Inferlume

Part A: Cisco SD-WAN — CVE Chain Technical Breakdown

CVE-2026-20127 (CVSS 10.0) — Authentication Bypass: Core Attack Vector

Vulnerability class: CWE-287 — Improper Authentication
Attack vector: Network. No authentication required. No user interaction required.

Technical mechanism: CVE-2026-20127 exploits a flaw in the peering authentication logic of Cisco Catalyst SD-WAN Controller and Manager. An unauthenticated remote attacker can send specially crafted requests to an unpatched system, causing it to authenticate the attacker as a high-privileged non-root user. Once authenticated, the attacker gains access to the NETCONF protocol endpoint used to manage SD-WAN fabric configuration across all connected network devices.

Operational impact of successful exploitation: An attacker with NETCONF access can read and modify routing policy, VPN tunnel configuration, access control lists, and WAN interface settings across the entire SD-WAN fabric — equivalent to administrative control over all connected sites without needing to breach individual devices.

Exploitation confirmed since: At least 2023, per SOC Prime citing CISA reporting. Formal CVE disclosure and KEV listing: February 24, 2026.

Affected components: Cisco Catalyst SD-WAN Controller; Cisco Catalyst SD-WAN Manager (vManage).

Patch: Applied via Cisco-provided software update; per FedRAMP Notice 0006, the remediation deadline for FedRAMP cloud providers was February 27, 2026.

CVE-2022-20775 — Privilege Escalation to Root: Persistence Chain

Vulnerability class: Path traversal enabling root command execution.
Attack vector: Requires prior authenticated access (obtained via CVE-2026-20127).

Technical mechanism: After achieving initial authenticated access via CVE-2026-20127, an attacker uses CVE-2022-20775's path traversal flaw to execute arbitrary commands as root on the SD-WAN Controller operating system. Root access enables persistent implant installation, credential extraction, and configuration manipulation that survives reboots and patches to the authentication bypass alone.

Why this chain matters: CVE-2026-20127 provides management-plane access; CVE-2022-20775 converts that access into operating-system-level persistence. CISA's ED-26-03 specifically calls out this chaining behavior as the mechanism enabling durable attacker foothold on SD-WAN infrastructure.

CVE-2026-20122 (CVSS 5.4) — Improper Use of Privileged APIs: Filesystem Manipulation

Vulnerability class: Improper use of privileged APIs; allows arbitrary file upload.
Attack vector: Network. Requires low-privileged (read-only) API credentials — achievable after initial compromise.

Technical mechanism: An authenticated attacker with read-only API credentials can craft API requests that upload a malicious file and overwrite arbitrary files on the SD-WAN Manager local filesystem, escalating privileges to vmanage user level. In the broader chain, this enables persistent modification of Manager configuration, introduction of backdoored scripts, or credential file replacement.

Exploitation confirmed: By Cisco in March 2026 advisory update.

CVE-2026-20128 (CVSS 7.5) — Password in Recoverable Format: Credential Harvesting

Vulnerability class: Storage of password in recoverable format; CWE-257.
Attack vector: Local — requires prior filesystem access (achieved via CVE-2026-20127 + CVE-2022-20775 chain).

Technical mechanism: Cisco Catalyst SD-WAN Manager stores DCA (Device Configuration Archive) service account credentials in recoverable format on the local filesystem. An attacker with local access — gained through the preceding chain — can read and recover these credentials, enabling further privilege escalation and lateral movement to additional SD-WAN components or adjacent infrastructure.

Exploitation confirmed: By Cisco in March 2026 advisory update.

CVE-2026-20133 (CVSS 6.5) — Sensitive Information Exposure: Reconnaissance Enablement

Vulnerability class: Information exposure of sensitive configuration data.
Attack vector: Network.

Technical mechanism: A flaw in Cisco Catalyst SD-WAN Manager exposes sensitive configuration information to an attacker with network access. VulnCheck assessed the risk as higher than the CVSS score suggests — noting that the exposed information can be leveraged to accelerate exploitation of other vulnerabilities in the chain or enable targeting of downstream network infrastructure.

CISA KEV listing: April 20, 2026. Cisco has not independently updated its advisory to confirm exploitation at time of source consumption — discordance noted in confidence rationale.

Cisco SD-WAN Attack Chain: Integrated Exploitation Flow

textSTEP 1: CVE-2026-20127
  → Unauthenticated request to SD-WAN Controller/Manager
  → Authentication bypass: attacker authenticated as high-privileged non-root user
  → NETCONF access obtained: full SD-WAN fabric management plane compromised

STEP 2: CVE-2022-20775
  → Path traversal from authenticated session
  → Arbitrary OS command execution as root
  → Persistent implant installed: survives authentication fix alone

STEP 3: CVE-2026-20122
  → Authenticated (read-only) API credentials used
  → Malicious file uploaded via privileged API misuse
  → Arbitrary file overwrite on Manager filesystem
  → Privilege escalation to vmanage user

STEP 4: CVE-2026-20128
  → Local filesystem access (from Step 2/3)
  → DCA credentials recovered from storage
  → Credential reuse enables lateral movement to additional SD-WAN infrastructure

STEP 5: CVE-2026-20133
  → Network-accessible information exposure
  → Sensitive configuration data retrieved
  → Reconnaissance data accelerates targeting of downstream network devices

Exploitation conditions: Management interface must be network-accessible. Risk is highest where management planes are internet-exposed or in under-segmented networks.

Part B: Kyber Ransomware — Full Technical Analysis

Variant Comparison Matrix

ESXi Variant — Deep Technical Analysis

Binary characteristics:

• 64-bit ELF executable. Not stripped. Statically linked against OpenSSL 1.0.1e-fips. C++, compiled with GCC 4.4.7 (a 2012-era compiler).

• Binary is not packed or obfuscated — full symbol and string information retained.

Execution flow:

1. Parse CLI arguments: target path required; encryption size parameter validated as 0–100 (controls what percentage of large files is encrypted).

2. Initialize optional logging.

3. If --vmkill flag set: enumerate and gracefully terminate all non-whitelisted VMs via esxcli vm process list, then esxcli vm process kill --type=soft --world-id <id>. Uses fork()/execlp() rather than system() — direct syscall-level argument passing avoids shell injection issues, indicating low-level OS programming competency.

4. Load embedded RSA-4096 public key.

5. Initialize thread pool (capped at 12 threads for parallel encryption).

6. Traverse directories recursively; encrypt files.
   
   

Background persistence during encryption:

• Implements a --detach flag: forks the parent process, exits the parent, calls setsid() on the child to detach from the controlling terminal and avoid SIGHUP on SSH session close. Allows the operator to disconnect safely while encryption continues uninterrupted across /vmfs/volumes.

Defacement (pre-encryption):
Before the encryption loop begins, the binary replaces three files:

• /etc/motd — displays ransom note on SSH login

• /usr/lib/vmware/hostd/docroot/index.html — replaces VMware web management portal

• /usr/lib/vmware/hostd/docroot/ui/index.html — replaces Host Client interface

Any administrator accessing the system via SSH or the vSphere web console sees the ransom note immediately, regardless of encryption progress. Replacement fails gracefully on non-ESXi systems.

Directory traversal:

• Recursive walk; does NOT follow symbolic links.

• Drops readme.txt ransom note into every folder before encryption begins.

• No file extension allowlist — all files encrypted unless explicitly excluded.

• Excluded extensions/names: .xhsyw (already encrypted), .locksignal, .processing, .cryptdata_backup, .tmp, readme.txt, .sf (VMware system files).

Encryption mechanism (confirmed by Rapid7 decompilation — not as advertised):

• Advertised: AES-256-CTR + X25519 + Kyber1024.

• Actual: ChaCha8 for bulk encryption; RSA-4096 for key wrapping only. No post-quantum implementation found.

• Decompilation evidence: ECRYPT_encrypt_bytes function executes 8 rounds (i = 8; i > 0; i -= 2) with 32-bit right rotations at constants 16, 20, 24, and 25 (corresponding to ChaCha standard left-rotation constants 16, 12, 8, 7 from RFC 8439). ECRYPT_keysetup uses the "expand 32-byte k" sigma constant in standard ChaCha 256-bit key initialization layout.

Partial encryption strategy (size-based):

This approach dramatically reduces encryption time while still rendering large VMDK files unusable.

Per-file encryption workflow:

1. Create .locksignal marker file; rename original to .processing (concurrency guard).

2. Check last 535 bytes for trailer markers KYBER, CDTA, ATDC — skip if present (already encrypted).

3. Generate unique 40-byte key/IV; wrap with embedded RSA-4096 public key.

4. Append metadata trailer (with redundant .cryptdata_backup copy) before encryption starts.

5. Encrypt in-place in 1 MB chunks.

6. Rename from .processing to .xhsyw on success.

• Files remaining with .processing suffix indicate interrupted or failed encryption.

Windows Variant — Deep Technical Analysis

Binary characteristics:

• 64-bit PE executable. Not stripped, not packed. Rust, compiled with MSVC 19.36 / VS2022.

• Retains full Rust panic strings and cargo dependency paths including build path: C:\Users\user\.cargo\registry\src\index.crates.io-6f17d22bba15001f

• Binary version flag reveals project name: win_encryptor 1.0

Entropy pipeline (custom — atypical for ransomware):
Aggregates entropy from four independent sources: system time, Windows CSPRNG (BCryptGenRandom), processor-based entropy via RDRAND, and running process telemetry. Produces approximately 30 KB of randomness to seed an internal AES-CTR DRBG. Unlike typical ransomware using only BCryptGenRandom, this custom pipeline suggests deliberate attention to key material quality by the developer.

Privilege check:
On startup, the binary checks for elevated privileges by attempting to acquire SeDebugPrivilege. This determines execution path:

• Without elevation: File encryption only.

• With elevation: Full toolkit unlocked — service termination, registry modification, shadow copy deletion, all 11 anti-recovery commands.

Service termination (elevated, via Windows Service Control Manager API):
Uses OpenSCManagerA, EnumServicesStatusA, and ControlService to terminate services matching five patterns: msexchange, vss, backup, veeam, sql. Forces system locale to en-US before enumeration to ensure pattern matching is language-independent regardless of the victim's regional settings.

11 Anti-Recovery Commands (complete list — source confirmed from Rapid7):

Hyper-V shutdown (experimental, requires --system flag):
If invoked with the --system flag, the binary enumerates Hyper-V VMs via PowerShell:

textGet-VM | select VMId, Name | ConvertTo-Json
Stop-VM -Force -TurnOff

Hard shutdown (-TurnOff) forces abrupt termination to release file locks before encryption. The developer explicitly labels this as "experimental."

File encryption workflow (Windows):

1. Check for prior encryption marker — skip if already encrypted.

2. If file is locked by a process, use Windows Restart Manager API to identify and terminate the responsible process.

3. If still inaccessible, modify file ACL to Everyone:FullControl and clear the read-only attribute.

4. Retry entire sequence up to three times per file.

5. Encrypt successfully opened file.

6. Rename with .#~~~ extension; drop READ_ME_NOW.txt in the directory.

7. Log to console: Successfully encrypted <file>. File size: <size>.
   
   

Excluded directories (Windows variant):

text$recycle.bin, perflog, system volume information, thumb, programdata, appdata,
microsoft, netframework, c$, all users

Excluded files (Windows variant):

textREAD_ME_NOW.txt, lockerlog_*, processed_file.icon, ntuser.dat, ntuser.dat.log,
ntuser.ini, desktop.ini, autorun.inf, ntldr, bootsect.bak, thumbs.db,
boot.ini, iconcache.db, bootfont.bin

Cryptography (Windows — confirmed as advertised):

• Hybrid key encapsulation: Kyber1024 (1568-byte / 0x620 public key, validated at runtime) + X25519 protect the symmetric key material.

• Bulk encryption: AES-256-CTR.

• Per-file: AES-256-CTR context initialized with 32-byte key expanded into 60-word key schedule.

• Kyber1024 is NOT used for direct file encryption — it encapsulates the AES-CTR symmetric key.

Registry artifacts and icon registration (elevated):

1. Creates directory C:\fucked_icon\

2. Writes processed_file.icon to that path

3. Registers .#~~~ extension in the registry with this as the default icon

4. Executes ie4uinit.exe to refresh the shell icon cache immediately — encrypted files display the custom icon without requiring a system restart

Mutex:

textboomplay.com/songs/182988982

Stored as a wide string in .rdata. References Boomplay, a legitimate African music streaming platform. The specific track was unidentifiable by Rapid7 due to geo-restrictions.

Part C: CISA KEV 8-Pack — Supplemental Technical Notes

CVE-2025-32975 — Quest KACE SMA (CVSS 10.0)

Mechanism: Improper authentication validation in Quest KACE Systems Management Appliance allows an unauthenticated attacker to craft requests treated as originating from a legitimate authenticated user. Full user impersonation achieved without credentials. KACE SMA holds endpoint management privileges across all managed devices — post-compromise scope is effectively equivalent to domain-level endpoint administration.

CVE-2026-34197 — Apache ActiveMQ Jolokia JMX-HTTP Bridge

Mechanism: The Jolokia JMX-HTTP bridge at /api/jolokia/ in Apache ActiveMQ Classic accepts authenticated management API calls. An attacker uses credentials (default admin:admin is endemic in production) to invoke a broker management operation that fetches a remote configuration file from an attacker-controlled URL and executes its contents as OS commands within the broker process. Discovered by Horizon3 using Anthropic Claude AI. Patch: Apache ActiveMQ Classic 5.19.4 or 6.2.3.

CVE-2026-33825 (BlueHammer) — Microsoft Defender

Mechanism: Insufficient granularity of access control in Microsoft Defender allows a low-privileged process to invoke privileged Defender operations, achieving SYSTEM-level privilege escalation. PoC released April 3, 2026. Patched April 14 in Defender version 4.18.26030.3011. Active exploitation confirmed by Huntress Labs telemetry as of April 20-21, 2026.
RedSun: Second local privilege escalation path in Defender. CVE ID: [NOT CONFIRMED in available sources]. PoC released April 16, 2026.
UnDefend: Exploits a condition causing Defender to fail to receive definition updates — effectively blinding endpoint protection. CVE ID: [NOT CONFIRMED in available sources]. PoC released April 16, 2026.