Inferlume

Top CVEs

CVE-2026-50751 — Check Point Security Gateway IKEv1 authentication bypass vulnerability with a CVSS score of 9.3, enabling unauthenticated remote threat actors to establish VPN sessions without valid passwords. CVE-2026-35273 — Oracle PeopleSoft PeopleTools Environment Management Hub unauthenticated remote code execution zero-day vulnerability, actively weaponized for wide-scale institutional record theft. CVE-2026-41089 — Windows Netlogon stack-based buffer overflow vulnerability with a CVSS score of 9.8, allowing unauthenticated, zero-click remote code execution against domain controllers. CVE-2026-44963 — Veeam Backup & Replication remote code execution vulnerability with a CVSS score of 9.4, enabling authenticated domain users to achieve full execution control over primary backup servers. CVE-2026-10520 — Ivanti Sentry OS command injection vulnerability added directly to the CISA KEV catalog following documented edge gateway exploitation. CVE-2026-20245 — Cisco Catalyst SD-WAN Manager improper output encoding vulnerability actively targeted by threat actors to compromise network management interfaces. CVE-2026-49160 — Microsoft HTTP.sys resource exhaustion vulnerability under active zero-day exploitation, enabling unauthenticated remote actors to trigger system denial-of-service via malformed HTTP/2 compressed data streams. CVE-2026-48567 — Azure HorizonDB maximum-severity remote code execution vulnerability with a CVSS score of 10.0, exposing cloud-native database infrastructure. MiniPlasma — Unpatched Windows cldflt.sys kernel vulnerability enabling active SYSTEM-level privilege escalation as part of an ongoing researcher disclosure campaign.

Attack Vectors This Week

The initial attack surface was dominated by unauthenticated remote exploitation of internet-facing secure gateways and enterprise middleware interfaces. Threat actors heavily leveraged certificate validation flaws and stack buffer overflows to seize control of perimeter appliances without valid credentials. In parallel, highly interactive voice-based social engineering campaigns systematically targeted corporate helpdesks to bypass multi-factor authentication checkpoins, while upstream supply chain contamination via trojanized PyPI packages and compromised GitHub repositories targeted developer workstations.

Actor & Infrastructure Patterns

Adversaries displayed a high degree of structural automation, using server-side script blocks to instantly extract OAuth tokens, long-lived session cookies, and local AI tool credentials to accelerate horizontal movement post-compromise. Financial extortion groups maintained a high cadence of vishing-to-SaaS lateral movement, bypassing traditional malware delivery chains entirely. Nation-state threat clusters expanded their use of fileless memory-resident implants, leveraging indirect system call patterns to bypass user-mode API hooks and using runtime patching of Event Tracing for Windows to systematically blind local endpoint detection and response agents.

MITRE ATT&CK Themes

• T1190 (Exploit Public-Facing Application) — Used to weaponize Check Point VPN portals, Oracle PeopleSoft endpoints, and Ivanti gateways via crafted network requests.

• T1195.001 (Supply Chain Compromise: Compromise Software Dependencies and Development Tools) — Deployed via the Miasma worm on GitHub and trojanized PyPI scientific computing packages.

• T1620 (Reflective Code Loading) — Utilized by Lazarus Group to execute the RemotePE RAT entirely in memory without creating identifiable filesystem artifacts.

• T1562.006 (Impair Defenses: Indicator Blocking) — Weaponized via in-memory patching of NtTraceEvent to completely disable telemetry generation for local security sensors.

• T1556.006 (Modify Authentication Process: Multi-Factor Authentication Bypass) — Observed across vishing loops and XML signature wrapping campaigns to subvert enterprise identity validation planes.

• T1490 (Inhibit System Recovery) — Deployed heavily by ransomware affiliates to purge volume shadow copies and destroy hypervisor configurations before beginning data encryption.

Threat Detection

YARA Rule: Miasma-Style Developer Secret Harvester

rule Miasma_CredStealer_Behavior {
    meta:
        description = "Detects characteristic indicators of Miasma-style credential harvesting from developer environments"
        author = "NightWatch CTI"
        date = "2026-06-14"
        version = "1.0"
    strings:
        $s1 = "AZURE_CLIENT_SECRET" ascii nocase
        $s2 = "OPENAI_API_KEY" ascii nocase
        $s3 = "AWS_SECRET_ACCESS_KEY" ascii nocase
        $s4 = "GH_TOKEN" ascii nocase
        $s5 = ".ssh/id_rsa" ascii
        $net1 = "requests.post" ascii
        $net2 = "urllib.request.urlopen" ascii
        $enc1 = "base64.b64decode" ascii
        $enc2 = "eval(compile(" ascii
    condition:
        (uint16(0) == 0x7f45 or uint16(0) == 0x4d5a) and (3 of ($s*)) and (1 of ($net*)) and (1 of ($enc*))
}

SIGMA Rule: Suspicious Check Point IKEv1 Authentication Bypass Attempt

title: Suspicious Check Point IKEv1 Authentication Bypass Attempt
id: a1f3c2d4-9e87-4b3a-bc12-fa09e8765432
status: experimental
description: Detects anomalous IKEv1 authentication failure spikes indicative of CVE-2026-50751 exploitation attempts against Check Point Security Gateways.
author: NightWatch CTI
date: 2026-06-14
logsource:
    product: checkpoint
    category: firewall
detection:
    selection:
        EventID: 'VPN_AUTH_FAILURE'
        Protocol: 'IKEv1'
        AuthMethod: 'PSK'
    filter_known_peers:
        src_ip|cidr:
            - '192.168.100.0/24'
    condition: selection and not filter_known_peers
fields:
    - src_ip
    - dest_ip
    - Protocol
falsepositives:
    - Misconfigured external VPN peers or legitimate high-volume tunnel reconnect issues during maintenance.
level: high

SIEM Query Pseudocode: Identifying Accelerated Initial Access Ransomware Staging

-- Identifies rapid post-compromise transitions from helpdesk credential resets to system recovery inhibition
SELECT 
    login.timestamp AS initial_login_time,
    process.timestamp AS command_execution_time,
    login.user_id,
    login.source_ip,
    process.command_line
FROM 
    IdentityAuthenticationLogs AS login
JOIN 
    EndpointProcessEvents AS process 
    ON login.host_name = process.host_name
WHERE 
    login.authentication_mechanism = 'HelpdeskReset'
    AND login.status = 'Success'
    AND (process.command_line LIKE '%vssadmin delete shadows%' 
         OR process.command_line LIKE '%Remove-Backup%'
         OR process.command_line LIKE '%bcdedit /set%')
    AND DATEDIFF(second, login.timestamp, process.timestamp) BETWEEN 0 AND 30
ORDER BY 
    initial_login_time DESC;