Cyber security developments for Friday the 19th of June 2026 covering articles added to the BlueTeamSec community on infosec.pub. Today we have 13 articles to cover. All attribution is by the article authors. All article analysis is automated.
The Canadian Federal Court has granted their intelligence service a warrant to neutralise botnets operated by foreign state actors using compromised Canadian routers. The court-authorised operation targets the malicious infrastructure itself rather than the device owners, and it's specifically focused on protecting critical infrastructure from foreign adversaries.
DomainTools report that Russian military intelligence Unit 26165 is running a global collection operation targeting over 200 organisations across more than 120 countries. The campaign compromises routers to manipulate DNS for interception and specifically targets messaging platforms like Signal, WhatsApp, and Telegram to decrypt communications โ one for anyone supporting Ukraine-related entities or critical infrastructure.
Google's Cloud blog details a China-nexus espionage campaign targeting North American medical, academic, and military institutions focused on AI and defence research. The attackers exploited legacy REDCap servers to deploy malware that trojanises legitimate files and, rather cleverly, abused email compliance rules to silently forward targeted emails to actor-controlled Gmail accounts โ active since September 2023.
CloudSEK's writeup covers Operation Escaneo, a sophisticated espionage campaign attributed to a threat actor calling themselves MexicanMafia, targeting Mexican government agencies and financial institutions. The operation uses a proprietary reconnaissance engine and exploits perimeter device vulnerabilities to maintain persistence through webshells and tunnels, resulting in over 1.3 million personal records exfiltrated.
Rapid7 have tracked Dropping Elephant using a multi-stage infection chain with China-themed lures, deploying a fileless remote access tool through DLL side-loading. The campaign patches security telemetry in memory to blind defences and uses control-flow flattening to resist analysis โ notably sophisticated evasion for this group.
Chinese security researchers have published analysis of a recent phishing campaign by APT-C-48, also known as CNC Group. The report examines their phishing methodologies and infection vectors โ adds useful context if you're tracking this actor's evolving tactics.
Hudson Rock disclosed the FortiBleed incident where 75,000 Fortinet firewalls were compromised through publicly accessible management interfaces and legacy password hashes in configuration files. Attackers cracked weak hashes using GPU clusters and either exfiltrated data directly or sold the access to ransomware groups โ a NATO contractor was among those affected.
On a similar note, Cisco have confirmed limited exploitation in the wild of a critical vulnerability in Catalyst SD-WAN Manager. The flaw allows authenticated users with write privileges to escalate to root through improper input validation in the file upload process โ affects all deployment types.
StepSecurity report that the Mastra organisation on npm was compromised on the 17th, with attackers injecting a typosquatted malicious dependency into over 140 packages totalling 1.1 million weekly downloads. The malicious package executed attacker-controlled payloads before self-deleting, targeting AI and cloud development environments containing credentials.
Cato Networks analysed a 33-day campaign by a threat actor calling themselves Poisson against a French automotive business. The operation used a fileless loader to deploy Havoc C2, but more interestingly combined OpenSSH and Tailscale VPN mesh for persistence that survived traditional C2 takedowns โ maintaining backdoor access for 18 days during C2 downtime, which is either impressive tradecraft or a lesson in legitimate tools being quite useful.
AhnLab detail a campaign distributing Xctdoor backdoor malware disguised as resume documents via malicious shortcuts. The multi-stage infection uses batch files, PowerShell, and script to establish persistence, then employs DLL side-loading to inject the backdoor โ particularly relevant if you're in HR or receive unsolicited applications.
CYPFER's piece on red teaming points out that honeypot detection in Active Directory can be bypassed by using native Windows mechanisms like the SAM-R protocol via RPC instead of LDAP queries. By retrieving account metadata through legitimate functions, attackers can distinguish real assets from decoys without triggering traditional LDAP-focused monitoring โ renders honeypots ineffective if they lack organic behavioural history.
And finally, researchers presented a specialised collection tool and dataset of malicious VS Code extensions at CODASPY 2026. The tool addresses a gap in software supply chain security by enabling systematic collection of malicious extensions that threaten developer environments โ useful reference if you're building detection mechanisms for the extension ecosystem.
That concludes today's briefing.