber espionage operations. The action impacted groups including MuddyWater and others relying on that shared infrastructure — useful context if you've been tracking Iranian threat actor activity and noticed recent changes in operational tempo.
OX Security have detailed a campaign called Shai-Hulud, which is a sophisticated supply chain attack weaponising GitHub as adaptive command-and-control infrastructure. Threat actors are using GitHub commits tagged with a specific marker to dynamically push malware updates across six execution stages, targeting developers and CI/CD pipelines whilst evading traditional detection by exploiting GitHub's trusted status in most environments.
Following on from the IronWorm story we covered last week, StepSecurity have written up another npm supply chain attack — this one called Miasma — which compromised 57 packages across 286 malicious versions in June using a novel technique they're calling Phantom Gyp. It executes malicious code during npm install without triggering standard lifecycle scripts, harvests cloud credentials and GitHub Actions secrets from CI/CD environments, and propagates as a worm across npm and RubyGems using stolen tokens. High-profile packages like a Vapi AI server SDK with over 400,000 monthly downloads were compromised, so flag this if you're running dependency scanning or supply chain risk programmes.
And another supply chain issue — Cyderes have tracked an active campaign by a threat actor called Leda Elacoate distributing trojanised installers for cryptocurrency platforms, Steam, and X-VPN via unauthorised channels including Bitbucket. The campaign deploys an infostealer called STX RAT using DLL sideloading and maintains persistence through frequent rotation of command-and-control infrastructure on a domain called supp0v3.com.
McAfee Labs have tracked WeedHack, a malware-as-a-service campaign active since January targeting Minecraft players, primarily teenagers and young adults. The campaign distributes malicious JAR files through YouTube videos and search engine poisoning, offering freemium info-stealing capabilities with premium features including webcam access and reverse shells for five dollars a month. The malware uses a technique called EtherHiding to fetch command-and-control domains from the Ethereum blockchain and has generated over 116,000 hits with consistent daily volumes around 2,000 to 3,000.
Proofpoint have published research on TA4922, a financially motivated Chinese-speaking threat actor that's expanded from regional East Asian operations to global campaigns targeting organisations worldwide. The shift in scope is notable given the group's previous focus on localised activity.
Broadcom have written up a five-month espionage campaign from October 2025 to early this year targeting a senior executive at a major global stock exchange. The write-up doesn't attribute to a specific threat actor but the persistence and targeting suggest nation-state level interest in financial sector intelligence.
Natto Team have detailed a breach of Italy's Interior Ministry network in February this year linked to Chinese threat actors. The attackers exfiltrated personnel data of approximately 5,000 DIGOS officers — that's Italy's domestic intelligence and security division — which represents a significant intelligence gain for targeting dissident communities and critics abroad.
M4lcode have published something titled about unmasking a threat actor called Quellostanco targeting Egyptian infrastructure via a Git commit, but the page content doesn't match — it's currently displaying unrelated material about a Chinese smishing campaign. Might be worth checking back later if the correct content gets posted.
Include Security have detailed how Bright Data has embedded SDK software into consumer applications on smart TVs and mobile devices, converting them into residential proxy exit nodes without explicit user consent. These compromised devices are being used to route web-scraping traffic for AI training purposes, effectively bypassing datacenter IP blocklists — so average consumers installing certain applications are unknowingly participating in a monetisation scheme they didn't agree to.
Huntress have analysed a RAT called DeskCvb, a sophisticated multi-stage malware campaign observed this year that uses malspam with HTML attachments redirecting to a fake CAPTCHA, eventually delivering an in-memory RAT. The analysis walks through the entire infection chain from initial email to payload execution.
Check Point have exposed a malware distribution ecosystem that uses search engine poisoning to impersonate legitimate software, employing click hijacking and traffic direction systems to distribute malware. The infrastructure is fairly sophisticated in how it funnels victims from search results through multiple redirection layers before delivering payloads.
Palo Alto Networks have written up Operation FlutterBridge, a malvertising campaign targeting macOS users. The campaign delivers a backdoor called FlutterShell through malicious adverts and is being run by a cybercrime cluster they're tracking as CL-CRI-1089.
Qualys have detailed the HazyBeacon campaign, where threat actors are using compromised AWS IAM credentials to deploy malicious Lambda functions as command-and-control relays. The technique abuses Lambda function URLs to establish persistent infrastructure that looks like legitimate cloud service traffic, which is notable given how widely AWS Lambda is deployed in enterprise environments.
Dashlane have posted a security advisory about a brute-force attack on user accounts starting May 31st. An external threat actor attempted to bypass two-factor authentication to register unauthorised devices, and fewer than 20 personal plan users had encrypted vaults downloaded — though contents remain protected by master passwords. Their automated security systems triggered lockouts preventing unauthorised access for the vast majority of targeted accounts.
Bishop Fox have analysed an unauthenticated remote code execution chain affecting UniFi OS servers that combines an authentication bypass via path traversal with command injection in the update service, resulting in root access. The vulnerability allows attackers to gain complete system control and install persistent backdoors, and Bishop Fox have released a non-destructive detection tool to help administrators identify vulnerable instances.
Depthfirst's autonomous security agent discovered 21 zero-day vulnerabilities in FFmpeg, including heap buffer overflows and integer overflows across various components. Some vulnerabilities had existed undetected for 15 to 20 years, affecting web browsers, streaming platforms, surveillance systems, and basically any infrastructure processing untrusted media. The flaws enable remote code execution exploits, with one vulnerability successfully exploited as proof-of-concept.
Positive Technologies have identified a critical vulnerability chain in the Internet Explorer WebBrowser control that enables remote code execution through clickjacking. The exploit leverages elevated trust granted to the localhost origin combined with legacy browser features to bypass security boundaries — so applications built with .NET, C#, Visual Basic, or Electron that use the IE WebBrowser control to render web content are affected.
Researchers at beyondmemory.io discovered that popular online JSON and code formatting tools maintain a public, unauthenticated feed that archives user-submitted data going back seven years. The vulnerability allows anyone to retrieve the contents of saved pastes through a predictable pagination endpoint, resulting in exposure of potentially sensitive information including secrets and credentials. The report also identifies a stored cross-site scripting vulnerability and highlights significant data exposure affecting Turkish organisations.
TrustedSec have written about the often-overlooked attack surface of privileged roles in cloud management platforms like Microsoft Intune, emphasising that service principals and administrative roles in these platforms represent tier-zero assets equivalent to Active Directory. Attackers can compromise these to achieve fleet-wide control through configuration changes and script deployment, whilst many organisations fail to monitor API-level actions within these management planes.
NVISO have detailed how adversaries are abusing QEMU virtualisation to execute malicious operations within guest VMs on compromised hosts, effectively evading host-based security tools. The technique involves deploying virtual machines to run command-and-control beacons and malicious payloads in an isolated environment, with traffic tunnelled over SSH to blend with legitimate encrypted communications — which significantly complicates forensic analysis.
Security research has demonstrated how attackers can exploit Windows Subsystem for Linux architecture to stage malicious payloads while evading Windows-based security telemetry. The technique leverages WSL2's Hyper-V isolation and the underlying protocol to perform downloads and file operations that remain invisible to Sysmon and other host-based monitoring tools, with file creation events misattributed to a system process instead of the actual malicious activity.
Praetorian have released WasmForge, a tool that compiles the Sliver command-and-control framework into WebAssembly modules wrapped in benign Go binaries. The technique achieves polymorphic evasion by encrypting offensive logic within WebAssembly bytecode, making static analysis ineffective and forcing defenders to rely on behavioural monitoring and runtime telemetry. As legitimate WebAssembly adoption grows in enterprise environments, distinguishing malicious from benign applications will become increasingly challenging for security operations teams.
A proof-of-concept demonstrating staged DLL injection via SMB shares has been published, developed for red team certification training. The technique forces a target Windows process to load a malicious DLL directly from a remote network share, achieving fileless execution that bypasses disk-based detection mechanisms — particularly relevant for organisations with permissive SMB traffic where attackers have sufficient process handle privileges.
Matheuz Security have disclosed a high-severity vulnerability in Trend Micro Deep Security Agent for Linux that allows local unprivileged attackers to bypass behaviour-monitoring protections. By generating high-volume filesystem and process activity, attackers can force the agent to unload its kernel modules, creating a repeatable window during reload where malicious artifacts can be written undetected. As of June, no conclusive vendor fix or timeline had been provided.
Rasta Mouse has written about Cobalt Strike 4.13's new Aggressor script hook, which enables operators to dynamically intercept and modify Beacon Object Files at runtime before execution. The demonstration shows using instrumentation tools to inject custom code and hooks directly into BOF execution flow, including manipulation of Windows API calls — which significantly enhances post-exploitation stealth by embedding hooks directly into BOFs rather than relying on external loaders.
Sansec have detailed a sophisticated Magecart skimming campaign targeting Magento and Adobe Commerce platforms by abusing Stripe and Google Tag Manager to host malware and exfiltrate stolen payment card data. The attack delivers code via malicious Tag Manager containers, harvests payment details through checkout button hooks, and exfiltrates encoded data by storing it as fake customer records in attacker-controlled Stripe accounts. This living-off-the-land approach bypasses content security policy rules and network filters by leveraging legitimate, trusted domains.
Black Hills Information Security have released GoGatoZ, an open-source tool for auditing GitLab CI/CD pipeline security. The tool automates discovery and exploitation of misconfigurations across the entire kill chain, including command injection, runner hijacking, and secret exfiltration. An audit of over 3,700 GitLab projects revealed more than 7,000 security findings with 1,580 classified as high severity, affecting organisations from students to Fortune 500 companies.
A technical analysis from kernullist details how attackers manipulate Event Tracing for Windows components — including provider registrations, enable slots, and session buffers — to evade detection by suppressing specific telemetry without stopping ETW sessions entirely. The research covers both offensive techniques for tampering with ETW and defensive considerations for maintaining telemetry integrity, which is useful background if you're relying on ETW as a telemetry source for endpoint detection.
NCC Group have detailed Async PICOs, an advanced Cobalt Strike technique enabling asynchronous, long-running tasks within Beacon processes through custom sleepmasks and event-driven execution. The method allows sophisticated post-exploitation operations that run as threads in unbacked memory regions, making detection more challenging. Source code and detection guidance are provided via their GitHub repository.
And finally, a technical deep-dive into x86-64 memory management architecture demonstrating manual address translation in Linux kernel version 6.9.3. The author walks through how the CPU's memory management unit translates virtual addresses to physical RAM addresses in a QEMU environment — this is a low-level technical exploration of foundational system architecture rather than security-specific content, but one for those interested in the underlying mechanics.
That concludes today's briefing.