InfoSec Briefing - November 11, 2026

🎧 Audio Briefing

Playback Speed:

Security news from the BlueTeamSec community for Wednesday the 11th of November 2026, with nine stories to get through.

CISA have added two Barracuda vulnerabilities to the Known Exploited catalogue. The first, affecting Email Security Gateway appliances, is a pre-authentication bypass that lets attackers modify configurations remotely — and when chained with other flaws, achieve root compromise. Both are being actively exploited in the wild, so if you're running Barracuda kit, patching and access restrictions are both urgent.

France's foreign ministry has formally attributed a destructive sabotage campaign to Iran's SHAHID KAVEH unit, linked to the IRGC. The attacks targeted retail distribution systems — causing fires, significant material damage, and economic losses in the tens of millions. It's the first purely sabotage-focused cyber operation on French soil.

CERT-FR have published technical details on that same campaign. Iranian units exploited the Modbus protocol on port 502 to remotely manipulate industrial refrigeration controllers from Schneider, Siemens, and Rockwell — hitting around 700 systems across major retailers including Casino, Leclerc, and Carrefour. The result was food spoilage and at least fifteen fires. Reconnaissance was done via the FOFA search engine, which is worth flagging if you monitor for scanning activity against your industrial control kit.

Security researchers have de-anonymised the administrator behind the Qilin ransomware-as-a-service operation, identifying him as Alexey Mikhailovich Yakovtsev. The investigation used cross-forum linking, leaked database records from Russia's Gosuslugi portal, and Telegram verification. Qilin's been a leading ransomware threat through 2025 and 2026, with payloads targeting Windows, Linux, ARM, NAS, and ESXi — so this is useful context if you're tracking that group. We've covered arrests linked to Qilin twice before, in October.

Rapid7 have published a Velociraptor artifact that deploys Sysinternals Autoruns on Linux systems. It enumerates autostart execution points and persistence mechanisms — systemd services, cron jobs, startup scripts — which makes it useful for both hunting and forensics. Compatible with modern distributions running glibc 2.28 or later.

Researchers have released Homer, a fork of the Donut shellcode generation tool designed to evade static analysis. It generates position-independent shellcode for loading Windows PE files or .NET assemblies in memory, with fixed byte patterns and structural invariants removed. One for red teams and those tracking evasion techniques.

And finally, Silverseal — an open-source UEFI bootkit and rootkit framework for Linux, written in Rust. It hijacks the UEFI boot process to load a kernel module before the operating system initialises, demonstrating pre-OS persistence. It's a proof-of-concept for educational and research purposes, but it highlights vulnerabilities in the UEFI boot process that are worth understanding if you're working on hardening Linux environments.

That's your briefing for today. The original articles are the work of their respective authors — the analysis here was automated.

📰 Articles Covered

CVE-2026-116606 - CISA KEV

This threat intelligence summary concerns **CVE-2026-116606**, a critical vulnerability currently being exploited in the wild.

### Vulnerability Overview
* **CVE ID:** CVE-2026-116606
* **Vendor:** Barracuda Networks
* **Affected Product:** Email Security Gateway (ESG)
* **Severity:** High (CVSS Score: 9.3)

### Impact
CVE-2026-116606 is an authentication bypass vulnerability that allows an unauthenticated remote attacker to invoke a configuration-import function . By restoring a crafted, compatible backup archive, an attacker can perform unauthorized modifications to the appliance's global configuration .

When chained with a separate command injection vulnerability (CVE-2026-111560), attackers can escalate their access to achieve **root privileges** on the affected device .

### Exploitation Context (MITRE ATT&CK T1190)
This vulnerability is being actively exploited against internet-facing applications .

* **Attack Path:** While authentication is not technically required to initiate the bypass, exploitation requires that the appliance's **administrative user interface (Admin UI)** be accessible to the attacker from the internet .
* **Threat Actors/Campaigns:** Barracuda has confirmed exploitation activity targeting a small number of organizations . CISA has officially added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, reflecting its active use in malicious campaigns .

### Affected Versions & Remediation
| Product | Affected Versions | Required Remediation/Patch |
| :--- | :--- | :--- |
| Email Security Gateway (ESG) | Earlier than 9.4.0.030 | Update to version 9.4.017+ (BNSF-40425) or latest firmware |

### Immediate Recommendations for Defenders
1. **Apply Patches:** Immediately update affected ESG appliances to the latest available firmware version provided by Barracuda . If firmware is significantly outdated, multiple update steps may be required—contact Barracuda Support if necessary .
2. **Restrict Access:** Immediately remove public internet access to the Administrative UI. Restrict access to the Admin UI exclusively to trusted, internal networks or via a VPN/secure management network .
3. **Threat Hunting:** Review appliance logs for unauthorized configuration changes or unexpected access to the management interface, especially from unfamiliar IP addresses.
CVE-2026-111560 - CISA KEV

As of November 11, 2026, **CVE-2026-111560** is a confirmed, actively exploited vulnerability affecting multiple Barracuda Networks products. It has been officially added to the CISA Known Exploited Vulnerabilities (KEV) Catalog .

### Overview of CVE-2026-111560
The vulnerability is an OS Command Injection flaw caused by improper neutralization of shell metacharacters within a timezone configuration field in Barracuda appliances .

* **Vendor:** Barracuda Networks
* **Affected Products:**
* Email Security Gateway (ESG)
* Load Balancer Application Delivery Controller (ADC)
* Message Archiver (BMA)
* WAF Control Center (WCC)
* Web Application Firewall (WAF)
* Web Security Gateway (WSG)

### Exploitation and Impact
* **What it allows:** An attacker can inject and execute OS commands with **root privileges** when the affected system processes a crafted timezone value .
* **Exploitation Context (MITRE ATT&CK T1190):** While CVE-2026-111560 technically requires administrative privileges to exploit directly, Barracuda has confirmed that it is being exploited in combination with **CVE-2026-116606** (a pre-authentication authorization bypass) .
* **Threat Actors/Campaigns:** Barracuda has identified exploitation activity affecting a small number of organizations. Specific threat actor names have not been publicly attributed to this campaign as of the latest disclosures .

### Recommended Actions for Defenders
Defenders should immediately verify if their appliances are exposed and apply the necessary patches provided by Barracuda Networks.

| Affected Product | Required Action / Patch |
| :--- | :--- |
| **Email Security Gateway (ESG)** | Apply BNSF-40425 (for 9.4.017+) or BNSF-40430 (for <9.4.017) |
| **Load Balancer ADC** | Apply BNADC-16586 |
| **Message Archiver (BMA)** | Apply BNMA-32468 |
| **WAF Control Center (WCC)** | Apply BNWF-60060 |
| **Web Application Firewall (WAF)** | Apply BNADC-16586 |
| **Web Security Gateway (WSG)** | Apply BNYF-24789 |

*Source: Barracuda Networks Security Advisory *

**Immediate Steps:**
1. **Patch:** Prioritize applying the specific patches listed above for all identified appliances.
2. **Audit:** If you use the Email Security Gateway, ensure you are protected against both CVE-2026-111560 and the associated authentication bypass CVE-2026-116606.
3. **Monitor:** Check device logs for unauthorized administrative activity or unexpected system configuration changes, particularly involving the timezone or system settings.
Déclaration d'attribution à l'Iran de cyberattaques visant la France - Statement attributing cyberattacks targeting France to Iran - Ministère de l'Europe et des Affairs étrangères

Based on the official statement from the French Ministry for Europe and Foreign Affairs, here is a detailed precis regarding the cyberattacks attributed to Iran.

### What Happened
The French government has officially attributed a series of highly aggressive and destructive cyberattacks to Iran. This campaign is described as unprecedented in both scale and intensity, marking the first time a cyberoffensive has been conducted purely for sabotage purposes on French national territory 【1】.

### Who Is Affected
The primary targets identified in this specific campaign are entities within the **large retail distribution sector (grande distribution)** in France 【1】.

### Security Implications
The attacks have caused significant real-world damage beyond digital systems, including:
* **Material damage:** Physical destruction of property 【1】.
* **Safety hazards:** The incidents triggered actual fires 【1】.
* **Economic impact:** Loss of food products, resulting in damages estimated at several tens of millions of euros 【1】.

The French government identifies the perpetrator as the **SHAHID KAVEH cyberoffensive unit**, which is affiliated with the Electronic and Cyber Center of the **Islamic Revolutionary Guard Corps (IRGC)** of Iran. This actor is considered a persistent threat to French interests 【1】.

### Technical Details and What Defenders Should Know
The investigation was led by the **Centre de coordination des crises cyber (C4)**, which aggregates efforts from the ANSSI, DGSE, DGSI, DGA, and the Cyberdefense Command.

To support the technical defense community, the C4 has published a joint report detailing the offensive cyber activities of IRGC-linked actors against French interests. Security teams and system administrators are advised to consult this official threat intelligence document:

* **Official Technical Report:** [CERTFR-2026-CTI-009](https://cert.cyber.gouv.fr/cti/CERTFR-2026-CTI-009/) 【1】

This report should be prioritized by organizations seeking to understand the specific tactics, techniques, and procedures (TTPs) used by the SHAHID KAVEH unit to conduct sabotage operations.
Offensive cyber activities targeting France conducted by Iranian actors linked to the IRGC - CERT-FR

This précis summarizes the advisory **CERTFR-2026-CTI-009** concerning offensive cyber operations against French national interests.

### **What Happened**
On October 11–12, 2026, threat actors conducted a major, aggressive sabotage attack targeting approximately 700 industrial refrigeration systems across France 【1】. The attackers remotely accessed these controllers and forced them to operate at high temperatures, causing significant food spoilage and leading to at least 15 reported fires 【1】.

The incident has been formally attributed by the *Centre de Coordination des Crises Cyber* (C4) to the **Shahid Kaveh** and **Shahid Shoostari** units, which operate within the Electronic and Cyber Center of the Iranian Islamic Revolutionary Guard Corps (IRGC-CEC) 【2】.

### **Who is Affected**
* **Primary Targets:** Companies in the French retail distribution sector, specifically identified groups include Casino, Leclerc, Coopérative U, Metro, Carrefour, and Intermarché 【1】.
* **Other Victims:** Additional impacts were noted in the broader agro-food sector, including small butcher shops, an abattoir, and cooperative food processing plants 【1】.
* **Energy Sector:** A simultaneous, moderate impact was recorded on Schneider Electric equipment at small French hydroelectric facilities, which has been linked to the same actor 【1】.

### **Technical Details**
* **TTPs:** The attackers utilized the **FOFA** search engine for target identification 【1】. They leveraged their ability to communicate with industrial control systems via the **Modbus protocol (port 502)**, a technique observed as early as April 2026 【1】.
* **Capability:** The Shahid Kaveh unit utilizes specialized scripts to scan, access, and manipulate industrial controllers from major vendors, specifically **Schneider Electric, Siemens, and Rockwell** 【1】.
* **Attribution Clues:** Analysts discovered traces of Farsi within the attack infrastructure and noted that the campaign was promoted on the "CyberbanNews" propaganda channel shortly after the event 【1】.

### **Security Implications**
This attack is characterized by its high level of aggression and significant physical damage, marking a shift from previous destabilization operations (such as those against *Charlie Hebdo* in 2023 or the 2024 Olympic display systems) toward direct industrial sabotage 【1】【2】. The incident confirms that the Shahid Kaveh unit actively maintains the capability to conduct large-scale, automated sabotage against critical and industrial infrastructure in France and other European nations 【1】.

### **What Defenders Should Know**
While the specific advisory provides exhaustive threat intelligence, defenders should focus on the following core risks identified by the C4:
* **Industrial Exposure:** Infrastructure using Modbus (port 502) is a specific target for this threat actor. Organizations should verify that such controllers are not directly exposed to the internet.
* **Vendor Risk:** The actor possesses pre-developed capability to manipulate hardware from **Schneider Electric, Siemens, and Rockwell**.
* **Proactive Monitoring:** Since the attacker uses tools like FOFA to identify targets, entities should monitor their own public-facing assets for unauthorized reconnaissance or unexpected connections from known malicious infrastructure.
Who Runs Qilin? Identifying Haise - justpaste.it

This investigation details the successful de-anonymization of "Haise," a central administrator for the Qilin ransomware group, which has been identified as a leading ransomware threat during the 2025–2026 period.

### What Happened
Security researchers successfully linked the alias "Haise"—the public-facing administrator for the Qilin ransomware-as-a-service (RaaS) operation—to a specific individual. By aggregating data from underground hacking forums, leaked public databases, and social media/messaging activity, investigators established a definitive chain of evidence identifying this operator as **Alexey Mikhailovich Yakovtsev** (born August 18, 1990).

### Who is Affected
* **The Subject:** Alexey Mikhailovich Yakovtsev has been unmasked as the primary administrator "Haise."
* **Targeted Organizations:** As an administrator for Qilin, Yakovtsev facilitated campaigns affecting a broad range of enterprise targets, specifically those utilizing Windows, Linux, ARM, NAS, and ESXi environments.

### Technical Details of Identification
The investigation utilized a multi-vector approach to bypass the operator’s operational security (OPSEC):
* **Cross-Forum Linking:** Researchers connected the "Haise" persona on the RAMP forum to other accounts, specifically "alexbigboss44" on Exploit and "Rjun" on XSS, by analyzing cross-platform profile metadata.
* **Digital Footprint:** The alias "Rjun" was linked to the email address `mail-30a@mail.ru`, which was corroborated by activity on the Zloy hacking forum.
* **Leaked Database Correlation:** This specific email address was identified in a leaked database from Russia’s *Gosuslugi* (Public Services) portal, which provided Yakovtsev’s real-world identity, residential address, and passport information.
* **Verification:** Investigators confirmed the link by tracing a phone number belonging to Yakovtsev’s biological sister to a Telegram account (ID 118329521). This account contained direct evidence of the user managing Qilin operations, including discussions on bypassing security tools like CrowdStrike and promoting ransomware-as-a-service affiliate programs.

### Security Implications
* **RaaS Infrastructure:** The identification highlights the human component behind the highly structured Qilin RaaS model. The operator acted as the primary liaison for recruitment, feature development, and marketing of the group's "pressure tactics" (e.g., automated tools for contacting lawyers/victims).
* **Advanced Capabilities:** Yakovtsev’s role included active research into bypassing Endpoint Detection and Response (EDR) solutions and acquiring enterprise-grade exploits, signaling a sophisticated threat landscape for defenders.

### What Defenders Should Know
* **Historical Correlation:** Defenders should cross-reference existing incident response data against the aliases "Haise," "Rjun," and "alexbigboss44" to identify historical involvement in Qilin-related breaches.
* **Threat Actor Profiling:** This case demonstrates that even high-level threat actors can be deanonymized when their "underground" identities inadvertently overlap with real-world personal information found in data breaches.
* **Continuous Threat:** Despite the exposure of its primary administrator, the Qilin group maintains capabilities to deploy specialized ransomware across diverse operating systems and continues to be a high-priority threat for corporate environments.
velociraptor/artifacts: Installs and runs Sysinternals Autoruns for Linux to enumerate autostart and persistence mechanisms. - Rapid7

This article is not a report on a specific cybersecurity incident or attack, but rather a technical definition for an **artifact within the Velociraptor digital forensics and incident response (DFIR) platform**.

The `Linux.Sysinternals.Autoruns` artifact is a tool designed to help security professionals detect persistence mechanisms on Linux systems.

### What is this?
It is a configuration script for Velociraptor that automates the deployment and execution of "Autoruns for Linux." Its primary purpose is to inventory all programs, scripts, services, and other components configured to launch automatically across a wide range of system events.

### Who is affected?
There are no "victims" or "affected parties" in the sense of a compromise. This tool is intended for use by **system administrators, security analysts, and incident responders** who need to audit Linux systems to ensure they are not harboring unauthorized or malicious software set to run automatically.

### Security Implications
This tool is a powerful defense and hunting mechanism. Attackers frequently use persistence mechanisms—such as modifying systemd services, cron jobs, or startup scripts—to ensure their malware survives a system reboot. By running this artifact, defenders can:
* **Identify Persistence:** Detect hidden or unauthorized auto-start points that an attacker might be using to maintain access.
* **Baseline Configurations:** Establish what "normal" startup behavior looks like on a clean system.
* **Forensic Investigation:** Quickly scan compromised machines to see which processes are configured to run automatically.

### Technical Details
The artifact works by leveraging the official Sysinternals Autoruns binary for Linux. Its technical implementation includes:
* **Comprehensive Scanning:** It categorizes auto-start locations into areas such as Logon (XDG/shell), Services (systemd), Scheduled Tasks (cron/timers), Boot (SysV init), Hijacks, Loaders (`ld.so.preload`), Network hooks, Browser extensions, and Device/Mount configurations.
* **Safe Execution:** The artifact explicitly states that it is a discovery tool; it merely inventories these mechanisms and **never executes** the discovered commands or starts the units.
* **Flexibility:** It supports optional parameters, such as defining an alternate root filesystem (useful for scanning container filesystems or mounted forensic images) and the ability to compute SHA256 hashes of the identified image paths for verification and threat intelligence matching.
* **Integration:** It parses the output of the Autoruns binary into a structured CSV format, allowing analysts to view and query findings directly within the Velociraptor interface.

### What Defenders Should Know
* **It is a Detection Utility:** Do not mistake the "Autoruns" name for a malicious script. This is a standard, reputable tool used for defensive auditing.
* **Scope:** Because it covers everything from browser extensions to kernel-level `ld.so.preload` configurations, the output can be voluminous. Analysts should be prepared to filter results effectively to separate expected system behavior from suspicious entries.
* **Hashing:** The artifact includes a default setting to calculate hashes (`CalculateHashes: Y`). This is vital for defenders, as it allows for immediate cross-referencing of discovered binaries against threat intelligence databases (e.g., VirusTotal).
* **Environment Agnostic:** By utilizing the `Root` parameter, defenders can use this artifact not just on live systems, but also when performing offline analysis of disk images or containers, making it a versatile tool in a responder's toolkit.
homer: Evasive fork of Donut to generate position-independent shellcode that loads PE Windows payloads from memory - twili8

Homer is an advanced, security-hardened fork of the popular `donut` tool, designed to generate shellcode that executes arbitrary Windows PE files, .NET assemblies, or scripts in memory 【1】【2】. Its primary purpose is to resist static analysis and automated extraction tools (such as `donut-decryptor`) that rely on fixed byte patterns or structural invariants within the payload 【1】.

### What Happened
Homer modifies the standard `donut` architecture by removing or moving every invariant that static analysis tools traditionally exploit. By introducing per-build secrets and structural randomization, it ensures that there are no stable byte offsets available for static parsers to reliably identify or disassemble the payload 【1】.

### Who Is Affected
* **Security Defenders & Malware Analysts:** Individuals tasked with signature-based detection, automated triage, or static analysis of malicious payloads will find legacy extraction tools ineffective against Homer-generated artifacts.
* **Red Teamers & Researchers:** The tool is explicitly intended for authorized defensive research and red teaming, providing a method to test the resilience of detection systems against advanced, obfuscated memory-only payloads 【2】.

### Security Implications & Technical Details
Homer's hardening techniques significantly alter the typical indicators of shellcode:
* **Structural Randomization:** It uses per-build randomized padding and shuffles field groups, making structural analysis impossible without knowledge of the specific build configuration 【1】.
* **Decryption Stubs:** Rather than plaintext indicators, Homer uses a small, per-build stub that decrypts the payload body at runtime 【1】.
* **Advanced Memory Manipulation:**
* **Unhooking:** It natively includes an unhooking pass that maps fresh, uninstrumented versions of DLLs from `\KnownDlls` or disk, bypassing standard EDR hooks without triggering `+X` (executable) memory permission changes 【1】.
* **Import Scrubbing:** After binding imports, the loader zeroes out the hint/name and DLL-name strings in memory, preventing simple identification of the payload's API surface via memory scanning 【1】.
* **Removal of "Noisy" Features:** The tool explicitly removes features common in `donut`, such as AMSI/WLDP/ETW bypass signatures and HTTP staging code, to avoid triggering common detection heuristics 【1】.

### What Defenders Should Know
* **Static Analysis Limitations:** Defenders must acknowledge that traditional static signatures for `donut` will not detect Homer. Static analysis is intentionally rendered ineffective by the tool's architecture 【1】.
* **Prioritize Dynamic Analysis:** Because the loader must eventually reveal the payload in memory to execute it, dynamic analysis—specifically monitoring memory allocations, process hollowing/injection behaviors, and capturing memory dumps—is the only reliable path for analysis 【1】.
* **No Information-Theoretic Secrecy:** While robust against static tools, Homer provides no "true" secrecy. A determined analyst can recover the payload through emulation or disassembling the decryption stub, as the decryption key is derived deterministically from the payload itself 【1】.
* **Scope of Defense:** The tool does not include runtime anti-analysis features (e.g., anti-debug or anti-VM checks), which remain a primary vector for defenders to intercept and analyze the payload while it is active in memory 【1】.
Silverseal: Silverseal is an open-source Linux bootkit and rootkit framework written in Rust, using UEFI and early kernel boot hooks to load a stealthy kernel rootkit. - Idov31

The Silverseal project is an open-source research framework designed to demonstrate the mechanics of UEFI bootkits on Linux systems. It provides a proof-of-concept for achieving pre-OS persistence by hijacking the boot process to load a malicious kernel module.

### What Happened
The project researchers developed a Rust-based framework (`silverseal-bootkit.efi`) that replaces the legitimate UEFI bootloader (such as GRUB) on a target system. By intercepting the boot process before the Linux kernel is fully initialized, it ensures that its own code—a "stager"—executes as part of the kernel's startup sequence. This stager subsequently loads a kernel module (`silverseal_rootkit.ko`), establishing a persistent presence on the system.

### Who Is Affected
While Silverseal is intended for educational and security research purposes, its mechanisms highlight vulnerabilities that could affect any system relying on standard UEFI boot processes. The current implementation is highly tailored to specific environments, with documentation and build workflows specifically referencing Ubuntu-based Linux targets and specific kernel configurations.

### Security Implications
Silverseal operates at a "pre-OS" level, which grants it significant advantages over standard user- or kernel-mode malware:
* **Privilege Level:** By loading during the boot phase, the bootkit establishes itself at Ring 0, allowing it to bypass OS-level security controls that are initialized later in the boot cycle.
* **Persistence:** Because the persistence mechanism is anchored in the UEFI boot process rather than the OS filesystem, it is difficult to detect and remove using standard security software running within the operating system.
* **Rootkit Capability:** The payload functions as a kernel module, providing the ability to intercept system calls, hide processes, or manipulate kernel data structures.

### Technical Details
The framework utilizes a multi-stage approach to compromise the system:
* **Boot Hooking:** It replaces the target's standard EFI bootloader with its own, backing up the original binary to maintain a semblance of normal system behavior.
* **Kernel Detouring:**
* **x64:** Hooks the Linux boot-image function within GRUB, detours the zstd kernel decompressor, and modifies a late-initcall to redirect execution to the stager.
* **ARM64:** Uses a similar approach, matching the decompressed kernel against a known profile before redirecting a late-initcall.
* **Payload Execution:** The stager leverages the kernel's `schedule_work` function to queue the execution of the rootkit module (`insmod`) after a short delay, ensuring it executes once the kernel is sufficiently initialized.

### What Defenders Should Know
Defenders can mitigate these types of threats by focusing on boot integrity and kernel-level monitoring:
* **Verify Boot Integrity:** Regularly audit the EFI system partition. Any unauthorized modification or replacement of bootloaders like GRUB is a primary indicator of compromise.
* **Monitor Module Loading:** Scrutinize the loading of kernel modules. Unexpected or unsigned modules, especially those loaded via `/sbin/insmod` during early boot, should be treated as highly suspicious.
* **Behavioral Analysis:** Monitor for suspicious use of kernel worker threads (such as `schedule_work`) during the boot process.
* **Use Defensive Baselines:** Because the rootkit relies on specific kernel versions and structure layouts (e.g., `work_struct`), maintaining hardened, known-good kernel configurations is essential.
* **Recovery and Validation:** Use tools to revert bootloader changes to a known-clean state. Testing and validating boot behavior in controlled, isolated virtual machine environments can help defenders identify specific indicators of compromise relevant to their own infrastructure.