Security news from the BlueTeamSec community for Thursday the 12th of November 2026. A busy one today, with nineteen stories to get through.
VMRay Labs have written up a China-nexus espionage campaign targeting Indian entities with ValleyRAT malware. The operation used tax-themed lures delivered via disk images, with DLL side-loading and fileless registry persistence to stay under the radar. Worth a look if you're tracking Silver Fox or dealing with similar targeting in the region.
Check Point Research identified CopperDragon, a China-nexus actor operating as what they're calling a digital quartermaster — essentially providing the Sparrow malware framework to multiple APT groups. The year-long campaign hit telecoms, government, and critical infrastructure across Latin America, Asia, and Europe, using modular backdoors and kernel-level rootkits. One for those tracking shared tooling ecosystems.
ESET have analysed Turla's Cereal toolset, a modular framework targeting Microsoft Exchange servers in Kazakhstan and Romania. The campaign features memory-resident execution and passive backdoors that hook directly into Exchange transport pipelines for email exfiltration, avoiding outbound beaconing entirely. This follows earlier coverage we saw in August around Turla's custom mixed-mode loaders.
An investigation by Artem Tamoian links personnel from contractor Yutek-NN to 2021 cyber-enabled harassment campaigns against Russian opposition activists. The operation used leaked databases to dox targets and send threatening emails, with Yutek-NN stakeholders including identified FSB officers — demonstrating the state-contractor nexus for domestic political suppression.
ZenoX have documented a new APT-C-36 campaign targeting Latin American judicial, legal, and educational institutions. The threat actor is using judicial-themed spearphishing with HTML smuggling to deploy a modular remote access tool capable of data exfiltration and surveillance through a fileless delivery chain.
Recorded Future have identified GhostFrame, a new ESXi implant linked to Settra ransomware operations. The malware persists via startup scripts, installs a backdoor process masquerading as a legitimate service, and disables security controls including firewall rules. Detection opportunities include watching for simultaneous TCP SYN packets across multiple ports.
JPCERT has released an Incident Investigation Report Checklist — a methodological framework designed to standardise cybersecurity incident reporting. It provides structured checklists and templates for both investigators and client organisations to ensure comprehensive, evidence-based reports with proper technical rigour. Useful reference if you're writing up incidents or reviewing third-party reports.
eMudhra suffered a critical key ceremony failure in April 2025 when a flawed Python script used for HSM key migration truncated ECDSA private keys to a single byte, making them cryptographically weak and recoverable from public information. The incident compromised sixteen subordinate CA certificates and resulted in eMudhra exiting the public TLS certificate business entirely. The full incident report is now public on Mozilla's Bugzilla.
Researchers discovered Operation Snowball, an autonomous AI-driven intrusion campaign targeting a European telecommunications provider and thirteen third-party organisations. The attacker used a jailbroken model with a million-token context window to enable an AI agent to autonomously conduct reconnaissance, adapt tactics to evade defences, and maintain persistent access over two weeks with minimal human intervention. This follows earlier commentary we covered on when cyber attacks stop being limited by people — worth reading together if you're tracking AI-enabled threats.
Security researchers published a lab reproduction of CVE-2026-123158, a critical authentication bypass in OpenSSH affecting systems using musl libc without PAM support. The flaw allows attackers to bypass authentication for locked accounts by exploiting a collision where musl's crypt function returns an asterisk for passwords over 256 bytes, matching the hash used for locked accounts. Vulnerable systems include Alpine Linux, OpenWrt, and Buildroot running unpatched OpenSSH with password authentication enabled. CISA added this to the KEV catalogue a couple of days ago.
AIR Security discovered a library hijacking vulnerability in Anthropic's Claude document-handling skills. When LibreOffice conversion attempts are blocked, a helper script loads a shim library from a predictable path in a shared temporary directory without verifying its contents, enabling potential code execution. Flag this if you're deploying AI assistants with document-handling capabilities.
Barracuda Networks disclosed two high-severity vulnerabilities affecting multiple products including Email Security Gateway, WAF, and Load Balancer ADC. One is a pre-authentication authorization bypass with a CVSS of 9.3, the other a command injection flaw requiring administrative credentials. Both pose significant risks if admin interfaces are exposed. CISA added these to the KEV catalogue earlier this week.
A proof-of-concept tool called Quick-Shift modifies Windows shortcut files to point icon paths to attacker-controlled network paths. When users interact with modified shortcuts, Windows automatically initiates connections that leak NTLM hashes to attacker-controlled responder listeners, enabling credential harvesting and relay attacks.
Proofpoint researchers identified BluePhishing, a proof-of-concept attack exploiting OAuth consent abuse in Microsoft Entra AI agent ecosystems. Attackers can trick users into granting consent to malicious AI agent blueprints, enabling autonomous creation and management of multiple AI agent identities within the victim's environment. No in-the-wild exploitation has been observed yet.
Tokyo police arrested a Chinese national operating an unlicensed SMS blaster device from a moving vehicle, targeting tourists in high-traffic districts. The fake base station forced over ten thousand mobile phones to connect to a rogue 2G network within two hours, enabling fraudulent phishing messages that harvested payment card information, resulting in twenty-six thousand dollars in losses since January. We've been tracking SMS blaster arrests since September — this is the latest in a series.
Sekoia documented coordinated cyberattacks in October and November targeting internet-exposed Danfoss refrigeration controllers across multiple European countries, causing mass food spoilage and hitting critical infrastructure including the French Blood Establishment. Attackers exploited unauthenticated vulnerabilities, including a non-public account renaming flaw, to manipulate temperature setpoints, with evidence suggesting the use of AI to analyse firmware and identify exploitable weaknesses. This ties into earlier coverage we saw around industrial refrigeration systems being targeted — worth reading together.
Microsoft patched CVE-2026-124194, a spoofing vulnerability in Outlook caused by missing warnings for unsafe actions. The flaw was actively exploited in the wild before patches were released, prompting CISA to add it to the KEV catalogue. Attackers can exploit this to deceive users into trusting spoofed actions, facilitating phishing and malware delivery.
PRODAFT analysed a sophisticated multi-architecture Linux botnet deploying at least thirteen distinct payloads targeting various CPU architectures. The botnet uses divergent scanning methods, with different samples focusing on Telnet propagation versus exploitation handlers, and features specialised DDoS control mechanisms for orchestrating attacks across compromised Linux servers, IoT devices, and embedded systems.
A proof-of-concept implementation demonstrates the CerealLoader technique associated with the Turla APT group. The custom mixed-mode loader bridges native and managed code execution to evade analysis by forcing analysts to switch between disassemblers and .NET decompilers, featuring loader lock avoidance and export forwarding for DLL hijacking. Useful reference if you're dealing with Turla tooling or similar evasion techniques.
That's everything for today from BlueTeamSec. The writing is by the original authors — the analysis was automated.