Security news from the BlueTeamSec community for Monday the 19th of October 2026. A busy one, with thirty stories to get through — so let's get started.
TAG-193, also tracked as Silent Lynx, is conducting sustained espionage across Central Asia and the CIS — Russia, Tajikistan, Belarus, Armenia, and Uzbekistan. Recorded Future's report documents spearphishing via compromised government accounts and lightweight reverse shells targeting diplomatic and resource-management organisations, with a particular focus on water security. Operational patterns suggest the group is likely based in Kazakhstan.
PolySwarm and VulnCheck have written up a Chinese state-linked campaign targeting US critical infrastructure and government entities using automated scanning tools and credential theft. The FBI seized seven domains tied to Integrity Technology Group on the 8th of October, though previously compromised systems remain at risk. One for infrastructure defenders to review.
STAR Labs identified an Android RAT campaign targeting Japanese users through fake applications impersonating legitimate Japanese brands. The malware demonstrates coordinated mobile threat activity focused on Japanese-speaking victims via multiple fake brand personas.
NVISO provides a forensic breakdown of the Digispark microcontroller used in BadUSB attacks. The analysis demonstrates firmware extraction techniques and documents host-based artifacts in Windows logs and registry keys — though the key takeaway is that filtering by vendor and product IDs is insufficient, and defenders should monitor for anomalous keyboard behaviours instead.
An open-source command-line tool called m365-xdr-cli now lets SOC analysts — or AI agents working on their behalf — perform incident triage, advanced hunting with KQL, and response actions in Microsoft Defender XDR from the terminal. It supports authentication via portal cookies or Entra App Registration, and it's from NerfBlasters.
A US District Court in California denied WhatsApp's motion to hold NSO Group in contempt for allegedly continuing to facilitate delivery of malicious software through WhatsApp after being barred by injunction. The court ruled that WhatsApp did not meet the clear and convincing standard required to prove the violation — which is either a high bar for evidence or a gap in the injunction's reach, depending on your perspective.
Censys reported on a cyberattack targeting Danfoss refrigeration controllers in France, where attackers manipulated exposed devices to force sustained defrost mode — causing mass food spoilage and physical fires. The incident exploited legacy operational technology systems with outdated firmware exposed on the public internet without authentication. Response involved a seventy-one percent reduction in exposure, primarily through network disconnection rather than firmware patching. This follows the CERT-FR disclosure we covered earlier in the week.
JPCERT in Japan investigated a series of unauthorised access incidents where attackers used AI-automated scanning to target web APIs of organisations with mobile applications. Attackers systematically reverse-engineered Android APK files using tools like jadx to extract hardcoded credentials and API endpoints, then exploited server-side request forgery vulnerabilities and conducted lateral movement targeting MySQL, Jenkins, and mail gateways. We covered a related report from LAC on the 17th.
A cybersecurity incident has disrupted the Bankruptcy Noticing Center infrastructure managed by BAE Systems for the Federal Judiciary in the US. The outage has taken down bankruptcy notice production and distribution systems nationwide, affecting all federal bankruptcy courts. Multiple uscourts.gov domains and the National Creditor Registration Service remain unavailable.
Todyl and SpecterOps have both written up a supply chain attack affecting Microsoft 365 tenants through compromised ConnectWise Cloud Backup credentials. An unauthorised party gained access by compromising a valid client secret, authenticated directly to Microsoft Graph API, bypassing MFA and Conditional Access, and systematically targeted tenants in ascending order. At least a hundred and sixty-two tenants were affected on the 15th of October between six and half-eight UTC, with attackers establishing persistence by escalating a second ConnectWise application to Global Administrator and adding client secrets for backdoor access.
SAP disclosed a critical server-side request forgery vulnerability in the SAP Cloud SDK for Python with a CVSS score of ten. The flaw allows attackers to exfiltrate OAuth2 client credentials by manipulating the tenant subdomain parameter to redirect token requests to attacker-controlled servers. SAP released a patch enforcing DNS label validation — version zero-point-four-five-point-two and above.
Trail of Bits research reveals systemic weaknesses in twenty-five popular package managers that fail to verify code integrity by default. Fewer than half use tamper-checking lockfiles by default, and only two verify integrity of every downloaded package — leaving developers vulnerable to supply chain attacks when repositories are compromised.
Bishop Fox published a critical reflected cross-site scripting vulnerability in Siemens Teamcenter's login redirect flow — CVE-2026-58113. The flaw enables zero-interaction code execution when authenticated victims click a malicious link, and researchers demonstrated exploitation to establish surrogate delegation relationships, allowing attackers to approve workflows, release controlled design data, and modify bills of materials with victim permissions. Siemens has released patches — rated eight-point-five CVSS.
Searchlight Cyber identified a critical vulnerability chain in Adobe Experience Manager Cloud enabling unauthenticated remote code execution. The exploit chain combined repository bypass, cross-site scripting, XML external entity, and Groovy script execution vulnerabilities to achieve full system compromise. Adobe has patched the cloud version, but on-premises instances may remain vulnerable without updates. This follows three CISA KEV alerts on the 15th.
Sansec disclosed BlockStrap, a critical unauthenticated remote code execution vulnerability in Magento and Adobe Commerce with a CVSS score of ten. The flaw enables arbitrary PHP code execution through second-pass directive injection in email templates, building on the earlier StyleSmuggler vulnerability. Adobe patched on the 13th of October, but researchers warn of rapid exploitation risk once patches are reverse-engineered. We've seen Magento appear before — there was a comparable vulnerability in September.
A repository from qkaiser documents a vulnerability in Broadcom's eight-oh-two-dot-eleven SDK implementation affecting fragment reassembly in the WPS monitor component. Researchers provide fingerprinting tools to identify vulnerable devices by sending zero-length fragmented frames — potentially affecting thousands of device models from vendors including Cisco, Netgear, Huawei, TP-Link, and ZTE.
Varonis Threat Labs discovered a privilege escalation vulnerability in Snowflake-managed PostgreSQL that allowed attackers to chain standard PostgreSQL features to achieve remote code execution on the database host. The exploit bypassed platform security controls by rebinding prohibited C functions and manipulating configuration files. Snowflake has fully remediated the vulnerability server-side.
Andrea Fortuna writes about the eBPF forensics gap — a critical blind spot where eBPF-based rootkits can intercept and manipulate security telemetry at the kernel level. Because security tools and malicious implants operate at the same privilege level using identical primitives, advanced attackers can suppress their presence from monitoring systems, making kernel compromise undetectable.
Ayush Anand documents how attackers are weaponising legitimate, vendor-signed ScreenConnect RMM clients to bypass security controls through social engineering. The attack uses a two-stage approach — deploying a cloud-based implant for initial access, then pushing a hidden self-hosted implant for persistent access. The technique exploits legitimate tool functionality rather than vulnerabilities, making signature-based detection ineffective.
Cuban Eight is a proof-of-concept red team tool that packages malicious Windows PE payloads into files disguised as legitimate Linux distribution installers. The technique abuses Windows Subsystem for Linux installer format to execute arbitrary code when the file is double-clicked, evading traditional detection by leveraging trusted Windows binaries and the WSL interop layer. It's from Maverick.
A researcher demonstrated DLL sideloading technique against Procmon64 to achieve initial access on Windows 10 while evading Elastic EDR detection. The attack exploits Windows DLL search order by placing a malicious DLL in the application directory, causing a signed process to load malicious code. The payload used import address table hiding to bypass static analysis detection.
UpGuard documented the JadePuffer ransomware campaign, which exploited publicly accessible, unauthenticated ChromaDB vector database instances to perform retrieval extortion. Attackers used encryption, data poisoning with ransom notes injected into RAG datasets, and destructive renaming to contaminate AI chatbot responses — causing customer-facing AI systems to deliver ransom demands instead of legitimate responses.
GreyNoise reports that malicious actors are exploiting vulnerabilities in internet-facing edge devices like NAS units and network video recorders to install unauthorised proxy software, converting them into residential proxy nodes. This proxyjacking technique allows attackers to monetise victim bandwidth and bypass security controls by masking their traffic through legitimate-appearing residential IP addresses.
Group-IB have written up KGB RAT, a Malware-as-a-Service offering actively promoted on underground forums since late twenty twenty-five. This Windows-targeting remote access trojan provides comprehensive capabilities including keylogging, credential harvesting, hidden VNC, ransomware, cryptocurrency address swapping, and psychological harassment tools — significantly lowering the barrier to entry for novice cybercriminals.
OrbitCurve released a firmware reverse engineering toolkit that provides structured workflows and agent skills for AI assistants like Claude, Codex, and Droid. The repository contains templates and scripts designed to automate and standardise the firmware reverse engineering lifecycle for security researchers.
Researchers at Columbia University introduced SRE-Bench, a benchmark for evaluating AI agents performing binary reverse engineering tasks. OpenAI's GPT-6 Astra achieved nearly a hundred percent success rate on the benchmark, while other models scored below sixty — demonstrating AI agents reaching near-human expert capability in automated binary analysis and vulnerability research.
A security researcher demonstrates techniques to reverse engineer WebAssembly Micro Runtime Ahead-of-Time compiled binaries by recovering function names from containers. The methodology parses export and function sections to map machine code back to human-readable function signatures — proving that AOT compilation provides no effective obfuscation for embedded systems and IoT devices. This is part two of a series — part one covered cracking the container format itself.
TornadoC2 is an advanced pull-based Command and Control framework designed for red-team operations, featuring ten native transport protocols including HTTPS, QUIC, DNS, and ICMP. Built in Go with compile-time configuration, it emphasises long-term persistence and stealth in heavily monitored environments through peer-to-peer pivoting and in-memory execution capabilities. It's from kamalx06.
That's everything for today from BlueTeamSec. The articles are the work of their original authors — the analysis here was automated.