Inferlume

How it Works
Pricing
About
Get Free Access →

Get Free Access

Last Updated On

DDAAIILLYY--22002266--00552222
CCrriittiiccaall
AAccttiivvee  EExxppllooiittaattiioonn  CCoonnffiirrmmeedd

Defender Platforms Under Fire, Kimwolf Botnet Operator Arrested

KEV-listed Langflow and Trend Micro Apex One flaws, plus a CVSS 10.0 Cisco Secure Workload bug, define today’s risk picture. Add a weaponized Linux LPE and a DDoS botnet disruption, and the pattern is clear: trusted tools are now the attack surface.

10

CVSS Score

9

IOC Count

16

Source Count

78

Confidence Score

CVEs

CVE-2025-34291, CVE-2026-34926, CVE-2026-20223, CVE-2026-41091, CVE-2026-45498

Actors

MuddyWater (Iranian-linked APT, Under Attribution for Langflow exploitation), AISURU/Kimwolf botnet operators, Jacob "Dort" Butler (charged Kimwolf operator), Calypso/Red Lamassu (China-aligned APT, telco espionage, Under Attribution)

Sectors

Federal Civilian Executive Branch, Telecommunications, Service Providers, Information Technology, Gambling, Gaming, Computer Software, Enterprise Security Operations

Regions

United States, Canada, China, Hong Kong, Germany, Brazil, United Kingdom, Vietnam, Azerbaijan, India, Singapore, Asia-Pacific, Middle East

Chapter 01 - Executive Overview

Today's brief covers five distinct incidents unified by a single strategic theme: the security tools and platforms that organizations rely upon to defend their environments are themselves becoming high-value attack surfaces. Endpoint protection engines, endpoint security management servers, AI orchestration platforms, and network segmentation control planes are all represented in today's active exploitation landscape. Alongside these, a long-running nation-state espionage campaign against telecommunications providers surfaces new tooling detail, and law enforcement scores a meaningful but partial disruption of a major DDoS botnet ecosystem.

Overall severity is Critical, driven by a CVSS 10.0 unauthenticated API flaw in Cisco Secure Workload, two actively exploited Microsoft Defender zero-days now on CISA's KEV list, a CVSS 9.4 Langflow RCE with confirmed exploitation since January 2026, and a weaponized Linux local privilege escalation with public proof-of-concept code.

Langflow RCE in AI Orchestration Stacks

An origin-validation error in Langflow (CVE-2025-34291, CVSS 9.4) allows a malicious website to hijack a logged-in user's session, harvest refresh tokens, and execute arbitrary Python code through Langflow's own workflow execution endpoints, yielding full compromise of the AI orchestration environment and all downstream integrations. CISA has placed this CVE in the Known Exploited Vulnerabilities catalog, ordering U.S. federal civilian agencies to patch by early June 2026. Exploitation has been confirmed active since at least 23 January 2026 per CrowdSec Intelligence Network telemetry. MuddyWater, an Iranian-linked APT, is attributed by multiple consulted sources with exploiting this vulnerability for initial access, though this attribution is marked Under Attribution as it has not been confirmed by a primary government advisory within this window.

  • The blast radius extends beyond the Langflow host itself: all API keys, access tokens, and integration credentials stored in the workspace are exposed on successful exploitation, turning a single origin-validation bug into a multi-service cascade compromise.

  • CISO decision: Escalate. Treat Langflow RCE as a priority-one campaign risk for any environment running Langflow in production. Enforce immediate patching, configuration hardening, and token rotation before allowing continued use.

Trend Micro Apex One Directory Traversal

CVE-2026-34926 (CVSS 6.7) is a path traversal vulnerability in on-premise Apex One servers that enables a pre-authenticated attacker who has obtained administrative credentials to modify a key internal deployment table and push malicious code to all managed endpoint agents fleet-wide. Trend Micro confirms at least one exploitation attempt in the wild. CISA's KEV listing requires federal civilian agencies to remediate by early June 2026.

  • The exploitation bar is higher than most vulnerabilities in today's brief because administrative credentials must already be in hand, but the downstream impact if that bar is cleared is catastrophic: the entire endpoint security fleet becomes a malware distribution mechanism.

  • CISO decision: Escalate. Treat on-premise Apex One servers as high-risk control points. Patch immediately, review admin credential hygiene, and audit recent deployment activity for signs of tampering.

Cisco Secure Workload REST API Flaw

CVE-2026-20223 carries a CVSS score of 10.0, the maximum possible. An access-validation failure on internal REST API endpoints in Cisco Secure Workload allows an unauthenticated remote attacker to send crafted requests and gain Site Admin privileges, with full ability to read sensitive cross-tenant data and modify security policy configurations. Cisco states it discovered this flaw during internal security testing and has no evidence of in-the-wild exploitation as of disclosure, but the absence of any workaround and the maximum severity score make this an emergency change for every environment where Secure Workload enforces segmentation or micro-perimeter policy.

  • Both SaaS and on-premise deployments are affected. Upgrading to fixed versions is the only durable mitigation.

  • CISO decision: Escalate. Treat Secure Workload patching as a scheduled emergency change for all environments where it gates east-west traffic or hosts multi-tenant workloads.

Microsoft Defender Zero-Days

Two Microsoft Defender vulnerabilities, CVE-2026-41091 and CVE-2026-45498, were confirmed exploited in zero-day attacks prior to patch release. CVE-2026-41091 abuses an improper link resolution in the Malware Protection Engine to escalate privileges to SYSTEM level. CVE-2026-45498 triggers a denial-of-service state against the Defender Antimalware Platform, used by adversaries to blind endpoint defenses before or during a broader attack chain. CISA added both to the KEV catalog on 21 May 2026 with a federal remediation deadline of 3 June 2026. No actor attribution has been made for either vulnerability in any consulted source within this window.

  • The strategic risk is significant: both vulnerabilities target security tooling itself. Exploitation grants either maximum privilege on compromised hosts or the ability to silence threat detection.

  • For most enterprise environments, Windows Defender auto-update delivers patches automatically, but this assumption fails in air-gapped, WSUS-managed, or policy-restricted environments and must be actively verified.

  • CISO decision: Escalate. Verify within 24 hours that all Windows endpoints have received Malware Protection Engine version 1.1.26040.8 or later and Antimalware Platform version 4.18.26040.7 or later. Do not rely on the assumption that auto-update ran.

PinTheft Linux Kernel LPE

PinTheft is a local privilege escalation vulnerability in the Linux kernel's RDS zerocopy subsystem that, combined with io_uring fixed buffers, allows an unprivileged local user to overwrite the page cache and promote a SUID binary to gain a root shell. A working proof-of-concept exploit is publicly available and has been independently verified on Arch Linux. The critical mitigating factor is that major distributions including Ubuntu and CloudLinux ship with the vulnerable RDS module disabled by default, significantly reducing immediate exposure unless administrators have explicitly enabled RDS for HPC or specialized networking use cases.

  • No formal CVE assignment has been published for PinTheft as of this reporting window.

  • CISO decision: Monitor. Require Linux platform owners to confirm default-safe configurations. Schedule kernel updates for any environment where RDS is intentionally enabled. Do not initiate emergency downtime for default-configuration systems.

Kimwolf DDoS Botnet Disruption

Authorities in Canada and the United States have arrested Jacob "Dort" Butler, the alleged operator of the Kimwolf IoT DDoS botnet that previously powered hyper-volumetric attacks peaking above 30 Tbps and targeting telecommunications, IT, gambling, gaming, and software sectors globally. The arrest is corroborated by U.S. Department of Justice charging documents and KrebsOnSecurity investigation. However, reporting from Cloudflare and SecurityWeek makes clear that the broader ecosystem of AISURU and Kimwolf-style botnets, fueled by insecure consumer IoT devices, is unlikely to abate structurally from a single operator arrest.

  • The arrest represents a meaningful enforcement action against one of the most prolific DDoS operators of the past 18 months, but infrastructure seizure does not equal full botnet neutralization.

  • CISO decision: Monitor. Maintain DDoS readiness and upstream mitigation contracts. Treat the Kimwolf arrest as a partial disruption of one operator, not a structural reduction in volumetric DDoS risk.

Calypso / Red Lamassu Telecommunications Espionage

A China-aligned threat actor tracked as Calypso, also referred to as Red Lamassu, has been conducting long-running espionage operations against telecommunications providers in Asia-Pacific and the Middle East using two newly disclosed malware families: Showboat for Linux and JFMBackdoor for Windows. The campaign has been active since at least mid-2022. Attribution rests on research from Lumen Black Lotus Labs and PwC Threat Intelligence, which reached this brief through a secondary reporting channel. Attribution is assessed as Under Attribution and Low confidence within this window.

  • The campaign's multi-year duration means any confirmed compromise should be treated as a long-dwell event requiring forensic scoping back to at least mid-2022.

  • CISO decision: Escalate for in-scope organizations. Telecommunications sector security teams in Asia-Pacific and the Middle East should initiate a threat hunt for Showboat and JFMBackdoor indicators within 48 hours.

Chapter 02 - Threat & Exposure Analysis

Langflow CVE-2025-34291

Attack vector: Network-based, requiring a victim user with an active Langflow session to visit an attacker-controlled website.

  • Langflow versions up to and including 1.6.9 expose a chained misconfiguration: overly permissive CORS with allow_origins set to wildcard and allow_credentials set to True, combined with a SameSite=None refresh token cookie setting.

  • This configuration allows a malicious site to perform credentialed cross-origin requests against the Langflow refresh endpoint, capturing fresh access and refresh tokens from an authenticated user's browser session without any further user interaction beyond the initial page visit.

  • Once tokens are obtained, the attacker invokes Langflow's authenticated code-execution endpoints to run arbitrary Python or workflow logic, achieving remote code execution on the Langflow host with full application-level permissions.

  • The secondary blast radius is the defining risk of this vulnerability: every API key, SaaS integration token, cloud provider credential, and LLM API key stored in the Langflow workspace is exposed on successful exploitation, turning a single origin-validation bug into a multi-service cascade compromise of every downstream service the Langflow instance is authorized to access.

  • Vulnerability root cause: CWE-346 (Origin Validation Error) combined with absence of CSRF protection on sensitive endpoints.

  • Patch status: Version 1.7 ships with hardened defaults that close the described CORS chain. CISA KEV deadline applies.

  • CVSS: 9.4 (NVD, corroborated)

  • Affected versions: 1.6.9 and below.

Trend Micro Apex One CVE-2026-34926

Attack vector: Local to the on-premise Apex One server, requiring pre-authentication with administrative credentials.

  • CVE-2026-34926 is a path traversal flaw (CWE-22/23) in how the Apex One on-premise server handles file paths when processing certain internal table operations.

  • A pre-authenticated attacker who has obtained administrative credentials through other means can manipulate file paths to modify a key internal deployment table used to define content pushed to endpoint agents.

  • Successful modification of this table enables injection of arbitrary malicious code into update packages that the Apex One server then distributes to all connected and managed endpoint agents, converting the centralized endpoint security management plane into a fleet-wide malware delivery mechanism.

  • The exploitation pre-condition (existing admin credentials) raises the effective attack bar compared to unauthenticated flaws, but Trend Micro's confirmation of at least one real-world exploitation attempt demonstrates that adversaries are actively pursuing this pre-condition and then chaining this vulnerability.

  • Patch status: Vendor patches available and referenced by multiple consulted sources. CISA KEV deadline applies.

  • CVSS: 6.7 (NVD and vendor advisory, corroborated)

  • Cloud-hosted Apex One deployments are not affected. Scope is on-premise only.

Cisco Secure Workload CVE-2026-20223

Attack vector: Remote, unauthenticated network access to internal Secure Workload REST API endpoints.

  • An access-validation failure on specific internal REST API endpoints means that crafted API requests are processed as if originating from a Site Admin user, despite carrying no valid authentication material.

  • Successful exploitation grants the attacker the full privilege set of a Site Admin: cross-tenant read access to sensitive configuration data, application policies, and workload telemetry, plus the ability to modify security policies that govern east-west traffic segmentation across the deployment.

  • Both SaaS and on-premise deployment modes are affected. Cisco confirms this was discovered through internal security testing with no known in-the-wild exploitation at time of disclosure, but the absence of any configuration-based workaround and the maximum CVSS score mean that the risk posture is binary: patch or remain fully exposed.

  • Fixed versions are 3.10.8.3 and 4.0.3.17 for affected branches, per Cisco's advisory.

  • CVSS: 10.0 (NVD and Cisco advisory, corroborated)

  • Vulnerability root cause: Insufficient access validation on authenticated-only API endpoints.

Microsoft Defender CVE-2026-41091 and CVE-2026-45498

CVE-2026-41091, Malware Protection Engine SYSTEM escalation:

  • Attack vector: Local (symlink/link-following abuse)

  • The Malware Protection Engine version 1.1.26030.3008 and earlier improperly resolves symbolic links before performing privileged file access operations.

  • An attacker with local access creates a symbolic link that redirects the engine's privileged file operation to an attacker-controlled target, achieving write or execution access in a SYSTEM-privileged context.

  • Post-exploitation: SYSTEM-level privilege achieved, enabling credential dumping, lateral movement staging, and direct manipulation of security tooling.

  • Root cause: CWE-59 (Improper Link Resolution Before File Access, Link Following)

  • Affected versions: Microsoft Malware Protection Engine 1.1.26030.3008 and earlier.

  • Patched version: 1.1.26040.8 and later.

  • CVSS: NOT CONFIRMED IN SOURCES within this window.

CVE-2026-45498, Defender Antimalware Platform DoS:

  • Attack vector: Not fully confirmed in consulted sources within this window.

  • A flaw in Microsoft Defender Antimalware Platform version 4.18.26030.3011 and earlier triggers a denial-of-service condition against the security platform itself, disrupting monitoring and scanning capabilities.

  • Observed adversary usage: Likely employed to blind endpoint defenses before or during a broader attack chain, creating a window during which security telemetry is absent.

  • Affects: Microsoft Defender Antimalware Platform, System Center Endpoint Protection 2012 and 2012 R2, Microsoft Security Essentials.

  • Patched version: 4.18.26040.7 and later.

  • CVSS: NOT CONFIRMED IN SOURCES within this window.

Both CVEs were confirmed as zero-days exploited prior to patch release. CISA KEV listed 21 May 2026. Federal deadline: 3 June 2026.

PinTheft Linux Kernel LPE

Attack vector: Local, requiring code execution ability on the target system and presence of the RDS and io_uring kernel facilities.

  • PinTheft targets rds_message_zcopy_from_user(), which pins user pages one at a time. On specific failure conditions, pinned pages are freed twice, creating a double-free that allows the attacker to steal page references and overwrite page-cache entries.

  • By targeting a SUID-root binary, the attacker replaces its in-memory contents with a minimal loader program that spawns a root shell, achieving reliable local privilege escalation to root.

  • Public proof-of-concept code combines the RDS zerocopy bug with io_uring fixed buffers. Independent testing confirms reliable exploitation on Arch Linux with default kernel settings where RDS is loaded.

  • Key mitigating factor: Ubuntu and CloudLinux ship with RDS autoloading disabled by default, preventing exploitation on default-configuration systems. Risk is highest on systems where an administrator has explicitly enabled RDS, such as HPC clusters or specialized networking deployments.

  • No formal CVE assigned as of this reporting window.

  • Patch status: Fixes merged into mainline kernels; distribution-specific packages in progress.

Kimwolf DDoS Botnet

Attack vector: Large-scale IoT device compromise used to originate hyper-volumetric HTTP and packet-based flood attacks against internet-facing services.

  • AISURU/Kimwolf campaigns produce short, extremely high-intensity bursts rather than sustained volumetric attacks. The record-peak attack documented by Cloudflare reached 31.4 Tbps over just 35 seconds, targeting multiple victims simultaneously.

  • Botnet composition draws from compromised consumer DVRs, IP cameras, routers, and Android TV boxes. Barracuda reporting links the broader botnet surge to insecure IoT supply chains and the availability of low-cost compromised hardware at scale.

  • 2025 global DDoS telemetry cited by consulted sources shows a doubling of DDoS incidents to over 47 million events, with AISURU/Kimwolf a significant contributor.

  • Targeting pattern: telecommunications providers, carriers, IT firms, gambling and gaming platforms, and software companies across China, Hong Kong, Germany, Brazil, the United States, the United Kingdom, Vietnam, Azerbaijan, India, and Singapore.

  • Law enforcement statements confirm seizure of infrastructure associated with the Kimwolf operation, but do not claim full neutralization of the botnet ecosystem. The underlying IoT vulnerability surface that enabled it remains unaddressed at a structural level.

Calypso / Red Lamassu Telecommunications Espionage

Showboat (Linux implant):

  • Modular post-exploitation framework deployed after initial access (initial infection vector unknown and not confirmed in consulted sources).

  • Masquerades as kernel kworker threads in process listings to evade process-level detection. Genuine kernel kworker threads have PPID 2 (kthreadd); any kworker process with a different PPID is a high-confidence indicator of Showboat.

  • Capabilities: host reconnaissance data sent to C2 on deployment, file upload and download, process concealment, service-based persistence registration, SOCKS5 proxy, and port forwarding for lateral movement into internal network segments.

  • Dead-drop evasion technique: the "hide" command retrieves concealment code at runtime from Pastebin and similar online forums, meaning no static concealment payload is stored on disk and traditional signature-based detection of this component fails.

  • C2 communication: host reconnaissance data transmitted to remote C2 at deployment.

JFMBackdoor (Windows implant):

  • Delivery chain: batch script drops fltMC.exe and FLTLIB.dll, abusing the legitimate Windows Filter Manager utility via DLL sideloading to load the final JFMBackdoor payload without direct execution of a suspicious binary.

  • Capabilities: reverse shell, file management (upload, download, move, delete), TCP proxying, process and service creation and termination, Windows registry read and write, desktop screenshot capture with AES encryption before exfiltration, encrypted configuration management, self-removal and active anti-forensics.

  • Infrastructure: multiple telecom-themed domains registered to impersonate target organizations. Shared certificate-generation patterns observed across multiple China-aligned clusters, suggesting a shared malware supply chain rather than a single unified group operating exclusively.

  • Campaign duration: active since at least mid-2022, confirming long-dwell capability as a design goal.

Cross-Incident Pattern Analysis

Three of today's five primary incidents (CVE-2026-41091, CVE-2026-34926, and the JFMBackdoor campaign) specifically target or abuse security software, endpoint management tooling, or the processes of security platforms themselves. This reflects a consistent and increasing adversary pattern: security software is no longer assumed to be safe infrastructure. It is attack surface. Organizations whose patch and verification workflows treat security tooling as lower priority than production systems should treat this brief as a direct challenge to that posture.

Chapter 03 - Operational Response

Defender priority order for today: (1) Microsoft Defender zero-days (broadest Windows estate exposure, SYSTEM-level risk, CISA deadline 3 June), (2) Langflow RCE (CVSS 9.4, active exploitation, cascading credential exposure, CISA deadline early June), (3) Cisco Secure Workload (CVSS 10.0, no workaround, emergency change required), (4) Trend Micro Apex One (requires prior admin credential compromise, patch and credential hygiene today), (5) PinTheft (monitor and verify configuration, no emergency action for default deployments), (6) Kimwolf (maintain DDoS readiness, no new emergency action following arrest).

Microsoft Defender CVE-2026-41091 and CVE-2026-45498

Do this now (0 to 24 hours):

  • Query your endpoint management platform (Intune, SCCM, or equivalent) for all devices running Microsoft Malware Protection Engine earlier than version 1.1.26040.8 or Antimalware Platform earlier than version 4.18.26040.7. Generate an exposure list within the hour.

  • For devices where Windows Defender auto-update is confirmed active, force a definition update push through your endpoint management tooling. Do not wait for the next scheduled pull cycle.

  • Manually verify on a representative sample of endpoints: open Windows Security, navigate to Virus and Threat Protection, select Protection Updates, check for updates, then go to Settings and About to confirm the Antimalware Client Version and engine version meet or exceed the patched thresholds.

  • Identify all air-gapped, WSUS-managed, or policy-restricted endpoints that cannot receive auto-updates and flag them immediately for priority manual patch deployment.

Do this within 24 hours:

  • Validate that WSUS and update infrastructure is configured to push Malware Protection Engine and Antimalware Platform updates independently from OS-level patches, as these travel on separate update channels.

  • Review Group Policy across all organizational units for Windows Update configuration. Confirm that definition and engine updates are not suppressed by policy.

  • Where Defender is the primary EDR in air-gapped environments, establish an offline update process using Microsoft's offline definition packages or the Microsoft Security Intelligence update binaries.

  • Notify endpoint engineering and vulnerability management teams. Escalation trigger: any device confirmed running the vulnerable engine version with external exposure (internet-facing, RDP-accessible) should be isolated and manually patched before being returned to network access.

  • If exploitation is suspected based on anomalous SYSTEM process creation or unexpected Defender service interruptions, initiate IR process and preserve event logs before applying the patch.

Langflow CVE-2025-34291

Do this now (0 to 24 hours):

  • Identify all self-hosted or managed Langflow instances at or below version 1.6.9, including shadow IT and team-deployed instances in development and staging environments. Restrict access to trusted administrative networks only while remediation is in progress.

  • Disable authenticated cross-site requests immediately by setting LANGFLOW_CORS_ALLOW_CREDENTIALS to False and tightening LANGFLOW_CORS_ORIGINS to a minimal whitelist of trusted domains.

  • Invalidate and rotate all API keys, access tokens, and refresh tokens stored in Langflow workspaces. Prioritize keys that grant access to production cloud services, LLM provider APIs, and SaaS platforms. Do not wait for exploitation confirmation before rotating. Assume exposure.

Do this within 24 hours:

  • Upgrade all Langflow deployments to version 1.7 or later, which ships with hardened defaults that close the described CORS and CSRF chain.

  • Review web proxy, WAF, and SIEM telemetry for unusual calls to Langflow refresh or code-execution endpoints from non-corporate origins and unexpected user agents.

  • Notify DevOps, MLOps, and AI platform teams. Notify data protection and legal teams: the cascading credential exposure characteristic of this vulnerability may constitute a personal data breach under applicable frameworks (GDPR Article 33, India DPDP Act, HIPAA) if connected downstream services process regulated personal data. Trigger breach notification assessment now.

  • Audit all services connected to Langflow workflows for access events from new or unfamiliar IP addresses or user agents over the past 30 days, covering the period since confirmed exploitation began in January 2026.

Trend Micro Apex One CVE-2026-34926

Do this now (0 to 24 hours):

  • Inventory all on-premise Apex One servers. Confirm current patch levels against Trend Micro's advisory for CVE-2026-34926.

  • Immediately restrict administrative access to Apex One servers to jump-hosts and enforce MFA on all admin accounts.

  • Monitor Apex One server logs for anomalous configuration changes, unexpected modification of deployment tables, or rapid policy pushes to agents outside approved maintenance windows.

Do this within 24 hours:

  • Apply Trend Micro's patches for CVE-2026-34926 on all affected on-premise servers.

  • Review recent Apex One update packages and script distributions for signs of tampering, comparing against known-good baselines where available.

  • Audit all connected agents for unexpected software deployments or configuration changes over the past 30 days.

  • Review admin credential hygiene: if any Apex One server admin credentials have been involved in a phishing event or credential-stuffing incident in recent months, treat the server as potentially compromised and escalate to full IR triage.

Cisco Secure Workload CVE-2026-20223

Do this now (0 to 24 hours):

  • Identify all Cisco Secure Workload instances, both SaaS and on-premise, and confirm whether they are running affected versions (3.9.x, older 3.10 builds, older 4.0 builds prior to fixed releases).

  • Restrict network access to Secure Workload management and REST API endpoints to trusted administrative IP ranges immediately, reducing the unauthenticated attack surface described in Cisco's advisory while patching is scheduled.

Do this within 24 hours:

  • Schedule and implement an emergency change window to upgrade Cisco Secure Workload to at least version 3.10.8.3 or 4.0.3.17, per Cisco's advisory. No configuration-only workaround exists.

  • Enable and review API audit logging for Secure Workload to detect unusual configuration operations originating from unauthenticated or unexpected IP ranges.

  • Notify security architecture and network segmentation teams. If Secure Workload gates zero-trust east-west policy for production workloads, treat this as a critical control failure requiring immediate escalation to security leadership.

PinTheft Linux Kernel LPE

Do this now (0 to 24 hours):

  • On all Linux systems, verify whether the RDS kernel module is loaded or autoloadable. Use the checks provided by Ubuntu and other vendor advisories. If present without a documented business requirement, unload and blacklist the module immediately.

  • Identify systems where RDS is intentionally enabled and multi-user shell access is permitted (HPC clusters, shared development nodes). Treat these as high-risk and enforce strict restrictions on untrusted user access until patched kernels are deployed.

Do this within 24 hours:

  • Plan and begin kernel updates for affected distributions, prioritizing Arch Linux deployments where PinTheft has been independently verified with public proof-of-concept code.

  • For environments that intentionally rely on RDS, coordinate with OS vendors to deploy patched kernels. Remove temporary RDS blacklisting only after patched kernels are confirmed in place.

Kimwolf DDoS Botnet

Do this now (0 to 24 hours):

  • Confirm that all critical internet-facing services are protected by DDoS-capable frontends (CDN, scrubbing service, or equivalent), noting that AISURU/Kimwolf campaigns are characterized by extremely short, ultra-high-volume bursts that overwhelm unprepared edge infrastructure within seconds.

  • Validate current escalation and contact procedures with upstream DDoS mitigation providers. Law enforcement statements on Butler's arrest do not claim full elimination of the Kimwolf botnet ecosystem.

Do this within 24 hours:

  • Review firewall and rate-limiting policies protecting APIs and web frontends in sectors explicitly targeted by Kimwolf: telecom, IT, gambling, gaming, and software.

  • Ensure logging retention on edge infrastructure is sufficient to support potential future law enforcement cooperation in DDoS investigation cases.

Calypso / Red Lamassu Telecommunications Espionage

Do this now (0 to 24 hours, telco sector in Asia-Pacific and Middle East):

  • Hunt for fltMC.exe and FLTLIB.dll execution sequences on Windows endpoints: specifically a batch script or cmd.exe parent launching fltMC.exe followed by a FLTLIB.dll load from a non-standard path. This is the confirmed JFMBackdoor DLL sideloading delivery chain.

  • Hunt for kworker-masquerading processes on Linux systems. Any process named kworker with a parent PID other than 2 (kthreadd) or with an associated open network socket is a high-confidence Showboat indicator.

  • Check for outbound SOCKS5 proxy connections and unusual port-forwarding activity from Linux hosts, particularly on telecom OSS/BSS infrastructure.

Do this within 48 hours:

  • Inspect DNS logs and certificate transparency data for domain registrations that closely impersonate your organization's name or your key partners. Telecom-themed impersonation domains are a confirmed Calypso infrastructure tactic.

  • Audit outbound connections from Linux production servers to Pastebin and similar code-sharing platforms. Showboat retrieves its concealment code from these as a dead-drop mechanism at runtime.

  • If any indicators are confirmed, assume a dwell time extending back to at least mid-2022. Initiate full IR process with forensic scoping across that entire period. Do not limit investigation scope to recent months.

Langflow CVE-2025-34291

  • 5 December 2025: NVD publishes CVE-2025-34291, describing the chained CORS and cookie misconfiguration enabling account takeover and remote code execution in Langflow 1.6.9 and earlier.

  • 23 January 2026: CrowdSec Intelligence Network begins observing active exploitation of CVE-2025-34291 in the wild.

  • Late 2025 (date unconfirmed in sources): Vendor research and coverage document how successful exploitation leaks API keys and tokens, enabling cascading compromise of integrated services.

  • 21 to 22 May 2026: CISA adds CVE-2025-34291 to the KEV catalog. Multiple consulted sources report the mandatory federal patch deadline for FCEB agencies.

Trend Micro Apex One CVE-2026-34926

  • 20 to 21 May 2026: Trend Micro and third-party researchers publish advisories detailing CVE-2026-34926 as a directory traversal flaw in Apex One on-premise, noting at least one confirmed exploitation attempt.

  • 21 to 22 May 2026: CISA adds CVE-2026-34926 to the KEV catalog. Multiple consulted sources stress the risk of malicious code deployment to all agents managed by a compromised server.

Cisco Secure Workload CVE-2026-20223

  • 19 to 20 May 2026: Cisco discloses CVE-2026-20223, a CVSS 10.0 vulnerability in Secure Workload REST APIs allowing unauthenticated attackers to gain Site Admin privileges. NVD publishes matching technical details.

  • 21 to 22 May 2026: Multiple consulted sources publish coverage emphasizing the absence of workarounds and the requirement to upgrade to fixed versions. Cisco states no evidence of in-the-wild exploitation at time of disclosure.

Microsoft Defender CVE-2026-41091 and CVE-2026-45498

  • 20 May 2026: Microsoft begins rolling out mitigations for a separate Windows security event cluster (BitLocker zero-day, YellowKey), signaling an active Windows vulnerability exploitation period.

  • 21 May 2026: Microsoft confirms patches for CVE-2026-41091 and CVE-2026-45498, with both confirmed as zero-day exploits in active use before patch release.

  • 21 May 2026: CISA adds CVE-2026-41091 and CVE-2026-45498 to the KEV catalog with a federal remediation deadline of 3 June 2026.

  • 22 May 2026 (status as of report date): Patches available via Windows Update and Windows Defender auto-update channels. Manual verification required for restricted and air-gapped environments.

PinTheft Linux Kernel LPE

  • 19 May 2026: Security researchers disclose PinTheft as a Linux local privilege escalation targeting the RDS zerocopy subsystem, with a working proof-of-concept exploit publicly released.

  • 20 May 2026: Ubuntu publishes a detailed mitigation note confirming that default Ubuntu configurations disable automatic RDS module loading and providing temporary blacklisting commands for administrators to verify and enforce safe configurations.

  • 19 to 21 May 2026: CloudLinux and additional distribution vendors confirm they are testing the proof-of-concept and generally report that RDS is not enabled by default, reducing immediate risk for their platforms.

  • 22 May 2026 (status as of report date): No formal CVE assigned. Mainline kernel fixes merged. Distribution-specific patched kernels in progress.

Kimwolf DDoS Botnet

  • November 2025 (date unconfirmed in sources): Cloudflare observes a record 31.4 Tbps DDoS attack attributed to AISURU/Kimwolf, lasting 35 seconds.

  • December 2025 to January 2026 (dates unconfirmed in sources): Barracuda and others report increasing DDoS activity driven by Kimwolf and related botnets exploiting compromised consumer IoT devices globally.

  • 4 February 2026: Cloudflare and The Hacker News publish detailed analysis of Kimwolf's role in the broader hyper-volumetric DDoS surge.

  • 20 to 21 May 2026: A criminal complaint against Jacob "Dort" Butler is unsealed in the United States District of Alaska. Canadian authorities arrest Butler in Ottawa and charge him with operating the Kimwolf botnet. KrebsOnSecurity and SecurityWeek publish corroborating investigative coverage.

Calypso / Red Lamassu Telecommunications Espionage

  • Mid-2022 (first confirmed campaign activity per Lumen Black Lotus Labs): Calypso/Red Lamassu begins targeting telecommunications providers in Asia-Pacific and the Middle East with Showboat and JFMBackdoor tooling.

  • Dates unconfirmed in sources: Individual deployment events of Showboat and JFMBackdoor across victim telecommunications infrastructure occur over the multi-year campaign window.

  • 21 May 2026: Lumen Black Lotus Labs and PwC Threat Intelligence publish joint research on Showboat and JFMBackdoor. Coverage via secondary reporting channel surfaces within this brief's window.

  • 22 May 2026 (status as of report date): Campaign assessed as ongoing. No patch applicable. Threat hunt recommended for all in-scope telecommunications operators.

Chapter 04 - Detection Intelligence

Langflow CVE-2025-34291

  • Attack vector: Network-based, unauthenticated from the attacker's perspective. Requires a logged-in victim user to visit an attacker-controlled page.

  • Exploitation mechanism: Permissive CORS configuration (allow_origins wildcard with credentials allowed) and a SameSite=None refresh token cookie combine to allow an attacker's web page to send credentialed cross-origin requests to the Langflow refresh endpoint, obtaining valid access and refresh tokens from the victim's active session.

  • Post-token-capture behavior: Attacker invokes Langflow's authenticated Python code-execution endpoints using the harvested tokens, achieving arbitrary code execution on the Langflow host with full application-level permissions.

  • Secondary impact: All API keys, LLM provider tokens, SaaS integration credentials, and cloud provider access keys stored in the compromised Langflow workspace are exposed. Every downstream service the workspace is authorized to access is effectively compromised without any further attacker effort.

  • Root cause: CWE-346 (Origin Validation Error). Absence of CSRF protection on token-sensitive endpoints is a contributing weakness.

  • Affected versions: 1.6.9 and earlier.

  • Patched version: 1.7 (hardened default CORS and SameSite configuration).

  • CVSS: 9.4 (NVD, corroborated by multiple consulted sources).

  • KEV listed: Yes. Federal deadline early June 2026.

Trend Micro Apex One CVE-2026-34926

  • Attack vector: Local to the Apex One server. Requires pre-existing administrative credentials.

  • Exploitation mechanism: Path traversal (CWE-22/CWE-23) in the Apex One on-premise server's handling of internal file paths allows a pre-authenticated attacker to escape the intended directory boundary and write to or modify a key internal deployment table that controls what content is sent to endpoint agents.

  • Post-exploitation behavior: The modified table causes the Apex One server to distribute attacker-supplied malicious code to all connected and managed endpoint agents during the next update cycle, creating a fleet-wide compromise from a single server-side write operation.

  • Pre-condition: Administrative credentials to the on-premise Apex One server must already be held by the attacker, obtained through a separate prior compromise vector.

  • Scope: On-premise deployments only. Cloud-hosted Apex One is not affected.

  • CVSS: 6.7 (NVD and Trend Micro advisory, corroborated).

  • KEV listed: Yes. Federal deadline early June 2026.

Cisco Secure Workload CVE-2026-20223

  • Attack vector: Remote, unauthenticated. No prior access or credential required.

  • Exploitation mechanism: Specific internal REST API endpoints in Cisco Secure Workload fail to adequately validate whether a request is authenticated. A crafted API request sent to one of these endpoints is processed with Site Admin-level permissions, bypassing all authentication and authorization controls.

  • Post-exploitation behavior: Attacker gains full Site Admin access, enabling cross-tenant read access to sensitive workload data, application policy data, and telemetry, and the ability to modify segmentation policies that govern east-west traffic across all tenants in the deployment.

  • Cisco's discovery context: Found during internal security testing. No confirmed in-the-wild exploitation at time of disclosure.

  • No workaround exists. Upgrading is the only mitigation.

  • Fixed versions: 3.10.8.3 and 4.0.3.17 for affected branches.

  • CVSS: 10.0 (NVD and Cisco advisory, corroborated).

Microsoft Defender CVE-2026-41091

  • Attack vector: Local (link-following abuse, symlink).

  • Exploitation mechanism: Microsoft Malware Protection Engine version 1.1.26030.3008 and earlier resolves symbolic links improperly before accessing files in a privileged context. An attacker with local access creates a symlink redirecting the engine's privileged file access operation to an attacker-controlled target, achieving write or execution access in a SYSTEM-privileged context.

  • Post-exploitation behavior: SYSTEM-level privilege achieved, enabling credential dumping via LSASS access, lateral movement staging, and direct manipulation of other security tooling on the host.

  • Root cause: CWE-59 (Improper Link Resolution Before File Access).

  • Affected versions: Malware Protection Engine 1.1.26030.3008 and earlier.

  • Patched version: 1.1.26040.8 and later.

  • CVSS: NOT CONFIRMED IN SOURCES within this window.

  • KEV listed: Yes. Federal deadline 3 June 2026. Zero-day confirmed.

Microsoft Defender CVE-2026-45498

  • Attack vector: Not fully confirmed in consulted sources within this window.

  • Exploitation mechanism: Flaw in Microsoft Defender Antimalware Platform version 4.18.26030.3011 and earlier that triggers a denial-of-service condition, disrupting the platform's monitoring and scanning capabilities.

  • Observed adversary usage: Used to disable or degrade endpoint detection and response telemetry before or during a broader attack chain, creating a blind window during which secondary payloads are deployed without security tool visibility.

  • Affects: Microsoft Defender Antimalware Platform, System Center Endpoint Protection 2012 and 2012 R2, Microsoft Security Essentials.

  • Patched version: 4.18.26040.7 and later.

  • CVSS: NOT CONFIRMED IN SOURCES within this window.

  • KEV listed: Yes. Federal deadline 3 June 2026. Zero-day confirmed.

PinTheft Linux Kernel LPE

  • Attack vector: Local. Requires code execution capability on the target system and presence of RDS and io_uring kernel facilities.

  • Exploitation mechanism: The kernel function rds_message_zcopy_from_user() pins user pages one at a time and fails to handle certain error conditions cleanly, resulting in a double-free of pinned pages under specific fault conditions. The attacker exploits this to gradually steal page references and gain the ability to overwrite page-cache contents.

  • Exploit chain: Using io_uring fixed buffers to control memory layout, the attacker overwrites the cached contents of a SUID-root binary with a minimal loader program. When the SUID binary is subsequently executed, the loader runs with root privileges and spawns a root shell.

  • Reliability: Public proof-of-concept confirmed reliable on Arch Linux with default kernel settings where RDS is loaded.

  • Key mitigating factor: Ubuntu and CloudLinux disable automatic RDS module loading by default, preventing automatic exploitation on default-configuration systems.

  • No formal CVE assigned as of this reporting window.

  • Patch status: Mainline kernel fix merged. Distribution packages in progress.

Kimwolf DDoS Botnet

  • Attack vector: Compromised consumer IoT devices (DVRs, IP cameras, routers, Android TV boxes) originating hyper-volumetric HTTP and packet-based flood traffic.

  • Campaign behavior: Short, extremely high-intensity bursts characterized by attack durations as brief as 35 seconds but with peak volumes documented at 31.4 Tbps and billions of packets per second. This burst-mode pattern is specifically designed to overwhelm DDoS mitigation systems that rely on traffic baselines and ramp-up detection thresholds.

  • Target selection: Telecommunications providers, IT firms, gambling and gaming platforms, and software companies across ten-plus countries, per Cloudflare and Barracuda analysis.

  • Operator: Jacob "Dort" Butler, Canadian national, arrested 20 to 21 May 2026 in Ottawa following unsealing of a criminal complaint in the United States District of Alaska.

  • Infrastructure status: Law enforcement seized associated infrastructure. Full botnet neutralization is not claimed. Underlying IoT supply chain vulnerabilities enabling botnet replenishment remain unaddressed.

Calypso / Red Lamassu Telecommunications Espionage

Showboat technical profile (Linux):

  • Masquerades as kernel kworker threads (PPID 2 expected; any kworker with PPID other than 2 or with an open socket is a detection signal).

  • Modules: host recon (runs on deployment, reports to C2), file transfer (upload/download), process concealment, persistence via new service registration, SOCKS5 proxy and port-forwarding for lateral movement.

  • Dead-drop evasion: concealment code retrieved at runtime from Pastebin and online forums, never stored statically on disk.

  • Initial infection vector: UNKNOWN. Not confirmed in any consulted source.

JFMBackdoor technical profile (Windows):

  • Delivery: batch script drops fltMC.exe and FLTLIB.dll. fltMC.exe is a legitimate Windows Filter Manager command-line utility. FLTLIB.dll is the sideloaded malicious DLL that loads the JFMBackdoor payload.

  • Capabilities: reverse shell, file management, TCP proxy, process and service manipulation, registry read/write, screenshot capture with AES encryption, encrypted config management, self-removal and anti-forensics.

Infrastructure observations:

  • Telecom-themed impersonation domains registered to mimic target organizations.

  • Shared certificate-generation patterns across multiple China-aligned clusters, indicating a shared tooling supply chain across several groups rather than a single unified actor.

  • No specific domain names, IP addresses, or certificate fingerprints published in consulted sources.

Indicators of Compromise

IOC Type

IOC Value

Context

Confidence

CVE ID

CVE-2025-34291

Langflow origin validation error RCE, CVSS 9.4, KEV listed

Confirmed

CVE ID

CVE-2026-34926

Trend Micro Apex One on-premise directory traversal, CVSS 6.7, KEV listed

Confirmed

CVE ID

CVE-2026-20223

Cisco Secure Workload REST API auth bypass, CVSS 10.0

Confirmed

CVE ID

CVE-2026-41091

Microsoft Defender MMPE SYSTEM privilege escalation, KEV listed, zero-day

Confirmed

CVE ID

CVE-2026-45498

Microsoft Defender Antimalware Platform DoS, KEV listed, zero-day

Confirmed

Malware Family

Showboat (kworker)

Linux post-exploitation implant, Calypso/Red Lamassu, telco targeting

Pending

Malware Family

JFMBackdoor

Windows espionage implant, Calypso/Red Lamassu, DLL sideloading delivery

Pending

Filename

fltMC.exe

Legitimate Windows binary abused in JFMBackdoor sideloading chain

Pending

Filename

FLTLIB.dll

Sideloaded malicious DLL delivering JFMBackdoor payload

Pending

No public IP addresses, domains, URLs, or file hashes were published in any consulted source for today's incidents. IOC-driven defense must focus on CVE-based attack surface management, version inventory validation, and behavioral malware hunting rather than network-indicator matching until enriched indicators are published.

Infrastructure Patterns

  • Langflow: Exploitation relies on attacker-controlled web origins interacting with Langflow's refresh and execution API endpoints. Defenders should baseline expected origins and user-agent patterns for Langflow and treat unexpected external origins as an immediate detection signal. No specific attacker domains or IPs are published in consulted sources.

  • Apex One: The on-premise server is the critical infrastructure node. No attacker-controlled external infrastructure is described in consulted sources. Focus detection on the server's own deployment and logging activity.

  • Cisco Secure Workload: Attack surface is the REST API management plane. Focus on access controls and API audit logging rather than network indicators. No external attacker infrastructure is named in consulted sources.

  • PinTheft: Local exploit only. Network-level indicators are not applicable. Infrastructure is the vulnerable kernel and RDS module configuration.

  • Kimwolf: Botnet infrastructure composed of globally distributed compromised IoT devices. Specific C2 domains or IPs are not disclosed in open consulted sources. Monitoring for volumetric burst traffic patterns consistent with Cloudflare's documented AISURU/Kimwolf signature remains the primary network-level detection approach.

  • Calypso/Red Lamassu: Telecom-themed impersonation domains and shared certificate generation patterns across China-aligned clusters. Specific domain names or certificate fingerprints are not published in consulted sources within this window. Monitor certificate transparency logs and DNS for impersonation domain registrations targeting your organization's name.

Langflow CVE-2025-34291

Immediate detection actions:

  1. Configure WAF or reverse proxy rules to alert on or block cross origin POST requests to Langflow refresh and execution endpoints from origins not in an explicit whitelist.

  2. Review web server and application logs for requests carrying an Origin header from non corporate or non approved domains against any Langflow API path.

  3. Alert on any new outbound network connection from the Langflow server process to a cloud provider, SaaS API endpoint, or LLM provider API that was not previously observed in a baseline of normal Langflow traffic.

SIGMA pseudocode for Langflow cross origin exploitation detection:

title: Langflow Cross Origin Code Execution Attempt CVE 2025 34291
status: experimental
description: Detects cross origin requests to Langflow API execution or refresh endpoints from unauthorized origins
logsource:
  category: webserver
  product: langflow
detection:
  selection:
    cs-method: POST
    cs-uri-stem|startswith:
      - '/api/v1/run/'
      - '/api/v1/build/'
      - '/api/v1/login'
      - '/api/v1/refresh'
    http_origin|not_contains:
      - 'yourtrustedomain.com'
  filter_internal:
    src_ip|cidr: '10.0.0.0/8'
  condition: selection and not filter_internal
falsepositives:
  - Legitimate external integration partners not yet added to origin whitelist
level: high
tags:
  - cve.2025.34291

SIEM field logic:

event.category = "web"
AND http.request.method = "POST"
AND url.path MATCHES "/api/v1/run/*" OR "/api/v1/refresh"
AND http.request.headers.origin NOT IN [approved_origin_whitelist]
AND NOT source.ip IN [internal_cidr_ranges]
ALERT: Langflow unauthorized cross origin request to execution endpoint

Hunting hypothesis: An attacker exploited CVE 2025 34291 and exfiltrated API tokens. Evidence target: review auth logs for all services integrated with Langflow for access events from new or unfamiliar IP addresses or user agents over the past 90 days, covering the full exploitation window since January 2026.

Trend Micro Apex One CVE 2026 34926

Immediate detection actions:

  1. Enable and review Apex One server audit logs for unexpected writes to or modifications of the internal deployment table.

  2. Alert on any policy push or agent update operation originating outside approved maintenance windows or from an administrator account not previously seen performing that action.

  3. Monitor for new or modified update packages distributed to agents that do not match known good checksums.

SIEM field logic:

event.dataset = "apex_one.server_audit"
AND event.action IN ["table_modification", "policy_push", "agent_update"]
AND NOT event.outcome = "scheduled_maintenance"
AND event.user NOT IN [approved_admin_accounts]
ALERT: Apex One server anomalous deployment table modification or policy push outside maintenance window

Hunting hypothesis: An attacker obtained Apex One admin credentials and modified deployment content. Evidence target: review all agent update events in the past 30 days for packages with unexpected hashes or names, and correlate with any admin account access from unfamiliar IP addresses.

Cisco Secure Workload CVE 2026 20223

Immediate detection actions:

  1. Enable API audit logging on all Secure Workload deployments if not already active.

  2. Alert on any API request to administrative or configuration endpoints arriving from IP addresses not in the approved management network range.

  3. Alert on any unauthenticated or anonymous API request that returns a 200 or 201 response code from a Secure Workload endpoint.

SIEM field logic:

event.dataset = "cisco_secure_workload.api_audit"
AND http.response.status_code IN [200, 201, 204]
AND (http.request.headers.authorization = null OR http.request.headers.authorization = "")
AND url.path MATCHES "/api/*"
ALERT: Cisco Secure Workload unauthenticated API request returning success response

Hunting hypothesis: An attacker has already probed or exploited CVE 2026 20223 and modified segmentation policies. Evidence target: review API audit logs for tenant configuration changes and policy modifications in the past 14 days, correlating against approved change management records.

Microsoft Defender CVE 2026 41091 SYSTEM Privilege Escalation via Symlink

MITRE note: T1068 is inferred from observed behavior. This is a behavioral inference and is not source confirmed via an explicit MITRE mapping in consulted sources.

Immediate detection actions:

  1. Alert on MsMpEng.exe spawning child processes with SYSTEM integrity where the parent chain does not trace back to a known legitimate Windows update or service context.

  2. Monitor for symbolic link creation events in user writable directories in temporal proximity to MsMpEng.exe file access on the same paths.

SIEM pseudocode:

event.provider = "Microsoft Windows Security Auditing"
AND event.id = 4688
AND process.name = "MsMpEng.exe"
AND process.integrity_level = "System"
AND process.parent.name NOT IN ["services.exe", "wininit.exe", "MpCmdRun.exe"]
ALERT: Defender engine anomalous SYSTEM level child process spawn

SIGMA pseudocode:

title: Suspicious MsMpEng Child Process with SYSTEM Integrity CVE 2026 41091
status: experimental
description: Detects MsMpEng spawning child processes at SYSTEM level outside expected Windows Update contexts
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: '\MsMpEng.exe'
    IntegrityLevel: 'System'
  filter_legitimate:
    ParentCommandLine|contains:
      - 'MpCmdRun'
      - 'WdBoot'
  condition: selection and not filter_legitimate
falsepositives:
  - Legitimate Windows Defender update operations in non standard configurations
level: high
tags:
  - cve.2026.41091

Hunting hypothesis: An attacker exploited CVE 2026 41091 and used SYSTEM privileges to establish persistence. Evidence target: search for scheduled tasks or services created in the past 14 days where the creating process token is SYSTEM but the creation does not trace to an approved management session.

Microsoft Defender CVE 2026 45498 Defender Antimalware Platform DoS

MITRE note: T1562.001 is inferred from observed behavior. Behavioral inference only, not source confirmed.

SIEM pseudocode:

event.provider = "Service Control Manager"
AND event.id IN [7034, 7036]
AND service.name IN ["WinDefend", "WdNisSvc", "MpsSvc"]
AND NOT correlated_event: WindowsUpdate event within 30 minutes of same host
ALERT: Defender service unexpected crash or state change outside patch window

Hunting hypothesis: An attacker combined CVE 2026 45498 with a secondary payload deployment during the resulting blind window. Evidence target: correlate Defender service interruption events with new process creations, new scheduled tasks, or new outbound network connections within 5 minutes of the interruption.

PinTheft Linux Kernel LPE

Immediate detection actions:

  1. Monitor for unexpected changes to SUID binaries and anomalous use of RDS and io uring on high risk Linux hosts.

  2. Alert when processes execute from writable file systems with SUID privileges.

  3. Correlate with kernel logs indicating RDS activity.

SIEM pseudocode:

host.os = "linux"
AND process.name IN ["python", "bash", "sh", "perl", "ruby"]
AND file.path MATCHES "/tmp/*" OR "/dev/shm/*"
AND file.permissions CONTAINS "suid"
ALERT: Possible PinTheft post exploitation SUID abuse

Hunting hypothesis: Search for processes executing from writable file systems with SUID privileges and correlate with kernel logs indicating RDS activity to surface potential successful PinTheft exploitation attempts.

Kimwolf DDoS Botnet

Immediate detection actions:

  1. Coordinate with upstream DDoS providers to ensure alerting thresholds and mitigation templates match the short burst, high volume pattern observed in AISURU and Kimwolf attacks.

  2. Review firewall and rate limiting policies for telecom, IT, gambling, gaming, and software service front ends.

SIEM pseudocode:

event.category = "network"
AND network.protocol IN ["http", "https", "tcp"]
AND destination.port IN [80, 443]
AND bytes_in > baseline_95th_percentile * 10
AND duration < 60
ALERT: Short burst high volume DDoS pattern consistent with Kimwolf

Hunting hypothesis: Review past DDoS events for traffic patterns matching Kimwolf documented campaigns, especially very high HTTP request rates over brief windows, to refine playbooks and update allowlists that could hinder mitigation.

NO CONFIRMED MITRE MAPPING IN SOURCES.

Neither vendor advisories nor public reporting for today's incidents include explicit MITRE ATT&CK technique IDs. Any ATT&CK references below are behavioral inferences only and are not source confirmed.

Possible inferred behaviors, disclosed as inference only:

  • Langflow CVE 2025 34291:

    • T1190 Exploit Public Facing Application

    • T1566 Phishing, if the attack begins with lure based web access

    • T1552 Unsecured Credentials, from token theft

  • Trend Micro Apex One CVE 2026 34926:

    • T1068 Exploitation for Privilege Escalation, if admin credentials are already obtained

    • T1574 Hijack Execution Flow, for malicious code distribution through the management plane

  • Cisco Secure Workload CVE 2026 20223:

    • T1190 Exploit Public Facing Application

    • T1068 if the result is admin level control of the control plane

  • Microsoft Defender CVE 2026 41091:

    • T1068 Exploitation for Privilege Escalation

    • T1562 Impair Defenses, if the exploit is used to suppress protection

  • Microsoft Defender CVE 2026 45498:

    • T1562 Impair Defenses

  • PinTheft:

    • T1068 Exploitation for Privilege Escalation

  • Kimwolf:

    • T1498 Network Denial of Service

  • Showboat and JFMBackdoor:

    • T1036 Masquerading

    • T1574.002 DLL Side Loading

    • T1090 Proxy

    • T1027 Obfuscated Files or Information

Chapter 05 - Governance, Risk & Compliance

Regulatory exposure and mandatory patch deadlines

CISA's addition of Langflow CVE 2025 34291, Trend Micro Apex One CVE 2026 34926, and Microsoft Defender CVE 2026 41091 and CVE 2026 45498 to the KEV catalog triggers Binding Operational Directive 22 01 obligations for U.S. Federal Civilian Executive Branch agencies, requiring remediation by early June 2026. Organizations outside the federal space are not directly bound by BOD 22 01, but CISA's classification of these vulnerabilities as Known Exploited signals heightened regulatory and customer expectations around timely patching and risk disclosure.

Business risk impact

The Langflow RCE and Apex One traversal flaws both sit on platforms that orchestrate access to wider estates, AI workflows with cloud and SaaS credentials in the former, and endpoint agents in the latter, creating disproportionate blast radius if exploited. Cisco Secure Workload's CVE 2026 20223 directly affects a segmentation and policy enforcement control plane with cross tenant administrative reach, making it a critical business continuity risk where Secure Workload underpins micro segmentation or zero trust initiatives.

Threat actor attribution and legal context

U.S. and Canadian charges against Jacob Dort Butler for operating the Kimwolf botnet demonstrate law enforcement willingness to pursue and extradite individuals running high impact DDoS infrastructure, adding legal deterrence but not removing the underlying systemic weaknesses in IoT security. Reporting also attributes Langflow exploitation to MuddyWater, an Iranian linked threat group, which may increase geopolitical and sanctions related scrutiny for organizations found to have facilitated or failed to remediate relevant infrastructure.

Most urgent leadership decision

Given the combination of KEV listings and control plane exposure, the most urgent decision for senior leadership is to approve expedited maintenance windows and associated risk acceptance for patching Langflow, Apex One, Microsoft Defender and Cisco Secure Workload even if it requires short service interruptions.

Chapter 06 - Adversary Emulation

Without explicit technique IDs in the consulted sources, ATT&CK aligned validation scenarios cannot be built without inference. The safest next step is to build control validation around observed behaviors instead of formal ATT&CK emulation.

Recommended validation focus:

  • Langflow: simulate cross origin POSTs to refresh and execution endpoints from a non whitelisted origin.

  • Apex One: simulate unauthorized policy table modification attempts from a privileged admin session.

  • Cisco Secure Workload: simulate unauthenticated API requests to management endpoints and verify alerting.

  • Defender: simulate Defender service interruption and suspicious SYSTEM level child process creation.

  • PinTheft: validate RDS module absence and SUID hardening.

  • Kimwolf: validate DDoS response capacity against short burst high volume traffic patterns.

Intelligence Confidence78%

Factor

Impact

Rationale

CISA KEV confirmation

Strongly positive

Four CVEs carry authoritative government confirmation of exploitation status

NVD CVSS scoring

Positive

CVE-2026-20223 and CVE-2025-34291 have corroborated scores from NVD and vendor advisories

DOJ charging documents

Strongly positive

Kimwolf attribution to Jacob Butler is among the highest-evidence attribution available

Vendor advisory corroboration

Positive

Cisco, Trend Micro, and Ubuntu vendor advisories independently confirm technical details

KrebsOnSecurity investigation

Positive

Adds investigative corroboration for Kimwolf attribution beyond law enforcement documents

MuddyWater attribution gap

Negative

No primary government advisory or primary vendor research publication confirms MuddyWater within this window; attribution remains Under Attribution

Calypso/Red Lamassu channel gap

Negative

Credible underlying research from Lumen and PwC reached this brief through a secondary reporting channel only

No IOC hashes, IPs, or domains

Negative

Limits defensive enrichment and network-indicator detection capability

No confirmed MITRE mappings

Negative

All technique references are behavioral inferences; no source-confirmed ATT&CK IDs

Microsoft Defender CVSS gap

Negative

CVSS scores for CVE-2026-41091 and CVE-2026-45498 were not published in consulted sources within this window