Last Updated On
Iranian False Flag, Firewall Zero Day, and Ransomware Surge
An unpatched CVSS 9.3 buffer overflow in Palo Alto Networks PAN-OS firewalls is under active exploitation, granting attackers root-level access with no authentication required. No patch is available until May 13, 2026. Separately, Rapid7 has confirmed that a 2026 intrusion presented as Chaos ransomware was in fact an Iranian state-sponsored espionage operation by MuddyWater, using Microsoft Teams social engineering and a custom RAT, with no file encryption performed. A CISA KEV remediation deadline for four actively exploited vulnerabilities including a CVSS 9.9 SimpleHelp flaw expires May 8. A critical cPanel vulnerability is being mass-exploited against more than 550,000 exposed servers. Ransomware groups claimed attacks against Papua New Guinea's court system and Hungarian media company MediaWorks. CISA has issued advisories on Iranian OT probing and an NSA-built ICS tool with an unpatched data-theft flaw.
9.9
CVSS Score
19
IOC Count
11
Source Count
0
Confidence Score
CVE-2026-0300, CVE-2026-41940, CVE-2024-57726, CVE-2024-57728, CVE-2024-7399, CVE-2025-29635, CVE-2026-6807
MuddyWater (aka Seedworm, Static Kitten, Mango Sandstorm), Chaos RaaS (used as false-flag cover), Gentlemen ransomware group, World Leaks ransomware group, Iranian-affiliated OT threat actors (unattributed), Qilin, Akira, Clop, INC Ransom, Play, DragonForce, Sinobi, Sorry ransomware operator (unattributed)
Government, Judiciary, Education, Media and Publishing, Manufacturing, Business Services, Retail, Construction, Healthcare, Energy, Water, Financial Services, Critical Infrastructure, Network Security
United States, Papua New Guinea, Hungary, Israel, Middle East and North Africa, Western Europe, Canada, Germany, Global
Chapter 01 - Executive Overview
Today's threat landscape presents three parallel demands on security and risk teams: emergency mitigation of an unpatched firewall zero-day under active exploitation, detection and re-scoping of an active Iranian espionage operation disguised as ransomware, and final-hour remediation of four KEV-listed vulnerabilities with a federal deadline expiring May 8, 2026. Layered on top of these are mass exploitation of a critical cPanel flaw, two ransomware incidents targeting public sector and media organizations, active Iranian probing of OT environments, and fresh data confirming a 389 percent year-on-year surge in confirmed ransomware victims globally.
INCIDENT ONE: CVE-2026-0300, PAN-OS CAPTIVE PORTAL ZERO-DAY
Palo Alto Networks has confirmed active in-the-wild exploitation of CVE-2026-0300, a CVSS 9.3 buffer overflow in the User-ID Authentication Portal (Captive Portal) service on PA-Series and VM-Series firewalls running PAN-OS.
An unauthenticated attacker with network access to the exposed portal can execute arbitrary code with root-level privileges on the firewall. No credentials, no prior access, and no user interaction are required.
Affected branches: PAN-OS 10.2, 11.1, 11.2, and 12.1 across multiple minor versions. Cloud NGFW and Prisma Access are not affected.
No patch exists as of May 7, 2026. Vendor has committed to releasing fixes beginning May 13, 2026.
Risk framing: A rooted perimeter firewall eliminates the defensive value of the device entirely. An attacker with root access can inspect, modify, or redirect all traffic passing through it, including VPN tunnels and internal communications.
Threat actor: Under Attribution. No group or nation-state fingerprint identified in consulted sources.
Immediate action required: Disable or restrict the Captive Portal to trusted internal IPs now. Do not wait for the May 13 patch window.
INCIDENT TWO: MUDDYWATER / CHAOS RANSOMWARE FALSE FLAG
Rapid7 has published a detailed threat report confirming that an intrusion in early 2026, initially presenting as a Chaos ransomware attack, was a state-sponsored false-flag espionage operation attributed with moderate confidence to MuddyWater (Seedworm), an Iranian MOIS-affiliated APT.
The attackers used Microsoft Teams external chat to socially engineer employees into granting screen-sharing access, then interactively harvested credentials and manipulated MFA configurations to add attacker-controlled devices.
A custom Remote Access Trojan named Game.exe was deployed. No file encryption was executed despite Chaos ransomware artifacts being present, which is the primary false-flag indicator.
Persistent remote access tools DWAgent and AnyDesk were installed as services and may remain active long after a victim concludes remediation.
Attribution basis: A code-signing certificate thumbprint (B674578D4BDB24CD58BF2DC884EAA658B7AA250C) is a confirmed MuddyWater shared resource. C2 domain moonzonet[.]com is independently linked to MuddyWater activity targeting Israeli and Western organizations in early 2026. Attribution confidence is moderate; a second independent corroborating source is not present in this window.
Critical IR implication: Any organization that received a Chaos ransomware extortion message or DLS listing in 2026 and treated it as a closed ransomware engagement may have an active APT-level foothold they have not yet identified.
Immediate action required: Re-scope any 2026 Chaos-branded incident as an active APT compromise. Hunt for DWAgent, AnyDesk, Game.exe, and visualwincomp.txt artifacts. Block all published IOCs at perimeter and DNS immediately.
INCIDENT THREE: CISA KEV DEADLINE EXPIRING MAY 8
Four actively exploited vulnerabilities added to the CISA KEV catalog on April 24 through 25, 2026 reach their federal remediation deadline on May 8, 2026.
CVE-2024-57726 (SimpleHelp, CVSS 9.9): Missing authorization enabling unauthorized access to managed endpoints.
CVE-2024-57728 (SimpleHelp, path traversal): CISA KEV listed; CVSS not confirmed in consulted sources.
CVE-2024-7399 (Samsung MagicINFO 9, CVSS 8.8): Path traversal enabling arbitrary file write as SYSTEM authority. Patch: upgrade to version 21.1050 or later.
CVE-2025-29635 (D-Link DIR-823X, CVSS 7.5): Command injection via POST to /goform/set_prohibiting. Device is end-of-life. No patch will be issued. Discontinuation is the only compliant mitigation.
Even organizations not subject to FCEB mandates should treat KEV listings as action items. CISA explicitly urges all organizations to prioritize KEV-listed vulnerabilities.
INCIDENT FOUR: CVE-2026-41940 CPANEL/WHM MASS EXPLOITATION AND SORRY RANSOMWARE
A critical vulnerability in cPanel and WHM tracked as CVE-2026-41940 is being mass-exploited to compromise internet-facing servers. Shadowserver estimates more than 550,000 servers remain potentially exposed.
Observed activity includes website compromises leading to ransomware notes and encrypted content associated with the Sorry ransomware family.
No T1-weight vendor advisory or CISA KEV listing confirmed for this CVE in the current source window. Single primary source for technical detail. Organizations operating cPanel/WHM should treat active scanning and opportunistic exploitation as underway now.
INCIDENT FIVE: PUBLIC AND MEDIA SECTOR RANSOMWARE
The Gentlemen ransomware group has claimed an intrusion against Papua New Guinea's Magisterial Service, the administrative arm of the District Court system, threatening to release full dumps of judicial data. Compromise of judicial records carries acute confidentiality and integrity risk for court operations.
The World Leaks ransomware group has published 8.5 terabytes of data exfiltrated from Hungarian media company MediaWorks, including payroll contracts, financial records, and internal communications. MediaWorks has confirmed the incident.
Both incidents lack published technical detail, IOCs, or confirmed intrusion vectors in consulted sources. They are included as indicators of continued targeting of under-resourced government, justice, and media sector organizations.
INCIDENT SIX: IRANIAN OT PROBING AND GRASSMARLIN ADVISORY
CISA and US federal partners have issued a joint advisory warning of ongoing Iranian-affiliated cyber activity targeting internet-connected OT devices, specifically Rockwell/Allen-Bradley PLCs, with confirmed instances of operational disruption and financial loss in US critical infrastructure sectors including energy, water, healthcare, and manufacturing.
CISA has separately issued an advisory for CVE-2026-6807 in GrassMarlin, an NSA-developed ICS network-mapping tool that went end-of-life in 2017. The flaw enables XML External Entity-style attacks via crafted session files. No patch will be issued.
STRATEGIC TREND CONTEXT
Fortinet's 2026 Global Threat Landscape report records 7,831 confirmed ransomware victims in 2025, a 389 percent increase over the prior year, attributed in part to AI-assisted crimeware tooling including WormGPT, FraudGPT, and BruteForceAI lowering operator skill requirements.
Time-to-exploit for critical vulnerabilities has compressed to approximately 24 to 48 hours after disclosure, leaving defenders minimal response margin.
53 distinct ransomware groups claimed US victims in January through February 2026 alone, underscoring a dense, fragmented, and high-tempo threat ecosystem.
Chapter 02 - Threat & Exposure Analysis
CVE-2026-0300: UNAUTHENTICATED ROOT RCE IN PAN-OS CAPTIVE PORTAL
Attack mechanism:
Vulnerability type: Buffer overflow in the User-ID Authentication Portal (Captive Portal) service of PAN-OS.
Attack vector: Network, unauthenticated, no user interaction required.
The attacker sends specially crafted packets to the exposed Captive Portal service. The buffer overflow condition redirects execution flow to attacker-controlled code, resulting in arbitrary code execution with root privileges on the host firewall.
Root compromise of a perimeter firewall bypasses all downstream network controls. Traffic inspection, access control policies, and VPN tunnel confidentiality are all undermined from the device's own vantage point.
Affected versions:
PAN-OS Branch | Affected Versions |
|---|---|
12.1 | Below 12.1.4-h5 and below 12.1.7 |
11.2 | Below 11.2.4-h17, below 11.2.7-h13, below 11.2.10-h6, below 11.2.12 |
11.1 | Below 11.1.4-h33, below 11.1.6-h32, below 11.1.7-h6, below 11.1.10-h25, below 11.1.13-h5, below 11.1.15 |
10.2 | Below 10.2.7-h34, below 10.2.10-h36, below 10.2.13-h21, below 10.2.16-h7, below 10.2.18-h6 |
Not affected: Cloud NGFW, Prisma Access.
Exploitability context:
CVSS 9.3 when Captive Portal is accessible from untrusted networks or the internet.
CVSS 8.7 when access is restricted to trusted internal IPs only.
No publicly known proof-of-concept exploit code identified in consulted sources.
Exploitation described as limited in-the-wild activity. Attack surface will widen as awareness grows before the May 13 patch window opens.
Patch status: Unpatched as of May 7, 2026. Vendor patch release targeted for May 13, 2026.
Threat actor: Under Attribution.
Sector exposure: All sectors operating PA-Series or VM-Series firewalls with Captive Portal enabled and internet-facing.
Geographic exposure: [INSUFFICIENT SOURCE DATA — global scope implied by device ubiquity; no regional targeting confirmed in consulted sources.]
MUDDYWATER / CHAOS: STATE-SPONSORED INTRUSION MASQUERADING AS RANSOMWARE
Full attack chain (source: Rapid7, 2026-05-06):
Step 1 — Initial Access: Threat actor initiates one-on-one Microsoft Teams chats with targeted employees from attacker-controlled external accounts, establishing screen-sharing sessions.
Step 2 — Credential Harvest: During screen-sharing, employees instructed to enter credentials into locally created text files (credentials.txt, cred.txt). Browser artifacts confirm access to hxxps://adm-pulse[.]com/verify.php, a Quick Assist impersonation phishing page.
Step 3 — MFA Manipulation: MFA configurations modified interactively during the Teams session to add attacker-controlled devices, enabling persistent authenticated access that survives password resets.
Step 4 — Initial Foothold: Attacker authenticates to internal systems including Domain Controllers using compromised credentials. RDP sessions established.
Step 5 — Persistence via Remote Access Tools: DWAgent and AnyDesk downloaded and installed as Windows services (dwagsvc.exe), providing persistent remote access independent of the subsequent malware chain.
Step 6 — Payload Staging: ms_upd.exe downloaded via curl from 172.86.126[.]208:443/ms_upd.exe, saved to C:\ProgramData\ms_upd.exe and executed.
Step 7 — C2 Registration: ms_upd.exe collects computer name, username, and domain. Generates a unique client ID (computer name + username + tick count). Sends a /register request to moonzonet[.]com and awaits an approved status response.
Step 8 — Secondary Stage Delivery: ms_upd.exe downloads three components from moonzonet[.]com: Game.dll (saved as WebView2Loader.dll), Game.exe, and Game.config (saved as visualwincomp.txt) into the user's Downloads folder or C:\Users\Public\Downloads. Executes Game.exe, reports execution status, then self-deletes via cmd.exe /c ping 127.0.0.1 -n 6 > nul && del /f /q.
Step 9 — RAT Deployment: Game.exe establishes C2 to uploadfiler[.]com:443, polls /index.php every 60 seconds, and provides full remote shell capability across 12 commands: run_cmd, run_powershell, upload, upload_chunk, delete_file, cmd_start, cmd_input, cmd_stop, ps_start, ps_input, ps_stop, re_register.
Step 10 — Lateral Movement: Compromised accounts used for RDP-based movement between systems including Domain Controllers.
Step 11 — Exfiltration: Data exfiltrated over Game.exe C2 channel to /profile endpoint. Victim subsequently contacted via email with a .onion ransom negotiation link.
Step 12 — False Flag: Chaos DLS entry created with a countdown timer. No file encryption executed. Absence of encryption is the primary indicator distinguishing this operation from a genuine ransomware attack.
Key technical divergence from genuine ransomware: A genuine RaaS operator does not deploy remote management tools, a custom RAT, and a full lateral movement chain without encrypting files. The espionage objective of persistence, data collection, and long-term access is structurally incompatible with destructive ransomware deployment.
ms_upd.exe technical profile:
Collects host telemetry and registers with C2 before proceeding.
No obfuscation; strings are plaintext. API imports statically resolved.
Self-deletes after delivering Game.exe. Likely single-use or limited-deployment tool.
Designed to leave minimal forensic footprint once the RAT is operational.
Game.exe technical profile (WebView2 masquerade):
Trojanized Microsoft WebView2APISample open-source project. PDB path confirms developer modified the official Microsoft repository.
Anti-analysis checks: sandbox DLL detection (sbiedll.dll, dbghelp.dll, api_log.dll, vmcheck.dll, wpespy.dll), VM CPU keyword detection (Virtual, VMWare, KVM, Hyper-V), sleep and timing checks to detect time-skipping sandboxes.
Persistence: self-installs into randomized C:\ProgramData\visualwincomp-[random]\ directory. Registers mutex ATTRIBUTES_ObjectKernel to enforce single execution instance.
Configuration: AES-256-GCM encrypted config file (visualwincomp.txt) decrypted at runtime to extract C2 host and port.
C2 beaconing: polls /index.php every 60 seconds. Registration data including computer name, username, and privilege level sent to /home endpoint.
Obfuscation inconsistency: XOR encoding (key 0xAB) applied to anti-analysis strings only. RAT command strings, file paths, and JSON registration formats left in plaintext, providing rich static detection surface.
Dynamic API resolution via LoadLibraryA/GetProcAddress used to obscure imported functionality from static analysis tools.
Infrastructure fingerprint:
Indicator | Role |
|---|---|
moonzonet[.]com | C2 for ms_upd.exe; /register and /check endpoints; previously linked to MuddyWater targeting Israeli and Western organizations in early 2026 |
uploadfiler[.]com | C2 for Game.exe RAT; /home and /index.php endpoints; port 443 |
adm-pulse[.]com | Quick Assist impersonation phishing page |
172.86.126[.]208 | Hosts ms_upd.exe download; port 443 |
77.110.107[.]235 | Source IP of malicious Teams activity |
93.123.39[.]127 | Source IP of malicious Teams activity |
116.203.208[.]186 | IP contacted by renamed pythonw.exe |
Attribution anchors:
Certificate thumbprint B674578D4BDB24CD58BF2DC884EAA658B7AA250C ("Donald Gay" / "Microsoft ID Verified CS AOC CA 02") is a confirmed MuddyWater shared resource, previously used to sign Stagecomp/Darkcomp backdoor variants. Time-invalid; revoked shortly after deployment.
moonzonet[.]com independently linked to MuddyWater activity in early 2026.
Tradecraft alignment with Operation Olalampo (March through April 2026 MuddyWater campaign) including Microsoft Teams social engineering and pythonw.exe proxy execution.
Attribution confidence: Moderate. Second independent corroborating source not present in this source window.
Sector exposure: US construction, manufacturing, business services per Chaos DLS victim profile. Iranian targeting patterns extend to government and critical infrastructure sectors globally.
Geographic exposure: United States, Israel, MENA, Western Europe.
CVE-2026-41940: CPANEL/WHM MASS EXPLOITATION AND SORRY RANSOMWARE
Vulnerability: Critical flaw in cPanel and WHM. Exact vulnerability class not confirmed in consulted sources beyond characterization as critical. CVSS score not published in consulted sources.
Exploitation: Mass exploitation confirmed. Shadowserver estimates more than 550,000 servers remain potentially exposed.
Observed post-exploitation activity: Website compromises, ransomware notes, and file encryption associated with the Sorry ransomware family.
Patch status: Patch availability and version details not confirmed in consulted sources. Treat as requiring immediate action pending vendor advisory.
No CISA KEV listing confirmed for this CVE in the current source window.
Threat actor: Under Attribution.
Sector exposure: All sectors operating internet-facing cPanel/WHM web hosting environments.
Geographic exposure: [INSUFFICIENT SOURCE DATA — mass exploitation implies global scope.]
CISA KEV CLUSTER: SIMPLEHELP, SAMSUNG MAGICINFO, D-LINK DIR-823X
CVE | Product | Flaw Class | CVSS | Patch Status | Notes |
|---|---|---|---|---|---|
CVE-2024-57726 | SimpleHelp | Missing authorization | 9.9 | Patch available | Enables unauthorized access to managed endpoints |
CVE-2024-57728 | SimpleHelp | Path traversal | Not confirmed | Patch available | CISA KEV listed |
CVE-2024-7399 | Samsung MagicINFO 9 | Path traversal enabling arbitrary file write as SYSTEM | 8.8 | Upgrade to version 21.1050 or later | Arctic Wolf observed exploitation in May 2025 within days of PoC release |
CVE-2025-29635 | D-Link DIR-823X | Command injection via POST to /goform/set_prohibiting | 7.5 | No patch; end-of-life device | Discontinuation is the only compliant mitigation |
Federal deadline: May 8, 2026. CISA urges all organizations, not only FCEB agencies, to treat these as high-priority remediation items.
GRASSMARLIN CVE-2026-6807 AND IRANIAN OT PROBING
CVE-2026-6807 (GrassMarlin): Insufficiently hardened XML parsing enabling XML External Entity-style attacks via crafted session files. A user tricked into opening a malicious session file may trigger sensitive data disclosure. GrassMarlin is an NSA-developed network-mapping tool for ICS and SCADA environments that went end-of-life in 2017. No patch will be issued. CISA recommends isolation from untrusted networks and avoidance of untrusted session files.
Iranian OT probing (CISA joint advisory): Iranian-affiliated actors are actively probing and exploiting internet-connected OT devices, specifically Rockwell/Allen-Bradley PLCs, across US critical infrastructure sectors including energy, water, healthcare, and manufacturing. Confirmed instances of operational disruption and financial loss reported. Stryker (medical device manufacturer) cited in consulted sources as an illustrative example of Iran-linked attack impact on industrial and healthcare environments; independent confirmation of this specific attribution not available beyond secondary source reporting.
Recommended immediate actions for OT operators: Verify GrassMarlin is isolated from untrusted networks; confirm PLCs and critical OT devices are not directly internet-accessible; review firewall rules and remote access paths for ICS/OT segments; cross-reference CISA advisory IOCs against OT network logs.
STRATEGIC THREAT CONTEXT
Fortinet 2026 Global Threat Landscape report: 7,831 confirmed ransomware victims in 2025 versus approximately 1,600 the prior year, a 389 percent increase. AI-assisted crimeware tooling (WormGPT, FraudGPT, BruteForceAI) is credited with lowering operator skill barriers and accelerating the cybercrime supply chain.
Time-to-exploit compression: For critical outbreaks, TTE has compressed to approximately 24 to 48 hours after disclosure, compared to a previously reported average of 4.76 days. The CVE-2026-41940 mass exploitation pattern is consistent with this trend.
US ransomware ecosystem density: 53 distinct ransomware groups claimed US victims in January through February 2026 alone. Top operators during this period included Qilin, Akira, Clop, INC Ransom, Play, DragonForce, and Sinobi. Shared tooling, infrastructure patterns, and victimology increase the likelihood of repeated targeting of the same sectors and organizations.
Manufacturing, business services, and retail are the most frequently targeted sectors globally per Fortinet data. These align directly with both the Chaos DLS victim profile and the broader ransomware ecosystem trends observed this week.
Chapter 03 - Operational Response
Two parallel operational tracks are required today. The first addresses emergency perimeter device mitigation for CVE-2026-0300 and the KEV deadline cluster. The second addresses full APT-level re-scoping for any organization that has experienced Chaos-branded ransomware contact in 2026. All other actions flow from these two priorities.
PRIORITY ONE: CVE-2026-0300 PAN-OS ZERO-DAY (ACT NOW, PATCH MAY 13)
Containment actions:
Identify all PAN-OS PA-Series and VM-Series firewalls in the estate immediately.
For each device, determine whether the User-ID Authentication Portal (Captive Portal) is enabled and accessible from untrusted networks or the internet.
Disable internet-facing and untrusted-network access to the Captive Portal immediately. If Captive Portal is not operationally required, disable it entirely.
Restricting portal access to trusted internal IP ranges reduces CVSS from 9.3 to 8.7 and materially reduces active exploitation risk per vendor guidance.
Confirm PAN-OS versions against the affected version table. If unpatched and portal cannot be restricted, initiate emergency change control.
Hardening actions:
Apply workaround per Palo Alto Networks advisory: restrict User-ID Authentication Portal to trusted zones only or disable the service where not required.
Patch as soon as May 13, 2026 fixes are released. Prioritize PAN-OS 12.1, 11.2, 11.1, and 10.2 branches. Schedule emergency change window now.
Enable detailed logging on the Captive Portal service to capture any reconnaissance or exploitation activity predating the patch window.
Review firewall logs for anomalous or unexpected inbound connections to the User-ID Authentication Portal from external IPs going back at least seven days.
Internal coordination:
Network and firewall engineering: immediate configuration review and portal restriction deployment.
Vulnerability management: track CVE-2026-0300 for May 13 patch release and hold emergency change window.
SOC: enable alerts for anomalous traffic to Captive Portal ports and endpoints.
If exploitation is suspected: initiate IR process, preserve firewall logs, and contact Palo Alto Networks PSIRT.
PRIORITY TWO: MUDDYWATER / CHAOS FALSE FLAG (RE-SCOPE ALL 2026 CHAOS ENGAGEMENTS)
Containment actions:
If your organization received any Chaos ransomware contact, extortion message, or DLS listing in 2026, immediately re-scope the IR engagement. Do not treat as closed. Search for DWAgent, AnyDesk, and RAT artifacts before concluding remediation.
Audit all active Microsoft Teams external chat sessions and external guest accounts. Disable external Teams chat if not operationally required.
Revoke all credentials that may have been exposed via Teams screen-sharing sessions. Force MFA re-enrollment for all accounts, removing any unrecognized MFA devices.
Hunt for persistence artifacts: dwagent.exe, dwagsvc.exe, dwaglnc.exe, AnyDesk.exe, Game.exe, WebView2.exe, ms_upd.exe, and visualwincomp.txt in C:\ProgramData\ directories across all managed endpoints.
Block all IOC domains and IPs at perimeter and DNS: moonzonet[.]com, uploadfiler[.]com, adm-pulse[.]com, 172.86.126[.]208, 77.110.107[.]235, 93.123.39[.]127, 116.203.208[.]186.
Hardening actions:
Restrict or disable Microsoft Teams external chat (anonymous external message requests from outside the tenant).
Deploy or tune DLP alerting on creation of credential-named files (credentials.txt, cred.txt) in user Desktop, Documents, and Downloads paths.
Audit remote management tool installations across all endpoints. Flag any unsigned or unrecognized DWAgent or AnyDesk installations, particularly from C:\ProgramData.
Review RDP access logs for unexpected lateral movement to Domain Controllers.
Run IOC-based sweeps using published SHA-256 hashes against EDR, endpoint inventory, and proxy/DNS logs within 24 hours.
Internal coordination:
Identity and IAM team: emergency MFA device audit and re-enrollment for any accounts connected via Teams to external parties.
SOC: activate hunting hypotheses for DWAgent persistence and pythonw.exe proxy execution.
IR team: if DWAgent or Game.exe artifacts found, treat as full APT-level compromise, not ransomware. Engage threat intelligence capability.
Legal and compliance: if data exfiltration confirmed, initiate breach notification review per applicable frameworks (GDPR, DPDP, HIPAA, NIS2 depending on sector and region).
External communications: do not engage ransom negotiation channels without IR leadership sign-off, as doing so may alert the threat actor to active investigation.
PRIORITY THREE: CISA KEV DEADLINE MAY 8 (FINAL 24 HOURS)
SimpleHelp: Apply patch for CVE-2024-57726 (CVSS 9.9) and CVE-2024-57728 immediately. SimpleHelp exploitation enables unauthorized access to all endpoints managed through the platform.
Samsung MagicINFO 9: Upgrade to version 21.1050 or later for CVE-2024-7399 (CVSS 8.8). The flaw enables arbitrary file write as SYSTEM authority.
D-Link DIR-823X: This device is end-of-life. No patch will ever be issued for CVE-2025-29635. Immediately discontinue use and replace with a supported device. This is the only compliant mitigation.
PRIORITY FOUR: CVE-2026-41940 CPANEL/WHM (TREAT AS ACTIVE EXPLOITATION UNDERWAY)
Organizations operating internet-facing cPanel/WHM environments should assume active scanning and opportunistic exploitation is underway now.
Restrict exposure through network-level controls and enforce strong authentication on administrative interfaces immediately pending vendor patch availability.
Monitor for anomalous administrative actions, new account creation, unexpected file changes, and webshell-like behavior in web-accessible directories.
Threat hunt focus: unauthorized cron jobs, new scheduled tasks, suspicious outbound connections, and anomalous changes in web content or file shares.
PRIORITY FIVE: OT ENVIRONMENTS AND GRASSMARLIN (FOR ICS/OT OPERATORS)
Verify GrassMarlin, if still in use, is fully isolated from untrusted networks. Ensure staff are aware of the risk of opening untrusted session files.
Confirm that PLCs (particularly Rockwell/Allen-Bradley) and all other critical OT devices are not directly reachable from the internet.
Conduct immediate review of remote access paths, firewall rules, and monitoring coverage around ICS/OT network segments.
Cross-reference CISA advisory IOCs for Iranian OT probing against OT network logs and historian access records going back 30 days.
PRIORITY ORDER SUMMARY
Priority | Action | Deadline |
|---|---|---|
1 | Disable or restrict PAN-OS Captive Portal | Now (patch May 13) |
2 | Re-scope any 2026 Chaos ransomware engagement as active APT | Now |
3 | Block MuddyWater IOCs at perimeter and DNS | Within 24 hours |
4 | Remediate SimpleHelp, Samsung MagicINFO, replace D-Link DIR-823X | Before May 8 close of business |
5 | Patch or mitigate CVE-2026-41940 in cPanel/WHM | Immediately; treat as active |
6 | Isolate GrassMarlin, review OT remote access paths | Within 48 hours |
CVE-2026-0300 (PAN-OS Captive Portal RCE):
Early May 2026 (exact date not confirmed in consulted sources): Limited in-the-wild exploitation of CVE-2026-0300 begins, targeting internet-exposed User-ID Authentication Portals on PA-Series and VM-Series firewalls.
2026-05-04: Palo Alto Networks publishes security advisory for CVE-2026-0300, confirming buffer overflow in Captive Portal service. Patches committed for May 13, 2026.
2026-05-05: The Hacker News, SecurityWeek, watchTowr, and HelpNetSecurity report on the vulnerability and active exploitation. watchTowr confirms no patches available.
2026-05-07 (report date): Status: Unpatched. Active exploitation confirmed. Patch target date May 13, 2026.
MuddyWater / Chaos False Flag Operation:
February 2025: Chaos RaaS group becomes active. Rapid7 assesses it likely includes former BlackSuit and Royal ransomware members following Operation Checkmate (law enforcement disruption of BlackSuit infrastructure, July 2025).
Early 2026 (exact date not confirmed in consulted sources): MuddyWater-attributed intrusion begins. Threat actor initiates Microsoft Teams external chat sessions with targeted employees. Screen-sharing used to harvest credentials and manipulate MFA.
Early 2026 (post initial access): DWAgent and AnyDesk deployed as persistent services. RDP sessions established to Domain Controllers. ms_upd.exe downloaded from 172.86.126[.]208:443 via curl.
Early 2026 (post foothold): Game.exe RAT deployed. C2 established to uploadfiler[.]com:443. Data exfiltration initiated. Victim contacted via email with .onion ransom negotiation link. Chaos DLS entry created with countdown timer. No file encryption executed.
Late March 2026: Chaos DLS shows 36 claimed victims.
2026-05-06: Rapid7 publishes full technical report "Muddying the Tracks: The State-Sponsored Shadow Behind Chaos Ransomware." Report includes IOCs, YARA rules, Game.exe malware analysis, MITRE ATT&CK mapping, and certificate attribution anchor.
2026-05-07 (report date): Status: Rapid7 report in active dissemination. IOCs published. Attribution moderate confidence. Second independent corroborating source pending.
CISA KEV Cluster:
2026-04-24 through 2026-04-25: CISA adds CVE-2024-57726, CVE-2024-57728, CVE-2024-7399, and CVE-2025-29635 to KEV catalog. Federal remediation deadline set for May 8, 2026.
2026-05-07 (report date): Status: Deadline expires in less than 24 hours. D-Link device has no patch; discontinuation is the only compliant mitigation.
CVE-2026-41940 / Sorry Ransomware:
2026-05-06: BleepingComputer reports mass exploitation of CVE-2026-41940 in cPanel/WHM. Shadowserver exposure estimate of 550,000 servers published. Sorry ransomware deployment confirmed in observed post-exploitation activity.
2026-05-07 (report date): Status: Mass exploitation ongoing. No CISA KEV listing or T1-weight advisory confirmed in consulted sources. Single primary source for technical detail.
Papua New Guinea Magisterial Service:
Reported within the 24-hour window: Gentlemen ransomware group claims intrusion and threatens release of judicial data. Intrusion date and vector not confirmed in consulted sources.
MediaWorks Hungary:
Reported within the 24-hour window: World Leaks group publishes 8.5 TB of exfiltrated data. MediaWorks confirms the incident. Intrusion date and technical vector not confirmed in consulted sources.
GrassMarlin CVE-2026-6807:
2026-04-29: CISA publishes advisory for CVE-2026-6807. No patch available; tool is end-of-life since 2017.
Iranian OT Probing:
April 2026: CISA and US federal partners publish joint advisory on Iranian-affiliated OT targeting activity. Ongoing activity confirmed at report date.
Chapter 04 - Detection Intelligence
CVE-2026-0300: TECHNICAL DETAIL
Vulnerability class: Stack or heap buffer overflow (exact memory region not confirmed in consulted sources) in the User-ID Authentication Portal service of PAN-OS.
Trigger condition: Specially crafted packets sent to the Captive Portal service endpoint. No authentication, no user interaction, no prior foothold required.
Impact: Arbitrary code execution with root privileges on the affected PA-Series or VM-Series firewall host.
CVSS vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CVSS 9.3 for internet-exposed configuration). Restricted to trusted IPs: CVSS 8.7.
CWE classification: [NOT CONFIRMED IN CONSULTED SOURCES]
Exploitation evidence: Described as limited in-the-wild activity by Palo Alto Networks. No further forensic detail, no IOCs, and no post-exploitation artifacts published in consulted sources within this window.
PoC availability: No publicly known proof-of-concept exploit code identified in consulted sources.
Patch status: Unpatched as of May 7, 2026. Fixes targeted for May 13, 2026.
MUDDYWATER / CHAOS: MALWARE TECHNICAL DETAIL
ms_upd.exe (Initial Downloader):
Function: Collects host telemetry, registers with C2, downloads and executes the Game.exe RAT, then self-deletes.
Telemetry collected: Computer name, username, domain. Client ID generated as computer name + username + tick count.
C2 protocol: HTTP requests to moonzonet[.]com via /register (registration) and /check (status polling) endpoints.
Self-deletion mechanism: cmd.exe /c ping 127.0.0.1 -n 6 > nul && del /f /q [path]
Obfuscation: None. Strings are plaintext. API imports statically resolved.
Likely designed as a single-use staging tool to minimize forensic footprint.
Game.exe (Custom RAT, WebView2 Masquerade):
Origin: Trojanized Microsoft WebView2APISample open-source project. PDB path retained, confirming developer modified the official repository rather than writing from scratch.
Masquerade: Presents as a legitimate Microsoft WebView2 application to casual inspection.
Anti-analysis and evasion:
Check Type | Detail |
|---|---|
Sandbox DLL detection | sbiedll.dll, dbghelp.dll, api_log.dll, vmcheck.dll, wpespy.dll |
VM CPU keyword detection | Virtual, VMWare, KVM, Hyper-V (checked against CPUID output) |
Timing checks | Sleep-based timing to detect sandbox time acceleration |
Mutex enforcement | ATTRIBUTES_ObjectKernel prevents multiple simultaneous instances |
Persistence: Self-installs into C:\ProgramData\visualwincomp-[random]\ directory. Designed to blend with legitimate ProgramData entries.
Configuration decryption: AES-256-GCM encrypted configuration file (visualwincomp.txt) decrypted at runtime to extract C2 host (uploadfiler[.]com) and port (443).
C2 registration: Sends computer name, username, and privilege level to /home endpoint. Polls /index.php every 60 seconds.
Supported RAT commands:
Command | Function |
|---|---|
run_cmd | Execute single cmd.exe command |
run_powershell | Execute single PowerShell command |
upload | Upload file to C2 |
upload_chunk | Upload file in chunks (large file exfiltration) |
delete_file | Delete specified file |
cmd_start | Open interactive cmd.exe shell |
cmd_input | Send input to interactive cmd shell |
cmd_stop | Close interactive cmd shell |
ps_start | Open interactive PowerShell shell |
ps_input | Send input to interactive PowerShell shell |
ps_stop | Close interactive PowerShell shell |
re_register | Re-register with C2 (identity refresh or failover) |
Exfiltration: Command results and status data reported to /profile endpoint over the same HTTPS-mimicking channel.
Obfuscation inconsistency: XOR encoding (key 0xAB) applied only to anti-analysis strings. All RAT command names, file path strings, and JSON registration keys left in plaintext, providing a rich and reliable static detection surface.
Dynamic API resolution: LoadLibraryA and GetProcAddress used to resolve certain API imports at runtime, obscuring some functionality from basic static import analysis.
Code-signing certificate detail:
Field | Value |
|---|---|
Subject name | Donald Gay |
Issuer | Microsoft ID Verified CS AOC CA 02 |
Algorithm | sha384RSA |
Thumbprint | B674578D4BDB24CD58BF2DC884EAA658B7AA250C |
Serial | 33 00 07 9A 51 C7 06 3E 66 05 3D 22 9B 00 00 00 07 9A 51 |
Status | Time-invalid (revoked shortly after deployment) |
Attribution significance | Confirmed MuddyWater shared resource; previously used to sign Stagecomp/Darkcomp backdoor variants; paired with "Amy Cherne" identity in related Operation Olalampo activity |
CISA KEV CLUSTER: TECHNICAL DETAIL
CVE | Vulnerability Mechanism | Exploitation Impact |
|---|---|---|
CVE-2024-57726 | Missing authorization in SimpleHelp remote support software | Unauthorized access to all endpoints managed through the SimpleHelp platform |
CVE-2024-57728 | Path traversal in SimpleHelp | File system access beyond authorized boundaries; full technical impact not confirmed in consulted sources |
CVE-2024-7399 | Path traversal in Samsung MagicINFO 9 Server enabling arbitrary file write | File write as SYSTEM authority; potential for code execution via planted executables or configuration files |
CVE-2025-29635 | Command injection via HTTP POST to /goform/set_prohibiting on D-Link DIR-823X | Remote command execution on affected router; network pivot capability |
CVE-2026-41940 (CPANEL/WHM): TECHNICAL DETAIL
Vulnerability class: Described as critical in consulted sources. Exact vulnerability mechanism (injection, traversal, overflow, authentication bypass) not confirmed in consulted sources within this window.
Exploitation scale: Shadowserver estimates more than 550,000 internet-facing servers remain potentially exposed.
Post-exploitation observed: Website defacement, ransomware notes, file encryption associated with Sorry ransomware family.
Patch details: [NOT CONFIRMED IN CONSULTED SOURCES]. Treat as requiring immediate vendor advisory review.
GRASSMARLIN CVE-2026-6807: TECHNICAL DETAIL
Vulnerability class: Insufficiently hardened XML parsing enabling XML External Entity (XXE)-style attacks.
Trigger: User opens a crafted GrassMarlin session file received from an untrusted source.
Impact: Sensitive data disclosure from the analyst's system. Potential to exfiltrate network topology data, ICS device inventories, or other sensitive mapping artifacts produced by GrassMarlin.
Patch: None available. Tool is end-of-life since 2017.
Mitigation: Isolate from untrusted networks; do not open untrusted session files; consider decommissioning in favor of supported alternatives.
CVE-2026-0300: UNAUTHENTICATED ROOT RCE IN PAN-OS CAPTIVE PORTAL
Attack mechanism:
Vulnerability type: Buffer overflow in the User-ID Authentication Portal (Captive Portal) service of PAN-OS.
Attack vector: Network, unauthenticated, no user interaction required.
The attacker sends specially crafted packets to the exposed Captive Portal service. The buffer overflow condition redirects execution flow to attacker-controlled code, resulting in arbitrary code execution with root privileges on the host firewall.
Root compromise of a perimeter firewall bypasses all downstream network controls. Traffic inspection, access control policies, and VPN tunnel confidentiality are all undermined from the device's own vantage point.
Affected versions:
PAN-OS Branch | Affected Versions |
|---|---|
12.1 | Below 12.1.4-h5 and below 12.1.7 |
11.2 | Below 11.2.4-h17, below 11.2.7-h13, below 11.2.10-h6, below 11.2.12 |
11.1 | Below 11.1.4-h33, below 11.1.6-h32, below 11.1.7-h6, below 11.1.10-h25, below 11.1.13-h5, below 11.1.15 |
10.2 | Below 10.2.7-h34, below 10.2.10-h36, below 10.2.13-h21, below 10.2.16-h7, below 10.2.18-h6 |
Not affected: Cloud NGFW, Prisma Access.
Exploitability context:
CVSS 9.3 when Captive Portal is accessible from untrusted networks or the internet.
CVSS 8.7 when access is restricted to trusted internal IPs only.
No publicly known proof-of-concept exploit code identified in consulted sources.
Exploitation described as limited in-the-wild activity. Attack surface will widen as awareness grows before the May 13 patch window opens.
Patch status: Unpatched as of May 7, 2026. Vendor patch release targeted for May 13, 2026.
Threat actor: Under Attribution.
Sector exposure: All sectors operating PA-Series or VM-Series firewalls with Captive Portal enabled and internet-facing.
Geographic exposure: [INSUFFICIENT SOURCE DATA — global scope implied by device ubiquity; no regional targeting confirmed in consulted sources.]
MUDDYWATER / CHAOS: STATE-SPONSORED INTRUSION MASQUERADING AS RANSOMWARE
Full attack chain (source: Rapid7, 2026-05-06):
Step 1 — Initial Access: Threat actor initiates one-on-one Microsoft Teams chats with targeted employees from attacker-controlled external accounts, establishing screen-sharing sessions.
Step 2 — Credential Harvest: During screen-sharing, employees instructed to enter credentials into locally created text files (credentials.txt, cred.txt). Browser artifacts confirm access to hxxps://adm-pulse[.]com/verify.php, a Quick Assist impersonation phishing page.
Step 3 — MFA Manipulation: MFA configurations modified interactively during the Teams session to add attacker-controlled devices, enabling persistent authenticated access that survives password resets.
Step 4 — Initial Foothold: Attacker authenticates to internal systems including Domain Controllers using compromised credentials. RDP sessions established.
Step 5 — Persistence via Remote Access Tools: DWAgent and AnyDesk downloaded and installed as Windows services (dwagsvc.exe), providing persistent remote access independent of the subsequent malware chain.
Step 6 — Payload Staging: ms_upd.exe downloaded via curl from 172.86.126[.]208:443/ms_upd.exe, saved to C:\ProgramData\ms_upd.exe and executed.
Step 7 — C2 Registration: ms_upd.exe collects computer name, username, and domain. Generates a unique client ID (computer name + username + tick count). Sends a /register request to moonzonet[.]com and awaits an approved status response.
Step 8 — Secondary Stage Delivery: ms_upd.exe downloads three components from moonzonet[.]com: Game.dll (saved as WebView2Loader.dll), Game.exe, and Game.config (saved as visualwincomp.txt) into the user's Downloads folder or C:\Users\Public\Downloads. Executes Game.exe, reports execution status, then self-deletes via cmd.exe /c ping 127.0.0.1 -n 6 > nul && del /f /q.
Step 9 — RAT Deployment: Game.exe establishes C2 to uploadfiler[.]com:443, polls /index.php every 60 seconds, and provides full remote shell capability across 12 commands: run_cmd, run_powershell, upload, upload_chunk, delete_file, cmd_start, cmd_input, cmd_stop, ps_start, ps_input, ps_stop, re_register.
Step 10 — Lateral Movement: Compromised accounts used for RDP-based movement between systems including Domain Controllers.
Step 11 — Exfiltration: Data exfiltrated over Game.exe C2 channel to /profile endpoint. Victim subsequently contacted via email with a .onion ransom negotiation link.
Step 12 — False Flag: Chaos DLS entry created with a countdown timer. No file encryption executed. Absence of encryption is the primary indicator distinguishing this operation from a genuine ransomware attack.
Key technical divergence from genuine ransomware: A genuine RaaS operator does not deploy remote management tools, a custom RAT, and a full lateral movement chain without encrypting files. The espionage objective of persistence, data collection, and long-term access is structurally incompatible with destructive ransomware deployment.
ms_upd.exe technical profile:
Collects host telemetry and registers with C2 before proceeding.
No obfuscation; strings are plaintext. API imports statically resolved.
Self-deletes after delivering Game.exe. Likely single-use or limited-deployment tool.
Designed to leave minimal forensic footprint once the RAT is operational.
Game.exe technical profile (WebView2 masquerade):
Trojanized Microsoft WebView2APISample open-source project. PDB path confirms developer modified the official Microsoft repository.
Anti-analysis checks: sandbox DLL detection (sbiedll.dll, dbghelp.dll, api_log.dll, vmcheck.dll, wpespy.dll), VM CPU keyword detection (Virtual, VMWare, KVM, Hyper-V), sleep and timing checks to detect time-skipping sandboxes.
Persistence: self-installs into randomized C:\ProgramData\visualwincomp-[random]\ directory. Registers mutex ATTRIBUTES_ObjectKernel to enforce single execution instance.
Configuration: AES-256-GCM encrypted config file (visualwincomp.txt) decrypted at runtime to extract C2 host and port.
C2 beaconing: polls /index.php every 60 seconds. Registration data including computer name, username, and privilege level sent to /home endpoint.
Obfuscation inconsistency: XOR encoding (key 0xAB) applied to anti-analysis strings only. RAT command strings, file paths, and JSON registration formats left in plaintext, providing rich static detection surface.
Dynamic API resolution via LoadLibraryA/GetProcAddress used to obscure imported functionality from static analysis tools.
Infrastructure fingerprint:
Indicator | Role |
|---|---|
moonzonet[.]com | C2 for ms_upd.exe; /register and /check endpoints; previously linked to MuddyWater targeting Israeli and Western organizations in early 2026 |
uploadfiler[.]com | C2 for Game.exe RAT; /home and /index.php endpoints; port 443 |
adm-pulse[.]com | Quick Assist impersonation phishing page |
172.86.126[.]208 | Hosts ms_upd.exe download; port 443 |
77.110.107[.]235 | Source IP of malicious Teams activity |
93.123.39[.]127 | Source IP of malicious Teams activity |
116.203.208[.]186 | IP contacted by renamed pythonw.exe |
Attribution anchors:
Certificate thumbprint B674578D4BDB24CD58BF2DC884EAA658B7AA250C ("Donald Gay" / "Microsoft ID Verified CS AOC CA 02") is a confirmed MuddyWater shared resource, previously used to sign Stagecomp/Darkcomp backdoor variants. Time-invalid; revoked shortly after deployment.
moonzonet[.]com independently linked to MuddyWater activity in early 2026.
Tradecraft alignment with Operation Olalampo (March through April 2026 MuddyWater campaign) including Microsoft Teams social engineering and pythonw.exe proxy execution.
Attribution confidence: Moderate. Second independent corroborating source not present in this source window.
Sector exposure: US construction, manufacturing, business services per Chaos DLS victim profile. Iranian targeting patterns extend to government and critical infrastructure sectors globally.
Geographic exposure: United States, Israel, MENA, Western Europe.
CVE-2026-41940: CPANEL/WHM MASS EXPLOITATION AND SORRY RANSOMWARE
Vulnerability: Critical flaw in cPanel and WHM. Exact vulnerability class not confirmed in consulted sources beyond characterization as critical. CVSS score not published in consulted sources.
Exploitation: Mass exploitation confirmed. Shadowserver estimates more than 550,000 servers remain potentially exposed.
Observed post-exploitation activity: Website compromises, ransomware notes, and file encryption associated with the Sorry ransomware family.
Patch status: Patch availability and version details not confirmed in consulted sources. Treat as requiring immediate action pending vendor advisory.
No CISA KEV listing confirmed for this CVE in the current source window.
Threat actor: Under Attribution.
Sector exposure: All sectors operating internet-facing cPanel/WHM web hosting environments.
Geographic exposure: [INSUFFICIENT SOURCE DATA — mass exploitation implies global scope.]
CISA KEV CLUSTER: SIMPLEHELP, SAMSUNG MAGICINFO, D-LINK DIR-823X
CVE | Product | Flaw Class | CVSS | Patch Status | Notes |
|---|---|---|---|---|---|
CVE-2024-57726 | SimpleHelp | Missing authorization | 9.9 | Patch available | Enables unauthorized access to managed endpoints |
CVE-2024-57728 | SimpleHelp | Path traversal | Not confirmed | Patch available | CISA KEV listed |
CVE-2024-7399 | Samsung MagicINFO 9 | Path traversal enabling arbitrary file write as SYSTEM | 8.8 | Upgrade to version 21.1050 or later | Arctic Wolf observed exploitation in May 2025 within days of PoC release |
CVE-2025-29635 | D-Link DIR-823X | Command injection via POST to /goform/set_prohibiting | 7.5 | No patch; end-of-life device | Discontinuation is the only compliant mitigation |
Federal deadline: May 8, 2026. CISA urges all organizations, not only FCEB agencies, to treat these as high-priority remediation items.
GRASSMARLIN CVE-2026-6807 AND IRANIAN OT PROBING
CVE-2026-6807 (GrassMarlin): Insufficiently hardened XML parsing enabling XML External Entity-style attacks via crafted session files. A user tricked into opening a malicious session file may trigger sensitive data disclosure. GrassMarlin is an NSA-developed network-mapping tool for ICS and SCADA environments that went end-of-life in 2017. No patch will be issued. CISA recommends isolation from untrusted networks and avoidance of untrusted session files.
Iranian OT probing (CISA joint advisory): Iranian-affiliated actors are actively probing and exploiting internet-connected OT devices, specifically Rockwell/Allen-Bradley PLCs, across US critical infrastructure sectors including energy, water, healthcare, and manufacturing. Confirmed instances of operational disruption and financial loss reported. Stryker (medical device manufacturer) cited in consulted sources as an illustrative example of Iran-linked attack impact on industrial and healthcare environments; independent confirmation of this specific attribution not available beyond secondary source reporting.
Recommended immediate actions for OT operators: Verify GrassMarlin is isolated from untrusted networks; confirm PLCs and critical OT devices are not directly internet-accessible; review firewall rules and remote access paths for ICS/OT segments; cross-reference CISA advisory IOCs against OT network logs.
STRATEGIC THREAT CONTEXT
Fortinet 2026 Global Threat Landscape report: 7,831 confirmed ransomware victims in 2025 versus approximately 1,600 the prior year, a 389 percent increase. AI-assisted crimeware tooling (WormGPT, FraudGPT, BruteForceAI) is credited with lowering operator skill barriers and accelerating the cybercrime supply chain.
Time-to-exploit compression: For critical outbreaks, TTE has compressed to approximately 24 to 48 hours after disclosure, compared to a previously reported average of 4.76 days. The CVE-2026-41940 mass exploitation pattern is consistent with this trend.
US ransomware ecosystem density: 53 distinct ransomware groups claimed US victims in January through February 2026 alone. Top operators during this period included Qilin, Akira, Clop, INC Ransom, Play, DragonForce, and Sinobi. Shared tooling, infrastructure patterns, and victimology increase the likelihood of repeated targeting of the same sectors and organizations.
Manufacturing, business services, and retail are the most frequently targeted sectors globally per Fortinet data. These align directly with both the Chaos DLS victim profile and the broader ransomware ecosystem trends observed this week.
27 OPERATIONAL RESPONSE
Two parallel operational tracks are required today. The first addresses emergency perimeter device mitigation for CVE-2026-0300 and the KEV deadline cluster. The second addresses full APT-level re-scoping for any organization that has experienced Chaos-branded ransomware contact in 2026. All other actions flow from these two priorities.
PRIORITY ONE: CVE-2026-0300 PAN-OS ZERO-DAY (ACT NOW, PATCH MAY 13)
Containment actions:
Identify all PAN-OS PA-Series and VM-Series firewalls in the estate immediately.
For each device, determine whether the User-ID Authentication Portal (Captive Portal) is enabled and accessible from untrusted networks or the internet.
Disable internet-facing and untrusted-network access to the Captive Portal immediately. If Captive Portal is not operationally required, disable it entirely.
Restricting portal access to trusted internal IP ranges reduces CVSS from 9.3 to 8.7 and materially reduces active exploitation risk per vendor guidance.
Confirm PAN-OS versions against the affected version table. If unpatched and portal cannot be restricted, initiate emergency change control.
Hardening actions:
Apply workaround per Palo Alto Networks advisory: restrict User-ID Authentication Portal to trusted zones only or disable the service where not required.
Patch as soon as May 13, 2026 fixes are released. Prioritize PAN-OS 12.1, 11.2, 11.1, and 10.2 branches. Schedule emergency change window now.
Enable detailed logging on the Captive Portal service to capture any reconnaissance or exploitation activity predating the patch window.
Review firewall logs for anomalous or unexpected inbound connections to the User-ID Authentication Portal from external IPs going back at least seven days.
Internal coordination:
Network and firewall engineering: immediate configuration review and portal restriction deployment.
Vulnerability management: track CVE-2026-0300 for May 13 patch release and hold emergency change window.
SOC: enable alerts for anomalous traffic to Captive Portal ports and endpoints.
If exploitation is suspected: initiate IR process, preserve firewall logs, and contact Palo Alto Networks PSIRT.
PRIORITY TWO: MUDDYWATER / CHAOS FALSE FLAG (RE-SCOPE ALL 2026 CHAOS ENGAGEMENTS)
Containment actions:
If your organization received any Chaos ransomware contact, extortion message, or DLS listing in 2026, immediately re-scope the IR engagement. Do not treat as closed. Search for DWAgent, AnyDesk, and RAT artifacts before concluding remediation.
Audit all active Microsoft Teams external chat sessions and external guest accounts. Disable external Teams chat if not operationally required.
Revoke all credentials that may have been exposed via Teams screen-sharing sessions. Force MFA re-enrollment for all accounts, removing any unrecognized MFA devices.
Hunt for persistence artifacts: dwagent.exe, dwagsvc.exe, dwaglnc.exe, AnyDesk.exe, Game.exe, WebView2.exe, ms_upd.exe, and visualwincomp.txt in C:\ProgramData\ directories across all managed endpoints.
Block all IOC domains and IPs at perimeter and DNS: moonzonet[.]com, uploadfiler[.]com, adm-pulse[.]com, 172.86.126[.]208, 77.110.107[.]235, 93.123.39[.]127, 116.203.208[.]186.
Hardening actions:
Restrict or disable Microsoft Teams external chat (anonymous external message requests from outside the tenant).
Deploy or tune DLP alerting on creation of credential-named files (credentials.txt, cred.txt) in user Desktop, Documents, and Downloads paths.
Audit remote management tool installations across all endpoints. Flag any unsigned or unrecognized DWAgent or AnyDesk installations, particularly from C:\ProgramData.
Review RDP access logs for unexpected lateral movement to Domain Controllers.
Run IOC-based sweeps using published SHA-256 hashes against EDR, endpoint inventory, and proxy/DNS logs within 24 hours.
Internal coordination:
Identity and IAM team: emergency MFA device audit and re-enrollment for any accounts connected via Teams to external parties.
SOC: activate hunting hypotheses for DWAgent persistence and pythonw.exe proxy execution.
IR team: if DWAgent or Game.exe artifacts found, treat as full APT-level compromise, not ransomware. Engage threat intelligence capability.
Legal and compliance: if data exfiltration confirmed, initiate breach notification review per applicable frameworks (GDPR, DPDP, HIPAA, NIS2 depending on sector and region).
External communications: do not engage ransom negotiation channels without IR leadership sign-off, as doing so may alert the threat actor to active investigation.
PRIORITY THREE: CISA KEV DEADLINE MAY 8 (FINAL 24 HOURS)
SimpleHelp: Apply patch for CVE-2024-57726 (CVSS 9.9) and CVE-2024-57728 immediately. SimpleHelp exploitation enables unauthorized access to all endpoints managed through the platform.
Samsung MagicINFO 9: Upgrade to version 21.1050 or later for CVE-2024-7399 (CVSS 8.8). The flaw enables arbitrary file write as SYSTEM authority.
D-Link DIR-823X: This device is end-of-life. No patch will ever be issued for CVE-2025-29635. Immediately discontinue use and replace with a supported device. This is the only compliant mitigation.
PRIORITY FOUR: CVE-2026-41940 CPANEL/WHM (TREAT AS ACTIVE EXPLOITATION UNDERWAY)
Organizations operating internet-facing cPanel/WHM environments should assume active scanning and opportunistic exploitation is underway now.
Restrict exposure through network-level controls and enforce strong authentication on administrative interfaces immediately pending vendor patch availability.
Monitor for anomalous administrative actions, new account creation, unexpected file changes, and webshell-like behavior in web-accessible directories.
Threat hunt focus: unauthorized cron jobs, new scheduled tasks, suspicious outbound connections, and anomalous changes in web content or file shares.
PRIORITY FIVE: OT ENVIRONMENTS AND GRASSMARLIN (FOR ICS/OT OPERATORS)
Verify GrassMarlin, if still in use, is fully isolated from untrusted networks. Ensure staff are aware of the risk of opening untrusted session files.
Confirm that PLCs (particularly Rockwell/Allen-Bradley) and all other critical OT devices are not directly reachable from the internet.
Conduct immediate review of remote access paths, firewall rules, and monitoring coverage around ICS/OT network segments.
Cross-reference CISA advisory IOCs for Iranian OT probing against OT network logs and historian access records going back 30 days.
PRIORITY ORDER SUMMARY
Priority | Action | Deadline |
|---|---|---|
1 | Disable or restrict PAN-OS Captive Portal | Now (patch May 13) |
2 | Re-scope any 2026 Chaos ransomware engagement as active APT | Now |
3 | Block MuddyWater IOCs at perimeter and DNS | Within 24 hours |
4 | Remediate SimpleHelp, Samsung MagicINFO, replace D-Link DIR-823X | Before May 8 close of business |
5 | Patch or mitigate CVE-2026-41940 in cPanel/WHM | Immediately; treat as active |
6 | Isolate GrassMarlin, review OT remote access paths | Within 48 hours |
28 INCIDENT TIMELINE
CVE-2026-0300 (PAN-OS Captive Portal RCE):
Early May 2026 (exact date not confirmed in consulted sources): Limited in-the-wild exploitation of CVE-2026-0300 begins, targeting internet-exposed User-ID Authentication Portals on PA-Series and VM-Series firewalls.
2026-05-04: Palo Alto Networks publishes security advisory for CVE-2026-0300, confirming buffer overflow in Captive Portal service. Patches committed for May 13, 2026.
2026-05-05: The Hacker News, SecurityWeek, watchTowr, and HelpNetSecurity report on the vulnerability and active exploitation. watchTowr confirms no patches available.
2026-05-07 (report date): Status: Unpatched. Active exploitation confirmed. Patch target date May 13, 2026.
MuddyWater / Chaos False Flag Operation:
February 2025: Chaos RaaS group becomes active. Rapid7 assesses it likely includes former BlackSuit and Royal ransomware members following Operation Checkmate (law enforcement disruption of BlackSuit infrastructure, July 2025).
Early 2026 (exact date not confirmed in consulted sources): MuddyWater-attributed intrusion begins. Threat actor initiates Microsoft Teams external chat sessions with targeted employees. Screen-sharing used to harvest credentials and manipulate MFA.
Early 2026 (post initial access): DWAgent and AnyDesk deployed as persistent services. RDP sessions established to Domain Controllers. ms_upd.exe downloaded from 172.86.126[.]208:443 via curl.
Early 2026 (post foothold): Game.exe RAT deployed. C2 established to uploadfiler[.]com:443. Data exfiltration initiated. Victim contacted via email with .onion ransom negotiation link. Chaos DLS entry created with countdown timer. No file encryption executed.
Late March 2026: Chaos DLS shows 36 claimed victims.
2026-05-06: Rapid7 publishes full technical report "Muddying the Tracks: The State-Sponsored Shadow Behind Chaos Ransomware." Report includes IOCs, YARA rules, Game.exe malware analysis, MITRE ATT&CK mapping, and certificate attribution anchor.
2026-05-07 (report date): Status: Rapid7 report in active dissemination. IOCs published. Attribution moderate confidence. Second independent corroborating source pending.
CISA KEV Cluster:
2026-04-24 through 2026-04-25: CISA adds CVE-2024-57726, CVE-2024-57728, CVE-2024-7399, and CVE-2025-29635 to KEV catalog. Federal remediation deadline set for May 8, 2026.
2026-05-07 (report date): Status: Deadline expires in less than 24 hours. D-Link device has no patch; discontinuation is the only compliant mitigation.
CVE-2026-41940 / Sorry Ransomware:
2026-05-06: BleepingComputer reports mass exploitation of CVE-2026-41940 in cPanel/WHM. Shadowserver exposure estimate of 550,000 servers published. Sorry ransomware deployment confirmed in observed post-exploitation activity.
2026-05-07 (report date): Status: Mass exploitation ongoing. No CISA KEV listing or T1-weight advisory confirmed in consulted sources. Single primary source for technical detail.
Papua New Guinea Magisterial Service:
Reported within the 24-hour window: Gentlemen ransomware group claims intrusion and threatens release of judicial data. Intrusion date and vector not confirmed in consulted sources.
MediaWorks Hungary:
Reported within the 24-hour window: World Leaks group publishes 8.5 TB of exfiltrated data. MediaWorks confirms the incident. Intrusion date and technical vector not confirmed in consulted sources.
GrassMarlin CVE-2026-6807:
2026-04-29: CISA publishes advisory for CVE-2026-6807. No patch available; tool is end-of-life since 2017.
Iranian OT Probing:
April 2026: CISA and US federal partners publish joint advisory on Iranian-affiliated OT targeting activity. Ongoing activity confirmed at report date.
29 TECHNICAL ANALYSIS
CVE-2026-0300: TECHNICAL DETAIL
Vulnerability class: Stack or heap buffer overflow (exact memory region not confirmed in consulted sources) in the User-ID Authentication Portal service of PAN-OS.
Trigger condition: Specially crafted packets sent to the Captive Portal service endpoint. No authentication, no user interaction, no prior foothold required.
Impact: Arbitrary code execution with root privileges on the affected PA-Series or VM-Series firewall host.
CVSS vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CVSS 9.3 for internet-exposed configuration). Restricted to trusted IPs: CVSS 8.7.
CWE classification: [NOT CONFIRMED IN CONSULTED SOURCES]
Exploitation evidence: Described as limited in-the-wild activity by Palo Alto Networks. No further forensic detail, no IOCs, and no post-exploitation artifacts published in consulted sources within this window.
PoC availability: No publicly known proof-of-concept exploit code identified in consulted sources.
Patch status: Unpatched as of May 7, 2026. Fixes targeted for May 13, 2026.
MUDDYWATER / CHAOS: MALWARE TECHNICAL DETAIL
ms_upd.exe (Initial Downloader):
Function: Collects host telemetry, registers with C2, downloads and executes the Game.exe RAT, then self-deletes.
Telemetry collected: Computer name, username, domain. Client ID generated as computer name + username + tick count.
C2 protocol: HTTP requests to moonzonet[.]com via /register (registration) and /check (status polling) endpoints.
Self-deletion mechanism: cmd.exe /c ping 127.0.0.1 -n 6 > nul && del /f /q [path]
Obfuscation: None. Strings are plaintext. API imports statically resolved.
Likely designed as a single-use staging tool to minimize forensic footprint.
Game.exe (Custom RAT, WebView2 Masquerade):
Origin: Trojanized Microsoft WebView2APISample open-source project. PDB path retained, confirming developer modified the official repository rather than writing from scratch.
Masquerade: Presents as a legitimate Microsoft WebView2 application to casual inspection.
Anti-analysis and evasion:
Check Type | Detail |
|---|---|
Sandbox DLL detection | sbiedll.dll, dbghelp.dll, api_log.dll, vmcheck.dll, wpespy.dll |
VM CPU keyword detection | Virtual, VMWare, KVM, Hyper-V (checked against CPUID output) |
Timing checks | Sleep-based timing to detect sandbox time acceleration |
Mutex enforcement | ATTRIBUTES_ObjectKernel prevents multiple simultaneous instances |
Persistence: Self-installs into C:\ProgramData\visualwincomp-[random]\ directory. Designed to blend with legitimate ProgramData entries.
Configuration decryption: AES-256-GCM encrypted configuration file (visualwincomp.txt) decrypted at runtime to extract C2 host (uploadfiler[.]com) and port (443).
C2 registration: Sends computer name, username, and privilege level to /home endpoint. Polls /index.php every 60 seconds.
Supported RAT commands:
Command | Function |
|---|---|
run_cmd | Execute single cmd.exe command |
run_powershell | Execute single PowerShell command |
upload | Upload file to C2 |
upload_chunk | Upload file in chunks (large file exfiltration) |
delete_file | Delete specified file |
cmd_start | Open interactive cmd.exe shell |
cmd_input | Send input to interactive cmd shell |
cmd_stop | Close interactive cmd shell |
ps_start | Open interactive PowerShell shell |
ps_input | Send input to interactive PowerShell shell |
ps_stop | Close interactive PowerShell shell |
re_register | Re-register with C2 (identity refresh or failover) |
Exfiltration: Command results and status data reported to /profile endpoint over the same HTTPS-mimicking channel.
Obfuscation inconsistency: XOR encoding (key 0xAB) applied only to anti-analysis strings. All RAT command names, file path strings, and JSON registration keys left in plaintext, providing a rich and reliable static detection surface.
Dynamic API resolution: LoadLibraryA and GetProcAddress used to resolve certain API imports at runtime, obscuring some functionality from basic static import analysis.
Code-signing certificate detail:
Field | Value |
|---|---|
Subject name | Donald Gay |
Issuer | Microsoft ID Verified CS AOC CA 02 |
Algorithm | sha384RSA |
Thumbprint | B674578D4BDB24CD58BF2DC884EAA658B7AA250C |
Serial | 33 00 07 9A 51 C7 06 3E 66 05 3D 22 9B 00 00 00 07 9A 51 |
Status | Time-invalid (revoked shortly after deployment) |
Attribution significance | Confirmed MuddyWater shared resource; previously used to sign Stagecomp/Darkcomp backdoor variants; paired with "Amy Cherne" identity in related Operation Olalampo activity |
CISA KEV CLUSTER: TECHNICAL DETAIL
CVE | Vulnerability Mechanism | Exploitation Impact |
|---|---|---|
CVE-2024-57726 | Missing authorization in SimpleHelp remote support software | Unauthorized access to all endpoints managed through the SimpleHelp platform |
CVE-2024-57728 | Path traversal in SimpleHelp | File system access beyond authorized boundaries; full technical impact not confirmed in consulted sources |
CVE-2024-7399 | Path traversal in Samsung MagicINFO 9 Server enabling arbitrary file write | File write as SYSTEM authority; potential for code execution via planted executables or configuration files |
CVE-2025-29635 | Command injection via HTTP POST to /goform/set_prohibiting on D-Link DIR-823X | Remote command execution on affected router; network pivot capability |
CVE-2026-41940 (CPANEL/WHM): TECHNICAL DETAIL
Vulnerability class: Described as critical in consulted sources. Exact vulnerability mechanism (injection, traversal, overflow, authentication bypass) not confirmed in consulted sources within this window.
Exploitation scale: Shadowserver estimates more than 550,000 internet-facing servers remain potentially exposed.
Post-exploitation observed: Website defacement, ransomware notes, file encryption associated with Sorry ransomware family.
Patch details: [NOT CONFIRMED IN CONSULTED SOURCES]. Treat as requiring immediate vendor advisory review.
GRASSMARLIN CVE-2026-6807: TECHNICAL DETAIL
Vulnerability class: Insufficiently hardened XML parsing enabling XML External Entity (XXE)-style attacks.
Trigger: User opens a crafted GrassMarlin session file received from an untrusted source.
Impact: Sensitive data disclosure from the analyst's system. Potential to exfiltrate network topology data, ICS device inventories, or other sensitive mapping artifacts produced by GrassMarlin.
Patch: None available. Tool is end-of-life since 2017.
Mitigation: Isolate from untrusted networks; do not open untrusted session files; consider decommissioning in favor of supported alternatives.
30 IOC AND INFRASTRUCTURE
All confirmed IOCs in this report originate from the MuddyWater / Chaos false-flag cluster and were published by Rapid7 on May 6, 2026. No IOCs have been published in consulted sources for CVE-2026-0300, CVE-2026-41940, the Papua New Guinea incident, the MediaWorks incident, or the Iranian OT probing advisory.
FILE HASHES (SHA-256):
Filename | Hash | Role |
|---|---|---|
ms_upd.exe | 24857fe82f454719cd18bcbe19b0cfa5387bee1022008b7f5f3a8be9f05e4d14 | Initial downloader |
DIDS.exe | a92d28f1d32e3a9ab7c3691f8bfca8f7586bb0666adbba47eab3e1a8faf7ecc0 | Alternative initial downloader (hunted variant) |
Game.exe | 1319d474d19eb386841732c728acf0c5fe64aa135101c6ceee1bd0369ecf97b6 | Custom RAT (primary) |
WebView2.exe | 3df9dcc45d2a3b1f639e40d47eceeafb229f6d9e7f0adcd8f1731af1563ffb90 | RAT variant (hunted) |
visualwincomp.txt | c86ab27100f2a2939ac0d4a8af511f0a1a8116ba856100aae03bc2ad6cb0f1e0 | AES-256-GCM encrypted C2 configuration |
WebView2Loader.dll | a47cd0dc12f0152d8f05b79e5c86bac9231f621db7b0e90a32f87b98b4e82f3a | Legitimate DLL used for sideloading |
dwagent.exe | cd098eddb23f2d2f6c42271ca82803b0d5ac950cb82a9b8ae0928e83945a53df | DWAgent remote management tool |
pythonw.exe (renamed) | cf3dfd1d6626fd2129abb7a5983c11827f4b0d497e2dba146a1889bd71f23cd5 | Renamed pythonw.exe used for proxy execution |
dwagsvc.exe | a3bac548b5bc91c526b4d6707623ddbd1a675aa952f0d1f9a0aa6f7230f09f23 | DWAgent service binary |
dwaglnc.exe | 86e0197389f0573eb83ff53991f337d416124c7c8bd727721ef3d396cd5f65d | DWAgent background component |
AnyDesk.exe | bfc1675ee1e358db8356f515aaded7962923e426aa0a0a1c0eddfc4dab053f89 | AnyDesk remote management tool |
NETWORK INDICATORS:
Type | Indicator | Role |
|---|---|---|
Domain | moonzonet[.]com | C2 for ms_upd.exe; /register and /check endpoints; linked to MuddyWater early 2026 |
Domain | uploadfiler[.]com | C2 for Game.exe RAT; /home and /index.php endpoints; port 443 |
Domain | adm-pulse[.]com | Quick Assist impersonation phishing infrastructure |
IP Address | 172.86.126[.]208 | Hosts ms_upd.exe download; port 443 |
IP Address | 77.110.107[.]235 | Source IP of malicious Teams activity |
IP Address | 93.123.39[.]127 | Source IP of malicious Teams activity |
IP Address | 116.203.208[.]186 | IP contacted by renamed pythonw.exe |
URL | hxxps://adm-pulse[.]com/verify.php | Credential harvesting page impersonating Quick Assist |
ONION ADDRESS (do not access):
hptqq2o2qjva7lcaaq67w36jihzivkaitkexorauw7b2yul2z6zozpqd[.]onion — Chaos RaaS dark leak site negotiation address
CERTIFICATE:
Field | Value |
|---|---|
Subject | Donald Gay |
Issuer | Microsoft ID Verified CS AOC CA 02 |
Thumbprint | B674578D4BDB24CD58BF2DC884EAA658B7AA250C |
Status | Time-invalid; revoked |
Significance | Confirmed MuddyWater shared resource; primary attribution anchor |
INFRASTRUCTURE BEHAVIORAL PATTERNS:
Game.exe C2 beaconing interval: 60-second polling to /index.php. Low-frequency, low-noise pattern designed to avoid anomaly-based detection thresholds.
All C2 communication runs over port 443 mimicking HTTPS to blend with normal enterprise web traffic.
Teams source IPs represent attacker-controlled accounts or infrastructure used to initiate external chat sessions; not necessarily static infrastructure.
adm-pulse[.]com mimics a legitimate Quick Assist authentication interface. Credential input is interactively guided during a live screen-sharing session, reducing victim suspicion.
moonzonet[.]com and uploadfiler[.]com represent two distinct C2 tiers: staging and RAT operations respectively, providing operational separation between dropper and post-compromise activity.
Initial access via Teams social engineering (T1566):
Alert on Microsoft Teams external chat sessions from outside-tenant accounts that progress to screen-sharing. Most organizations have no legitimate use case for an external party initiating a screen-share via Teams external chat.
Monitor for creation of files named credentials.txt or cred.txt in user Desktop, Documents, or Downloads paths. The attacker explicitly instructs victims to create these files during the screen-sharing session.
Alert on MFA device enrollment events that occur within 60 minutes of a Teams external chat session being active on the same account. Attacker manipulates MFA interactively during the session.
Monitor browser navigation to domains impersonating remote support tools. Alert on access to adm-pulse[.]com or similar Quick Assist-themed domains.
Payload staging and delivery (T1105):
Alert on curl.exe or any curl binary executing with an output path in C:\ProgramData\ and a remote target on port 443 that is not a known corporate destination.
Alert on cmd.exe executing a self-delete pattern: ping 127.0.0.1 combined with del /f /q in the same command line. This is the ms_upd.exe self-deletion mechanism and is not common in legitimate software.
Persistence via remote management tools (T1219, T1543):
Alert on installation of DWAgent service (dwagsvc.exe) from any path containing ProgramData. Legitimate DWAgent deployments managed by IT will originate from a known software distribution path.
Alert on AnyDesk installations on endpoints where AnyDesk is not on the approved remote tool inventory.
Alert on pythonw.exe executing from C:\ProgramData\ or from any directory created within the previous 24 hours.
Game.exe RAT (T1071, T1573, T1497):
Alert on any process creating the mutex ATTRIBUTES_ObjectKernel. This is the Game.exe single-instance enforcement mutex and has no known legitimate use.
Alert on WebView2.exe or WebView2APISample.exe executing from any path outside C:\Program Files\Microsoft\EdgeWebView.
Alert on periodic outbound connections at approximately 60-second intervals to external IPs on port 443 from non-browser processes.
Hunt for visualwincomp.txt in any C:\ProgramData\visualwincomp-[random]\ directory. Any match is a confirmed Game.exe RAT deployment.
Credential manipulation (T1056, T1556):
Alert on MFA device additions not initiated via IT helpdesk ticketing system or provisioning workflow.
Require manager or secondary approval for all MFA device changes on privileged accounts.
Alert on RDP connections from standard user workstations directly to Domain Controllers.
DETECTION OPPORTUNITIES: CVE-2026-0300 (PAN-OS)
Monitor PAN-OS system logs for crash events, unexpected service restarts, or authentication portal errors with abnormal frequency. These may indicate active exploitation attempts against the Captive Portal service.
Alert on unexpected outbound connections originating from PAN-OS management interfaces or data-plane IPs following any anomalous portal activity. Post-compromise behavior on a rooted firewall may include new SSH keys, modified routing tables, or unexpected outbound C2 sessions.
If Panorama is deployed, alert on unauthorized configuration changes including new administrator account additions or SSH key imports.
Alert on unexpected inbound connections to the Captive Portal service port from external or untrusted IP ranges.
DETECTION OPPORTUNITIES: CVE-2026-41940 (CPANEL/WHM)
Monitor for unauthorized administrative account creation or privilege escalation within cPanel/WHM administrative interfaces.
Alert on new or modified cron jobs and scheduled tasks on cPanel-managed servers, particularly those referencing external download URLs or shell execution.
Monitor web-accessible directories for new or recently modified PHP files that may represent webshell deployments.
Alert on unexpected outbound connections from web server processes to external IPs, particularly on non-standard ports.
DETECTION OPPORTUNITIES: IRANIAN OT PROBING
Cross-reference CISA advisory IOCs for Iranian OT activity against PLC access logs, historian connection records, and OT network flow data going back 30 days.
Alert on any direct internet-initiated connections to Rockwell/Allen-Bradley PLCs or other OT devices that should not be internet-accessible.
Monitor for unexpected firmware query commands or configuration read operations on PLC assets outside of known maintenance windows.
THREAT HUNTING HYPOTHESES
Hypothesis | Evidence Target | Priority |
|---|---|---|
Any endpoint with visualwincomp.txt in C:\ProgramData\visualwincomp-\ is compromised by Game.exe | File system hunt across all managed endpoints | Critical |
Any process with active mutex ATTRIBUTES_ObjectKernel is running Game.exe | Active process and handle telemetry from EDR | Critical |
Any DNS resolution of moonzonet[.]com or uploadfiler[.]com in the past 90 days indicates host compromise or reconnaissance | DNS query history from DNS server logs, proxy logs, or EDR telemetry | Critical |
Any DWAgent service installation in C:\ProgramData\ not originating from IT management tooling indicates unauthorized persistence | Service installation logs (Event ID 7045) correlated with software inventory | High |
Any PAN-OS device with inbound connections to the Captive Portal from external IPs in the past seven days may have been targeted | PAN-OS system logs and netflow data | High |
Any cPanel/WHM server with new PHP files in web-accessible directories created after May 1, 2026 should be investigated for webshell deployment | File integrity monitoring and web server logs | High |
DATA SOURCE REQUIREMENTS
Detection Layer | Required Data Sources |
|---|---|
Teams social engineering | Microsoft 365 audit log (Teams activity), Microsoft Entra ID MFA enrollment events |
Payload delivery and staging | EDR process telemetry (Sysmon Event IDs 1, 3, 11), Windows Event Logs |
RAT detection | EDR handle and mutex telemetry, file integrity monitoring, DNS/proxy logs |
Network C2 detection | DNS query logs, proxy logs, netflow, firewall outbound connection logs |
PAN-OS exploitation | PAN-OS system logs forwarded to SIEM, Panorama audit trail, netflow |
cPanel/WHM compromise | Web server access logs, file integrity monitoring, cron job audit logs |
OT/ICS probing | OT network flow data, PLC access logs, historian connection records |
DETECTION GAPS
Microsoft Teams external chat visibility requires Microsoft 365 audit logging to be enabled. This is not enabled by default in all organizational configurations. Validate before assuming coverage.
DWAgent and AnyDesk are legitimate tools. Behavioral context (installation path, installer source, service registration method) is essential to reduce false positives. Pure hash-based blocking will generate noise in environments that legitimately use these tools.
Game.exe sandbox evasion checks mean that automated sandboxing environments running virtual hardware may fail to detonate the sample fully. Bare-metal or hardware-passthrough analysis environments are recommended.
CVE-2026-0300 exploitation leaves no confirmed forensic artifact in consulted sources. Detection relies entirely on anomaly-based signals from PAN-OS system logs and netflow, which may be noisy without a reliable baseline.
SIEM DETECTION RULES (PSEUDOCODE — ADAPT FIELD NAMES TO YOUR PLATFORM BEFORE DEPLOYMENT)
YARA RULES (FOR GAME.EXE RAT DETECTION)
ENDPOINT DETECTION RULES (BEHAVIORAL — EDR PSEUDOCODE)
ATT&CK TECHNIQUE NARRATIVE (SOURCE-CONFIRMED, MUDDYWATER / CHAOS CLUSTER)
T1566 — PHISHING VIA SERVICE (INITIAL ACCESS)
The threat actor used Microsoft Teams external chat as the delivery mechanism for social engineering, bypassing email-based phishing controls entirely. One-on-one chat sessions were initiated from attacker-controlled out-of-tenant accounts, and screen-sharing was established to enable interactive credential harvesting. This technique exploits the implicit trust users place in internal collaboration platforms when they receive messages that appear to originate from a plausible external business contact.
Detection basis: Teams external chat audit logs, MFA enrollment event correlation.
T1056 — INPUT CAPTURE (CREDENTIAL ACCESS)
Rather than deploying a keylogger, the threat actor used a social engineering approach to instruct victims to manually type credentials into locally created text files during active screen-sharing sessions. Browser navigation to adm-pulse[.]com/verify.php served as a supplementary credential harvest mechanism, impersonating the Quick Assist authentication interface.
Detection basis: File creation monitoring for credential-named files; browser proxy logs for Quick Assist-impersonating domains.
T1556 — MODIFY AUTHENTICATION PROCESS (CREDENTIAL ACCESS / DEFENSE EVASION)
MFA configurations were manipulated interactively during the Teams screen-sharing session. The attacker guided victims through adding an attacker-controlled device as an approved MFA factor, creating a persistent authentication pathway that survives password resets and standard remediation steps. This is a critical post-access persistence mechanism that is frequently missed in ransomware-framed IR engagements.
Detection basis: Entra ID MFA device enrollment events correlated with Teams external chat activity; secondary approval requirements for MFA device changes on privileged accounts.
T1078 — VALID ACCOUNTS (INITIAL ACCESS / PERSISTENCE / DEFENSE EVASION)
Harvested credentials including Domain Controller access credentials were used to authenticate to internal systems, establishing a legitimate-looking access footprint that is difficult to distinguish from authorized user activity without behavioral baselining. The attacker also added their own device to victim MFA, creating a second valid authentication pathway for the compromised identity.
Detection basis: First-use of credentials from unrecognized device fingerprints; impossible travel alerts; RDP access from user workstations to Domain Controllers.
T1543 — CREATE OR MODIFY SYSTEM PROCESS (PERSISTENCE)
DWAgent was installed as a Windows service (dwagsvc.exe), providing persistent remote access that survives endpoint reboots and user logoff. Legitimate service registration makes this persistence mechanism blend with authorized software in environments that use remote management tools, requiring behavioral context for reliable detection.
Detection basis: Windows Event ID 7045 for service installation; path-based filtering for C:\ProgramData\ installations.
T1105 — INGRESS TOOL TRANSFER (COMMAND AND CONTROL)
curl was used to stage ms_upd.exe from 172.86.126[.]208:443 in the first transfer stage. ms_upd.exe then independently downloaded Game.dll, Game.exe, and visualwincomp.txt from moonzonet[.]com in the second stage. This two-stage transfer pattern separates the initial downloader infrastructure from the RAT delivery infrastructure, providing operational compartmentalization.
Detection basis: curl execution with ProgramData output path; outbound connections from ms_upd.exe to moonzonet[.]com; DNS resolution monitoring for C2 domains.
T1219 — REMOTE ACCESS TOOLS (COMMAND AND CONTROL)
DWAgent and AnyDesk were deployed as dual-redundant remote access channels. Using legitimate remote management software as C2 provides significant detection evasion because the traffic is signed, uses standard protocols, and is often whitelisted at the network perimeter. The presence of both tools simultaneously, outside of an IT-managed deployment, is a strong compromise indicator.
Detection basis: Process execution from non-IT parent; installation path anomaly; remote management tool inventory enforcement via EDR.
T1027 — OBFUSCATED FILES OR INFORMATION (DEFENSE EVASION)
The Game.exe configuration file (visualwincomp.txt) is AES-256-GCM encrypted at rest, decrypted only at runtime. Anti-analysis strings within the binary are XOR-encoded with key 0xAB. Critically, the core RAT command strings, file paths, and C2 JSON structures are left in plaintext, creating a significant static detection surface that partially undermines the obfuscation effort. This inconsistency is a tradecraft gap attributable to developer inexperience.
Detection basis: YARA rules targeting plaintext RAT command strings (see Detection Rules field); file integrity monitoring for AES-encrypted configuration files in randomized ProgramData directories.
T1497 — VIRTUALIZATION AND SANDBOX EVASION (DEFENSE EVASION)
Game.exe implements a multi-layer evasion stack: sandbox DLL presence checks, VM CPU keyword detection via CPUID, and sleep-based timing checks to detect time-acceleration in automated analysis environments. Combined, these checks will cause the binary to terminate silently in many automated sandbox environments, producing no behavioral telemetry.
Detection basis: Bare-metal or hardware-passthrough detonation required for reliable dynamic analysis. Static YARA detection is the primary reliable signal.
T1021.001 — REMOTE DESKTOP PROTOCOL (LATERAL MOVEMENT)
RDP sessions were used to move between systems following initial credential compromise, including to Domain Controllers. This is the standard lateral movement vector in credential-harvesting-led intrusions and is expected to continue after initial compromise as the attacker maps and accesses high-value internal targets.
Detection basis: RDP connections from standard user workstations to Domain Controllers; RDP session initiation outside normal business hours or from unexpected source hosts.
T1041 — EXFILTRATION OVER C2 CHANNEL (EXFILTRATION)
Data was exfiltrated via the Game.exe RAT C2 channel to uploadfiler[.]com:443, using the /profile endpoint. Exfiltration over an established encrypted C2 channel is difficult to distinguish from normal HTTPS traffic without deep packet inspection or process-level network monitoring.
Detection basis: Outbound data volume anomaly from non-browser processes to uploadfiler[.]com; process-level network connection monitoring via EDR.
ATT&CK TECHNIQUE NOTES FOR NON-CONFIRMED CLUSTERS
CVE-2026-0300 (PAN-OS): T1190 (Exploit Public-Facing Application) is behaviorally consistent but not confirmed in the Palo Alto Networks security advisory. No post-exploitation techniques are confirmed in consulted sources. Stated as behavioral inference only.
CVE-2026-41940 (cPanel/WHM): No MITRE technique IDs confirmed in consulted sources. T1190 is behaviorally consistent with mass exploitation of an internet-facing service. T1505.003 (Server Software Component: Web Shell) is consistent with observed webshell-like post-exploitation behavior reported by BleepingComputer. Both stated as behavioral inferences only, not source-confirmed.
All other clusters: [NOT CONFIRMED IN CONSULTED SOURCES]
MITRE D3FEND COUNTERMEASURE MAPPING
The following D3FEND defensive techniques are mapped to the confirmed ATT&CK techniques above. Mappings are source-informed where D3FEND published guidance aligns with the specific TTPs; all are noted where they represent recommended defensive practice derived from behavioral analysis.
ATT&CK Technique | D3FEND Countermeasure | D3FEND ID | Application |
|---|---|---|---|
T1566 (Phishing via Service) | Platform Monitoring | D3-PM | Monitor Microsoft Teams for external chat sessions initiating screen-sharing from out-of-tenant accounts |
T1566 (Phishing via Service) | User Behavior Analysis | D3-UBA | Detect anomalous collaboration platform usage patterns deviating from user baseline |
T1056 (Input Capture) | File System Monitoring | D3-FSM | Alert on creation of credential-named files in user directories |
T1556 (Modify Authentication Process) | Multi-Factor Authentication | D3-MFA | Enforce secondary approval for MFA device enrollment on privileged accounts |
T1556 (Modify Authentication Process) | Credential Hardening | D3-CH | Require MFA re-enrollment only through secure, IT-controlled provisioning workflows |
T1078 (Valid Accounts) | Authentication Event Thresholding | D3-ANET | Alert on first-use of valid credentials from unrecognized device fingerprints |
T1078 (Valid Accounts) | User Behavior Analysis | D3-UBA | Detect impossible travel and anomalous authentication time/location patterns |
T1543 (Create or Modify System Process) | Process Spawn Analysis | D3-PSA | Alert on service installation events from non-standard paths and non-IT parent processes |
T1105 (Ingress Tool Transfer) | Network Traffic Filtering | D3-NTF | Block outbound connections from endpoints to non-whitelisted external IPs on port 443 via EDR or firewall policy |
T1105 (Ingress Tool Transfer) | File Carving | D3-FC | Monitor for executable files dropped into C:\ProgramData\ from network-sourced curl transfers |
T1219 (Remote Access Tools) | Software Allowlisting | D3-SAL | Enforce application allowlist; block execution of any remote management tool not on approved inventory |
T1219 (Remote Access Tools) | Network Traffic Filtering | D3-NTF | Block or alert on outbound connections from known remote management tool binaries to non-corporate destinations |
T1027 (Obfuscated Files) | File Analysis | D3-FA | Deploy YARA-based static detection for Game.exe plaintext command strings (see Detection Rules field) |
T1497 (Sandbox Evasion) | Dynamic Analysis | D3-DA | Use bare-metal or hardware-passthrough detonation environments to defeat VM and timing-based evasion checks |
T1021.001 (RDP Lateral Movement) | Remote Terminal Session Detection | D3-RTSD | Alert on RDP sessions from user workstations to Domain Controllers; restrict RDP to jump hosts only |
T1041 (Exfiltration Over C2) | Outbound Traffic Filtering | D3-OTF | Monitor and alert on large outbound data transfers from non-browser processes over port 443 |
T1041 (Exfiltration Over C2) | Protocol Analysis | D3-PA | Inspect process-level network connections for periodic low-volume polling patterns consistent with C2 beaconing |
T1190 (Exploit Public-Facing Application — inferred, CVE-2026-0300) | Application Hardening | D3-AH | Disable or restrict internet-facing PAN-OS Captive Portal to trusted internal IPs only |
T1190 (Exploit Public-Facing Application — inferred, CVE-2026-0300) | Network Segmentation | D3-NS | Ensure Captive Portal service is not reachable from untrusted or internet-facing network zones |
Chapter 05 - Governance, Risk & Compliance
CVE-2026-0300 (PAN-OS): REGULATORY AND BUSINESS RISK
Regulatory exposure:
Any organization that has suffered exploitation and consequent unauthorized access to network traffic or internal systems may face breach notification obligations under applicable frameworks.
GDPR Article 33: 72-hour notification to supervisory Data Protection Authority required for personal data breaches with risk to individuals.
NIS2 Directive (EU): Significant incident reporting required within 24 hours of awareness for operators of essential services.
DPDP Act 2023 (India): Breach notification obligation to the Data Protection Board of India upon becoming aware of a personal data breach.
HIPAA (US healthcare): Breach notification for PHI exposure regardless of whether data was extracted.
PCI-DSS: Compromised network environments processing cardholder data trigger mandatory reporting obligations.
Note: Regulatory obligations are triggered by unauthorized access, not only confirmed data extraction. A root-level firewall compromise is sufficient to initiate breach assessment processes in most jurisdictions.
Business risk:
Operational risk: Root compromise of a perimeter firewall grants an attacker full visibility and control over network traffic. Network segmentation, traffic inspection, and access control policies are all bypassed from the firewall's own perspective.
Reputational risk: No confirmed breach published in consulted sources at report date. Risk is current and escalating as exploitation activity is described as limited but active, with awareness widening rapidly.
Financial risk: [INSUFFICIENT SOURCE DATA — no cost or fine estimates in consulted sources.] Note: GDPR fines for unreported breaches can reach 10 million euros or 2 percent of global annual turnover under Article 83(4), whichever is higher.
CISO risk decision: ESCALATE immediately. The combination of CVSS 9.3, confirmed active exploitation, and zero available patch creates a maximum-urgency risk posture for any organization with internet-exposed PAN-OS Captive Portal instances.
MUDDYWATER / CHAOS: REGULATORY AND BUSINESS RISK
Regulatory exposure:
Data exfiltration is confirmed in this incident. A victim confirmed that leaked data was legitimate per the Rapid7 report. This triggers breach notification obligations regardless of whether ransomware encryption occurred.
GDPR, NIS2, DPDP, HIPAA, and PCI-DSS obligations apply depending on the organization's sector and jurisdiction, consistent with the analysis above.
Organizations in the US construction, manufacturing, and business services sectors (primary Chaos victim profile) should review sector-specific reporting obligations under CISA voluntary reporting frameworks and any applicable state-level breach notification laws.
Note: Iranian state-sponsored attribution, if confirmed, may trigger additional obligations under US executive orders on state-sponsored cyberattacks and OFAC sanctions considerations for ransom payments.
Business risk:
The primary risk is the persistence of an undetected APT-level foothold. Organizations that concluded remediation after removing ransomware artifacts without hunting for DWAgent, AnyDesk, and Game.exe may have active state-level access to their networks right now.
Media-facing risk: Chaos DLS listings are public. Any organization listed may face media and client inquiries regardless of whether they engage with the threat actor.
Supply chain risk: Organizations that share network access with, or provide managed services to, Chaos-listed victims should assess whether lateral movement may have extended beyond the primary victim's perimeter.
CISO risk decision: Any 2026 Chaos ransomware engagement must be re-classified as a suspected state-sponsored espionage operation until ruled out. Treat as IR-priority-one.
CISA KEV CLUSTER: REGULATORY AND BUSINESS RISK
Federal Civilian Executive Branch agencies are under a legally binding remediation obligation expiring May 8, 2026 for all four KEV-listed CVEs. Non-compliance is an audit and oversight risk.
For all other organizations: CISA's guidance explicitly extends the urgency of KEV listings to the private sector as best-practice remediation prioritization. Board-level risk reporting should reflect outstanding KEV items as unacceptable residual risk.
D-Link DIR-823X discontinuation: Continued operation of an end-of-life device with a KEV-listed vulnerability after the deadline constitutes a known and accepted risk that should be formally documented in the organization's risk register if discontinuation is not immediately feasible.
STRATEGIC GOVERNANCE IMPLICATIONS
Boards and executive teams should be briefed on the compressed time-to-exploit environment. A 24 to 48-hour window from CVE disclosure to active exploitation leaves no room for standard monthly patching cycles for critical internet-facing vulnerabilities.
The MuddyWater false-flag operation demonstrates that nation-state actors are deliberately exploiting ransomware incident response playbooks as cover. IR playbooks should be updated to include a state-sponsored false-flag assessment checkpoint before concluding any ransomware engagement.
Organizations with dependencies on third-party service providers using SimpleHelp, cPanel/WHM, or Samsung MagicINFO should seek immediate written assurance of remediation status for KEV-listed and mass-exploited CVEs and document residual risk where timelines do not align with internal standards.
Media and judicial sector organizations should review breach notification playbooks, legal consultation processes, and stakeholder communication strategies specifically for data exfiltration scenarios where no encryption occurs, as these may not be covered by existing ransomware-specific IR plans.
Chapter 06 - Adversary Emulation
PURPOSE: The following emulation guidance is intended for authorized red team and purple team exercises only. All activities must be conducted under formal rules of engagement, within isolated or approved test environments, and with explicit written authorization from asset owners.
EMULATION SCENARIO 1: MUDDYWATER TEAMS-BASED SOCIAL ENGINEERING AND RAT DEPLOYMENT
Objective: Test detection coverage for Teams-based social engineering, credential file creation, MFA manipulation, curl-based payload staging, and Game.exe RAT persistence.
Phase 1 — Initial Access Simulation:
Simulate a Microsoft Teams external chat message request to a test user account from an out-of-tenant test account.
During a screen-sharing session with the test account, instruct the simulated victim to create a file named credentials.txt on the Desktop.
Attempt to enroll a new MFA device on the test account while the simulated Teams session is active.
Expected detections: File creation alert for credentials.txt; MFA enrollment alert correlated with Teams external chat session.
Phase 2 — Payload Staging Simulation:
From a test endpoint, execute curl.exe with a target URL on port 443 pointing to an internal test server, with output path set to C:\ProgramData\ms_upd_test.exe.
Follow with a cmd.exe command executing ping 127.0.0.1 -n 6 followed by del /f /q targeting the test file.
Expected detections: curl staging alert; self-delete dropper pattern alert.
Phase 3 — Persistence Simulation:
Install DWAgent on a test endpoint from a C:\ProgramData\ path using a non-IT management process as parent.
Register DWAgent as a Windows service (dwagsvc.exe).
Expected detections: Service install alert for DWAgent from non-standard path; EDR alert for non-IT parent process installing remote management tool.
Phase 4 — RAT Behavior Simulation:
Create a mutex named ATTRIBUTES_ObjectKernel on a test endpoint using a test process.
Create a file named visualwincomp.txt in a C:\ProgramData\visualwincomp-test\ directory.
Spawn cmd.exe and PowerShell as child processes of a test parent process mimicking Game.exe behavior.
Establish a periodic outbound connection at 60-second intervals to a test C2 listener on port 443 from a non-browser process.
Expected detections: Mutex alert; file creation alert in randomized ProgramData subdirectory; shell spawning alert; periodic beaconing alert.
Detection validation checklist:
Simulated TTP | MITRE Technique | Expected Alert | Pass/Fail |
|---|---|---|---|
credentials.txt creation during Teams session | T1056 | File creation alert | |
MFA device enrollment during Teams session | T1556 | Correlated MFA alert | |
curl staging to ProgramData on port 443 | T1105 | curl staging alert | |
Ping-delay self-delete pattern | T1070.004 | Self-deleting dropper alert | |
DWAgent service install from ProgramData | T1543 | Service install alert | |
ATTRIBUTES_ObjectKernel mutex creation | T1071 behavioral | Mutex alert | |
visualwincomp.txt in randomized ProgramData path | T1027 | File integrity alert | |
60-second periodic beaconing from non-browser | T1071 | Beaconing alert | |
cmd.exe/PowerShell spawned from RAT parent | T1059 | Shell spawn alert |
EMULATION SCENARIO 2: CVE-2026-0300 CAPTIVE PORTAL EXPLOITATION SIMULATION
Objective: Test detection coverage for anomalous inbound connections to the PAN-OS Captive Portal service and post-compromise behavior indicators.
Note: Do not attempt to replicate the actual buffer overflow. The following simulates the detection surface, not the exploit itself.
Phase 1 — Reconnaissance Simulation:
Generate anomalous inbound connections from an external test IP to the Captive Portal service port on a test or staging PAN-OS device.
Introduce repeated connection attempts with malformed or oversized HTTP headers to simulate probe activity.
Expected detections: PAN-OS system log anomaly alert; anomalous inbound connection alert from external IP to Captive Portal endpoint.
Phase 2 — Post-Compromise Behavior Simulation (assume root compromise):
Simulate unexpected outbound connections from the firewall management IP to an external test IP on a non-standard port.
Simulate addition of a new administrator account in PAN-OS configuration (in an isolated test environment only).
Expected detections: Unexpected outbound connection from PAN-OS management IP; unauthorized configuration change alert in Panorama or SIEM.
Detection validation checklist:
Simulated TTP | Expected Alert | Pass/Fail |
|---|---|---|
Anomalous inbound connections to Captive Portal | PAN-OS system log anomaly alert | |
Unexpected outbound from firewall management IP | Outbound connection alert from network device | |
New administrator account added to PAN-OS | Panorama or SIEM configuration change alert |
EMULATION SCENARIO 3: CPANEL/WHM POST-EXPLOITATION SIMULATION
Objective: Test detection coverage for unauthorized actions consistent with CVE-2026-41940 post-exploitation activity.
Phase 1 — Post-Exploitation Behavior Simulation:
Create a new PHP file in a web-accessible directory on a test cPanel server.
Add a new cron job referencing an external download URL on a test cPanel account.
Create a new administrative account via the cPanel/WHM administrative interface from an out-of-hours or unexpected source IP.
Expected detections: File integrity alert for new PHP file in web directory; cron job alert referencing external URL; administrative account creation alert.
Detection validation checklist:
Simulated TTP | Expected Alert |
|---|---|
New PHP file in web-accessible directory | File integrity monitoring alert |
Cron job referencing external URL | Cron job audit alert |
New admin account from unexpected source IP | Administrative account creation alert |