Inferlume

CVE-2026-41940: cPanel and WHM Authentication Bypass, Detection Intelligence

Detection engineering opportunities:

• Monitor cPanel and WHM HTTP access logs and authentication logs for patterns consistent with exploitation attempts: repeated failed authentication requests from the same source IP followed immediately by a successful authenticated session without an intervening password change event, particularly for sessions originating from IPs with no prior authentication history on the system.

• Enable file-integrity monitoring over cPanel session storage directories to flag unexpected write patterns, malformed file content, or session files containing raw unsanitized credential-like strings inconsistent with normal encrypted session file format.

• Monitor for new administrator or reseller account creation events within cPanel and WHM that are not traceable to approved change requests, particularly accounts created since approximately February 23, 2026.

• Monitor hosted domains for unexpected file creation events consistent with web shell installation (for example, PHP files in web roots that postdate the last legitimate deployment event).

• Monitor for correlated spikes in outbound spam or phishing-originated mail from domains hosted on cPanel servers, which may indicate post-exploitation abuse of mail server configurations.

Detection context and data requirements:

• Required log sources: cPanel and WHM HTTP access logs, authentication logs, OS-level file activity logs for session storage directories, network telemetry for management ports.

• Detection gap: Many shared hosting environments have limited visibility into underlying file systems and management logs. Customers relying on third-party hosting providers will need to depend on provider-driven telemetry and attestation to detect abuse and should require written confirmation of monitoring coverage.

Threat hunting hypotheses:

• Hunt this week: Search for new or modified cPanel accounts with administrative or reseller privileges created since February 2026 that are not linked to approved change requests. Exploitation grants attackers the ability to create persistent privileged accounts that survive patching.

• Hunt this week: For cPanel environments that also manage email infrastructure, search for correlated increases in outbound mail volume, spam bounce rates, or phishing campaign traces originating from hosted domains, which may indicate post-exploitation mail server abuse.

Immediate detection actions, within twenty-four hours:

• Enable and centralize logging from all cPanel and WHM instances into the SIEM if not already in place.

• Deploy basic correlation rules for suspicious authentication sequences (repeated failed login followed by immediate success without password change) and for new privileged account creation events.

SIGMA pseudocode (cPanel authentication anomaly):

title: cPanel Authentication Bypass Pattern - Repeated Failure Then Immediate Success
logsource:
  product: cpanel
  category: authentication
detection:
  failed_login:
    EventType: "FAILED"
    SourceIP|expand: "%src_ip%"
  success_after_failure:
    EventType: "SUCCESS"
    SourceIP|expand: "%src_ip%"
    timeframe: within 60s of failed_login
  filter_password_change:
    EventType: "PASSWORD_CHANGE"
    SourceIP|expand: "%src_ip%"
  condition: failed_login and success_after_failure and not filter_password_change
falsepositives:
  - Legitimate user mistyping password then correcting immediately
level: medium
tags:
  - CVE-2026-41940
  - attack.initial_access
  - attack.T1190

SIGMA pseudocode (cPanel new privileged account creation):

title: cPanel Unauthorized Privileged Account Creation
logsource:
  product: cpanel
  category: account_management
detection:
  selection:
    EventType: "ACCOUNT_CREATE"
    PrivilegeLevel|contains:
      - "admin"
      - "reseller"
      - "root"
    Timestamp|gte: "2026-02-23T00:00:00Z"
  filter_approved:
    ChangeTicketID: "*"
  condition: selection and not filter_approved
falsepositives:
  - Legitimate untracked admin account provisioning
level: high
tags:
  - CVE-2026-41940
  - attack.persistence
  - attack.T1078

JDownloader Python RAT Installers, Detection Intelligence

Detection engineering opportunities:

• On Windows endpoints, monitor for processes spawned by a JDownloader installer process that load Python runtimes (python.exe, pythonw.exe) or execute Python scripts from unusual working directories outside of standard Python installation paths, consistent with the loader deploying a Python-based RAT.

• Monitor for outbound network connections from endpoints known to have JDownloader installed, particularly connections to domains or IP addresses not consistent with the legitimate JDownloader update infrastructure (mirror.downloadatlas.com and similar known-good update endpoints).

• On Linux systems, detect creation of new SUID-root binaries (files with SUID bit set owned by root created after baseline) and suspicious script additions or modifications within /etc/profile.d or similar persistence directories.

• Monitor for Python interpreter invocations executing heavily obfuscated or base64-encoded payloads from command line arguments, consistent with obfuscated RAT execution.

Detection context and data requirements:

• Required sources: EDR or AV with process command line capture, module load events, and file system change monitoring on endpoints; network telemetry capturing DNS and outbound connection events from JDownloader-associated hosts.

• Detection gap: Heavily obfuscated Python RAT payloads may evade signature-based detection initially. Behavioral detection based on process ancestry (JDownloader installer spawning Python runtime) is more reliable than static signature matching for this threat.

Threat hunting hypotheses:

• Hunt this week: Search endpoint telemetry for any Python process execution event where the parent process chain includes a JDownloader installer executable invoked between May 6 and 7, 2026. Any such chain should be treated as a confirmed RAT deployment.

• Hunt this week: On Linux systems, enumerate all SUID-root binaries created after May 5, 2026 and cross-reference against known-good baseline. Any unexplained new SUID-root binary warrants immediate investigation.

Immediate detection actions, within twenty-four hours:

• Query EDR for JDownloader installer process hashes executed between May 6 and 7, 2026 and flag any hosts for triage.

• Create an alert for Python process execution with a JDownloader-related parent process on Windows endpoints.

SIGMA pseudocode (JDownloader spawning Python RAT on Windows):

title: JDownloader Installer Spawning Python Process - Possible RAT Deployment
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|contains:
      - "JDownloader"
      - "jd-installer"
      - "jdownloader-setup"
    Image|endswith:
      - "\\python.exe"
      - "\\pythonw.exe"
  condition: selection
falsepositives:
  - Legitimate JDownloader Python dependency invocation (low likelihood given RAT context)
level: high
tags:
  - attack.execution
  - attack.T1059.006
  - supply_chain_compromise

YARA pattern (Python RAT loader behavior, conceptual):

rule JDownloader_Python_RAT_Loader {
  meta:
    description = "Detects obfuscated Python RAT loader consistent with JDownloader supply chain compromise"
    reference = "BleepingComputer JDownloader incident analysis May 2026"
    date = "2026-05-12"
  strings:
    $obf1 = "exec(compile(" nocase
    $obf2 = "__import__('base64')" nocase
    $obf3 = "marshal.loads" nocase
    $obf4 = "zlib.decompress" nocase
    $python_magic = { 4D 61 67 69 63 4E 75 6D }
  condition:
    2 of ($obf1, $obf2, $obf3, $obf4) or $python_magic
}

Linux SUID detection shell command (for threat hunting):

find / -perm -4000 -user root -type f -newer /var/log/dpkg.log 2>/dev/null
# Flags any SUID-root binary created more recently than the last package
# manager activity, surfacing post-compromise implant files
# Adjust reference file timestamp to pre-incident baseline as

CVE-2026-0300: PAN-OS Captive Portal Zero-Day, Detection Intelligence

Detection engineering opportunities:

• Monitor PAN-OS system logs for nginx worker process crash events or unexpected restarts, which may indicate failed or successful memory corruption exploitation attempts against the Captive Portal service.

• Monitor PAN-OS authentication and system logs for administrator account creation or SSH key addition or modification events outside approved change management windows.

• Enable and monitor Threat ID 510019 detection events on all PAN-OS 11.1 and later devices with Advanced Threat Prevention content version at or above 9097-10022.

• Monitor for outbound network connections initiated from PAN-OS device management or data-plane IPs to external destinations not in the approved set of update servers, telemetry endpoints, syslog destinations, or licensed service infrastructure.

• Monitor for firewall configuration change events that are not associated with an authenticated administrator session in the change management system.

Detection context and data requirements:

• Required sources: PAN-OS system logs (system, configuration, authentication, threat), network flow or NetFlow data for firewall-originated sessions, SIEM integration for configuration drift alerting.

• Detection gap: PAN-OS 10.2 devices have no Threat ID 510019 signature available and remain dependent on network-level behavioral detection and log analysis until patched. Post-exploitation modification of firewall configuration can suppress further syslog output from the device, potentially silencing downstream alerting.

Threat hunting hypotheses:

• Hunt this week: Any PA-Series or VM-Series firewall that had an internet-accessible Captive Portal between April 9 and May 5, 2026 should be treated as a priority hunt target. Pull PAN-OS system logs for the full window and search for nginx crashes, unscheduled admin account changes, SSH key modifications, and any firewall-originated outbound TCP connections to external IPs outside approved infrastructure.

• Hunt this week: Search NetFlow or IPFIX records for outbound sessions originating from firewall management or data-plane IPs to non-approved external destinations, particularly on uncommon ports consistent with tunneling tool behavior.

Immediate detection actions, within twenty-four hours:

• Enable Threat ID 510019 on all eligible PAN-OS 11.1 and later devices immediately.

• Create SIEM alerting rule for administrator account creation or SSH key modification on PAN-OS devices outside scheduled change management windows.

• Pull and review the last thirty days of PAN-OS system logs for all internet-exposed devices before beginning patch deployment.

SIGMA pseudocode (PAN-OS post-exploitation configuration change):

title: PAN-OS Anomalous Configuration Change Outside Change Window
logsource:
  product: paloalto
  category: system
detection:
  selection:
    EventType|contains:
      - "config_change"
      - "admin_account_create"
      - "ssh_key_add"
      - "ssh_key_modify"
  filter_approved:
    AdminUser|expand: "%approved_admin_list%"
    Timestamp|within: approved_change_window
  condition: selection and not filter_approved
falsepositives:
  - Emergency out-of-band changes by authorized administrators
level: high
tags:
  - CVE-2026-0300
  - attack.persistence
  - attack.T1190

SIGMA pseudocode (PAN-OS anomalous outbound connection from firewall):

title: PAN-OS Device Initiating Outbound Connection to External IP
logsource:
  product: paloalto
  category: network_connection
detection:
  selection:
    src_ip|expand: "%panos_management_and_dataplane_ips%"
    direction: "outbound"
    dst_ip|not_cidr:
      - "10.0.0.0/8"
      - "172.16.0.0/12"
      - "192.168.0.0/16"
    dst_ip|not_expand: "%approved_update_telemetry_syslog_ips%"
  condition: selection
falsepositives:
  - Legitimate update, telemetry, or log forwarding to approved cloud destinations
level: high
tags:
  - CVE-2026-0300
  - attack.command_and_control
  - attack.T1071.001

YARA pattern (EarthWorm tunneling tool, conceptual pending full Unit 42 hash):

rule EarthWorm_Tunneling_Tool_PAN_PostExploit {
  meta:
    description = "EarthWorm tunneling binary deployed post CVE-2026-0300 exploitation"
    reference = "Unit 42 Threat Brief CVE-2026-0300 May 2026"
    date = "2026-05-12"
    note = "Hash-based detection requires full SHA-256 from Unit 42 Threat Brief directly"
  strings:
    $ew_str1 = "ew_" nocase
    $ew_str2 = "socks5" nocase
    $ew_str3 = "lcx" nocase
    $ew_str4 = "-s rssocks" nocase
    $ew_str5 = "-d ssocksd" nocase
  condition:
    2 of ($ew_str1, $ew_str2, $ew_str3, $ew_str4, $ew_str5)
}
// NOTE: Supplement with SHA-256 hash-based detection using the full
// hash value published in the Unit 42 Threat Brief for CVE-2026-0300.
// Hash value not reproduced here as it is not fully confirmed in
// available open sources consulted for this report.

CVE-2026-32202: Windows Shell NTLM Coercion, Detection Intelligence

Detection engineering opportunities:

• Monitor for outbound TCP port 445 connections from Windows endpoints to non-RFC1918 external IP addresses. This is the primary network-level signal for active NTLM hash coercion in progress via malicious LNK files.

• Monitor Windows Security Event ID 4648 (explicit credential use) for NTLM authentication attempts where the target server IP is external (non-RFC1918) and the authentication package is NTLMSSPv2.

• Monitor endpoint file system telemetry for creation of LNK files containing UNC paths where the referenced server address is an external (non-RFC1918) IP, particularly in shared directories, recently accessed network paths, and email attachment staging locations.

• Monitor for Windows Security Event ID 5140 (network share access) combined with Event ID 4624 (successful logon) using NTLM authentication type from an unusual source, which may indicate successful credential relay following hash theft.

Detection context and data requirements:

• Required sources: Windows Security event logs (4648, 5140, 5145, 4624), network flow telemetry for outbound TCP 445 to external IPs, endpoint file system telemetry from EDR with LNK file content inspection capability.

• Detection gap: If SMB signing is not enforced, NTLM relay attacks may succeed without leaving additional detection telemetry beyond the initial outbound authentication attempt. Organizations without perimeter blocking of outbound TCP 445 to internet addresses are significantly more exposed to both the hash theft and the relay follow-on.

Threat hunting hypotheses:

• Hunt this week: Search for Windows endpoints that initiated outbound TCP 445 connections to external non-RFC1918 IPs between December 2025 and April 14, 2026 (the patch release date). These hosts may have already leaked credential hashes to APT28 infrastructure prior to remediation.

• Hunt this week: Scan recent LNK files across shared drives and email-accessible storage locations for UNC paths containing external IP addresses. Any such file warrants immediate investigation and should be treated as a potential APT28 delivery artifact.

Immediate detection actions, within twenty-four hours:

• Create a network monitoring alert for any outbound TCP port 445 connection from an internal endpoint IP to a non-RFC1918 external IP address.

• Create a SIEM correlation rule for Windows Security Event ID 4648 with NTLM authentication package and a destination IP outside RFC1918 ranges.

SIGMA pseudocode (LNK-triggered outbound NTLM coercion):

title: Outbound NTLM Authentication to External IP - Possible LNK Coercion CVE-2026-32202
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4648
    AuthenticationPackageName: "NTLM"
    LogonProcessName: "NtLmSsp"
  filter_internal:
    IpAddress|cidr:
      - "10.0.0.0/8"
      - "172.16.0.0/12"
      - "192.168.0.0/16"
    IpAddress|contains:
      - "127.0.0.1"
      - "::1"
  condition: selection and not filter_internal
falsepositives:
  - Legitimate external NTLM authentication to known partner services or cloud connectors
level: high
tags:
  - CVE-2026-32202
  - attack.credential_access
  - attack.T1187
  - attack.T1557.001
  - APT28

YARA pattern (malicious LNK with external UNC path, conceptual):

rule Malicious_LNK_External_UNC_Path_NTLM_Coercion {
  meta:
    description = "LNK shortcut file containing UNC path referencing non-RFC1918 IP address"
    context = "CVE-2026-32202 APT28 NTLM credential coercion delivery vector"
    reference = "Akamai research, FortiGuard Labs, Microsoft MSRC April 2026"
    date = "2026-05-12"
    note = "Post-match logic should validate UNC IP is non-RFC1918 for precision"
  strings:
    $lnk_magic = { 4C 00 00 00 01 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46 }
    $unc_prefix = "\\\\" wide
    $smb_ref1 = ".smb" nocase
    $smb_ref2 = "\\share\\" wide
  condition:
    $lnk_magic at 0 and ($unc_prefix or $smb_ref1 or $smb_ref2)
}

SIEM field logic (network layer NTLM coercion detection):

IF network.transport = "tcp"
AND network.destination.port = 445
AND NOT network.destination.ip CIDR ["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16"]
AND network.source.ip CIDR [internal_endpoint_ranges]
THEN alert: "Outbound SMB to External IP - Possible NTLM Hash Coercion (CVE-2026-32202 / APT28)"
priority: HIGH

ShinyHunters Canvas LMS Breach, Detection Intelligence (Education Sector)

Detection engineering opportunities:

• Monitor Canvas administrative console for anomalous login activity including geographic anomalies, unusual access times, and permission escalation events inconsistent with normal institutional administrator behavior.

• Monitor Canvas API access logs for bulk data export events, unusually high API call volumes per credential, or API calls to data export endpoints from IP addresses or service accounts not associated with routine integration activity.

• Monitor institutional SSO and identity provider logs for Canvas-bound authentication events from unusual locations or at unusual times, particularly from April 25 onward.

• Monitor hosted Canvas login page content integrity (hash-based monitoring) for unauthorized modification, consistent with the defacement of approximately 330 institutions on May 7.

Threat hunting hypotheses:

• Hunt this week: Pull Canvas access logs for April 25 to May 7 and search for administrative access events outside normal working hours, bulk data export API calls, and authentication events from IPs not associated with institutional network ranges or known VPN exit nodes.

• Hunt this week: Review SSO federation token logs for Canvas for any long-duration or anomalously issued tokens that may indicate session persistence beyond normal institutional access patterns.

Immediate detection actions, within twenty-four hours:

• Confirm no active unauthorized sessions exist in the Canvas administrative console.

• Audit recent Canvas API access logs for bulk export activity since April 25, 2026.

• Reset all institutional Canvas administrative credentials as a precautionary measure regardless of confirmed breach status.

SIGMA pseudocode (Canvas admin anomalous access):

title: Canvas LMS Admin Login from Anomalous Location or Time
logsource:
  product: instructure_canvas
  category: authentication
detection:
  selection:
    EventType: "admin_login"
    UserRole|contains: "admin"
  filter_normal:
    SourceIP|expand: "%institutional_network_ranges_and_vpn_exits%"
    Timestamp|within: normal_business_hours_window
  condition: selection and not filter_normal
falsepositives:
  - Legitimate remote admin access from personal devices or travel
level: medium
tags:
  - ShinyHunters
  - attack.initial_access
  - attack.T1530
  - education_sector