This is the security briefing for Saturday the 17th of October 2026, drawn from the BlueTeamSec community on infosec.pub. A busy one, with twelve stories to cover.
CISA have added a BeyondTrust Remote Support vulnerability to the Known Exploited catalogue. It's an improper origin validation flaw that allows unauthenticated remote code execution and file manipulation on internet-facing appliances, and it's being actively exploited by a China-linked group called Armory Castle, who've been deploying web shells. The advisory notes this is the same flaw we covered back in August under a Mac security piece, and it was also mentioned in Google's zero-day review from July.
The Committee to Protect Journalists have reported that an Israeli ad-tech firm called Discover-Tech facilitated spyware targeting of at least forty-five Al Jazeera devices. The attacks used zero-click exploitation delivered through malicious ads served across nearly two hundred thousand apps and websites globally between 2024 and 2025. We've seen related reporting on Candiru and zero-click iOS exploits over the past few weeks, so this adds useful context to that thread.
The Citizen Lab and Confiant have both published detailed investigations into Discover-Tech's operations. The Citizen Lab piece describes the AdFection delivery mechanism, which exploits the online advertising ecosystem to deliver zero-click mercenary spyware from Candiru, Bindecy, and Intelos, using malicious ad scripts that fingerprint devices and automatically execute browser exploits. Confiant's report focuses on what they're calling ADINT — weaponised ad tech performing mass surveillance across ten million daily ad impressions, vacuuming first-party cookies and sensitive user data to build identity graphs and micro-target high-value individuals in government, defence, and research sectors. Both pieces are worth reading if you're tracking mercenary spyware delivery infrastructure.
Infoblox have written up a Russian-language threat actor called Hotejka, suspected to be a rebrand of ROI777, who operate a traffic direction system exploiting Cloudflare Pages infrastructure to host tech support scams at scale. The campaign uses browser fingerprinting, time-gating based on U.S. business hours, and browser lock techniques to manipulate victims into installing remote desktop software. Over twenty thousand malicious Cloudflare Pages domains were documented in six months. This follows coverage we had last week on Russian internet infrastructure and rogue AI agents abusing similar services.
360 Netlab have documented the evolution of the Yin-hu, or Silver Fox, botnet infrastructure, which now employs a time-window-based evasion technique. The botnet's backend redirects security researchers to legitimate sites during specific hours when whitelist domains are detected via Referer headers, while serving actual malware payloads during other times. We've seen this actor before — there was a piece on Chinese beamer malware and another on the DarkSword variant in recent weeks.
VulnCheck have analysed a joint advisory on Integrity Technology Group, a Chinese government-linked threat actor also known as Flax Typhoon or Ethereal Panda. The analysis revealed threat actors are repurposing infrastructure to target newer vulnerabilities, operating both targeted exploitation campaigns from Taiwan infrastructure and automated RedTail botnet operations from Hong Kong. Targeted organisations span India, Mexico, Great Britain, and Malaysia. This ties in with yesterday's reporting on Chinese cybersecurity software found in Taiwan's Ministry of Foreign Affairs and the Divine Seagull tooling piece.
The FBI have issued an advisory on North Korean IT workers infiltrating Western companies through stolen identities and facilitators to generate illicit revenue for military programmes. These workers use laptop farms, remote administration tools, and third-party verification services to evade detection while conducting intellectual property theft, data exfiltration, and extortion. The Bureau warns organisations, especially those in the cleared defence industry, about this high-level insider threat. We covered the U.S. government disruption operation and the fourteen indictments in this case yesterday.
LAC Corporation in Japan have published analysis of a surge in data breaches affecting web systems and mobile applications since July. Eighty-one of one hundred and nineteen reported cases occurred in this period, with a major factor being the rise of what they're calling A2B attacks — App to Backend — where threat actors reverse-engineer mobile apps to target backend APIs, exploiting vulnerabilities like server-side request forgery, remote code execution, SQL injection, and broken object-level authorisation. Attackers are monetising stolen personal information including biometric data and identity documents. This follows yesterday's advisory from JPCERT on the SiteGuard Server Edition command injection flaw and NICT's piece on AI-assisted vulnerability detection in Android apps.
Team Cymru researchers identified five previously unreported LegionRelay command and control servers targeting Ukrainian entities through behavioural threat hunting. The infrastructure uses TCP port 8000 on AS26383, presenting a deceptive 'France Education' banner and running Uvicorn ASGI servers. Defenders can proactively hunt for new infrastructure using the behavioural fingerprint combining banner, ASN, and port characteristics.
Academic researchers have published a paper modelling dynamic attack surfaces using queueing theory and branching processes. The paper illustrates concepts with a 2026 PaperCut vulnerability campaign where AI agents achieved remote code execution in under four hours, compromising four hundred and forty systems across forty-eight countries. The research identifies phase transition thresholds where attacker growth rates exceed combined vulnerability discovery and patching rates. This ties back to the PaperCut pre-auth chain and patch bypasses we covered last week from watchTowr.
And another vulnerability — security researchers have discovered PAGE404, a side-channel attack exploiting hardware page migration mechanisms in NVIDIA GH200 superchips that breaks Multi-Instance GPU isolation. The attack enables covert channels at eight to fifteen kilobits per second, workload fingerprinting, and inference of large language model prompt lengths across supposedly isolated GPU partitions, which is particularly relevant for cloud providers and multi-tenant environments using GH200 hardware.
That's everything for today from BlueTeamSec. The writing is by the original authors — the analysis was ours, automated as ever.