Inferlume

Top CVEs

CVE-2026-32201 | Microsoft SharePoint Server | Spoofing / Improper Input Validation (CWE-20) | CVSS 6.5 | Confirmed exploited in the wild | CISA KEV added April 14, 2026 | Federal patch deadline April 27, 2026. Allows unauthenticated network spoofing enabling phishing, data manipulation, and social engineering escalation chains within trusted SharePoint environments. Patch immediately regardless of sector.

CVE-2026-33827 | Windows TCP/IP Stack | Remote Code Execution | CVSS 8.1 | Race condition | Wormable risk profile on IPv6/IPSec-enabled hosts | No user interaction required. Network-based exploitation with no authentication precondition makes this a priority for all Windows Server infrastructure.

CVE-2026-33824 | Windows IKE Service Extensions | Remote Code Execution | CVSS 9.8 | Unauthenticated remote exploitation | Lateral movement vector via internal networks on UDP 500/4500. Blocking UDP 500/4500 at the perimeter is a partial mitigation only — internal hosts remain exposed without patching.

CVE-2026-32190 / CVE-2026-33114 / CVE-2026-33115 | Microsoft Office / Word | Remote Code Execution | CVSS 8.4 | Use-after-free and untrusted pointer dereference | Unauthenticated exploitation via document delivery. Email gateway sandboxing of Office attachments is a compensating control pending patch rollout.

CVE-2026-33826 | Windows Active Directory | Remote Code Execution | CVSS 8.0 | Authenticated | Improper input validation. Authenticated exploitation lowers urgency relative to unauthenticated CVEs this week but remains a priority for AD-dependent environments.

CVE-2026-34197 | Apache ActiveMQ | Code Injection via Jolokia JMX-HTTP bridge | CVSS 8.8 | Authenticated RCE | CISA KEV added April 16, 2026 | Exploitation activity confirmed since March 24. Any ActiveMQ instance accessible from internal networks should be treated as potentially compromised pending audit.

CVE-2026-34621 | Adobe Acrobat Reader | Prototype Pollution → Arbitrary Code Execution | CVSS 8.6 | Malicious PDF delivery | CISA KEV added April 13, 2026. Five months of confirmed exploitation before KEV listing — PDF attachment sandboxing and reader patching are both required, not optional.

Attack Vectors This Week

Exploitation of unpatched web-facing applications dominated initial access this week, with Storm-1175 operationalizing the gap between disclosure and patch deployment as a reliable entry point. The pattern is structural and not limited to this actor: any organization with internet-facing applications and multi-day patch SLAs is operating with a predictable exploitation window. SharePoint, Apache ActiveMQ, and Adobe Acrobat all presented active exploitation chains simultaneously — a distribution that complicates patch triage for security teams without automated prioritization tooling.

Software supply chain compromise via malicious npm packages represents a parallel vector that operates entirely within trusted developer workflows. Install-time code execution means the attack surface precedes runtime detection — endpoint behavioral analysis and CI/CD pipeline dependency scanning are the only realistic detection layers for this class of attack. GrafanaGhost introduces a third distinct vector: AI-mediated exfiltration that bypasses conventional credential and authentication controls entirely, initiating data exfiltration through the AI component's own legitimate outbound network behavior.

Actor & Infrastructure Patterns

Storm-1175 continues to demonstrate that financially motivated ransomware operators have closed the operational tempo gap with nation-state actors. A 24-hour attack cycle from initial access to encryption is not achievable through manual operation alone — this group has automated or semi-automated significant portions of its post-exploitation chain. The implication for defenders is that web-facing application patching SLAs measured in days are structurally insufficient against this actor.

Qilin maintained its position as the highest-volume ransomware operator tracked this month, with 134 confirmed victims in March 2026. Its geographic distribution (72 countries in one month) and sector targeting pattern (education, healthcare, finance) suggest a mature affiliate network rather than a centralized operation. Salt Typhoon (PRC-linked) remains confirmed active by FBI leadership for telecommunications and government communications targeting — no new TTPs reported this week, but the persistence of the operation at confirmed-active status warrants continued monitoring posture.

MITRE ATT&CK Themes

T1190 (Exploit Public-Facing Application) — Storm-1175 primary initial access vector; also observed in SharePoint CVE-2026-32201 and Apache ActiveMQ CVE-2026-34197 exploitation chains.

T1195.002 (Compromise Software Supply Chain) — 36 malicious npm packages impersonating Strapi plugins; install-time code execution within trusted development toolchains.

T1059.007 (Command and Scripting Interpreter: JavaScript) — npm reverse shell payloads executing within Node.js runtime environments post-installation.

T1486 (Data Encrypted for Impact) — Medusa ransomware deployment by Storm-1175; confirmed at ChipSoft (Netherlands) healthcare infrastructure.

T1048 (Exfiltration Over Alternative Protocol) — GrafanaGhost exfiltration via AI-initiated outbound HTTP image request carrying victim data as URL parameters; inferred from disclosed attack mechanism, no formal MITRE mapping published by Noma Security at time of writing.

T1566 / T1204.002 (Phishing / Malicious File) — Office and Word RCE delivery chains (CVE-2026-32190, CVE-2026-33114, CVE-2026-33115) and Adobe PDF prototype pollution (CVE-2026-34621).

T1041 (Exfiltration Over C2 Channel) — World Leaks 7.7 TB exfiltration from the Los Angeles City Attorney's Office.

T1078 (Valid Accounts) — Post-exploitation credential harvesting in the Strapi npm campaign targeting stored secrets in filesystem paths and environment variables.

Threat Detection

SIGMA — Storm-1175 / Medusa: Web-Facing RCE → Rapid Lateral Movement

texttitle: Storm-1175 Medusa Ransomware - Web-Facing Exploitation & Rapid Lateral Movement
id: a3f7c211-88d4-4c1b-9e5a-ff3302b91d44
status: experimental
description: >
  Detects rapid lateral movement and discovery behavior consistent with
  Storm-1175 Medusa ransomware post-exploitation, originating from web
  server processes within a compressed timeframe after initial access.
references:
  - https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/
author: NightWatch CTI
date: 2026-04-19
tags:
  - attack.initial_access
  - attack.t1190
  - attack.lateral_movement
  - attack.t1486
  - attack.exfiltration
logsource:
  category: process_creation
  product: windows
detection:
  selection_web_process:
    # Web application processes spawning interactive shells = strong initial access indicator
    ParentImage|contains:
      - 'w3wp.exe'
      - 'tomcat'
      - 'java.exe'
      - 'php-cgi.exe'
      - 'nginx'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
  selection_discovery_rapid:
    # Rapid host/network enumeration commands following web process compromise
    CommandLine|contains:
      - 'net user'
      - 'net group'
      - 'nltest /domain_trusts'
      - 'whoami /all'
      - 'systeminfo'
      - 'ipconfig /all'
  timeframe: 1h
  # Both conditions within 1h window indicates Storm-1175-pattern rapid exploitation
  condition: selection_web_process AND selection_discovery_rapid within timeframe
falsepositives:
  - Legitimate administrative scripts triggered from web applications
  - Validate all hits against change management records before escalating
level: high

SIGMA — GrafanaGhost: Anomalous Outbound HTTP from Grafana AI Component

texttitle: GrafanaGhost - Anomalous Outbound HTTP from Grafana AI Component
id: b9e1d445-27c3-4fa2-adb8-cc0192a3e817
status: experimental
description: >
  Detects outbound HTTP requests initiated by Grafana backend processes
  to non-baseline external hostnames, consistent with GrafanaGhost AI
  prompt injection exfiltration behavior. Data is transmitted as URL
  parameters in attacker-controlled image requests.
references:
  - https://noma.security/blog/grafana-ghost/
author: NightWatch CTI
date: 2026-04-19
tags:
  - attack.exfiltration
  - attack.t1048
logsource:
  product: grafana
  category: network_connection
detection:
  selection:
    # Grafana backend process initiating an outbound connection
    Image|contains: 'grafana'
    Initiated: 'true'
    # Flag connections to anything outside known-good Grafana infrastructure
    DestinationHostname|not|contains:
      - 'grafana.com'
      - 'grafana.net'
      - 'localhost'
      - '127.0.0.1'
      - '::1'
  filter_known_internal:
    # Exclude RFC1918 internal destinations (approved internal data sources)
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter_known_internal
falsepositives:
  - Configured Grafana external data sources — add approved domains to allowlist
  - Legitimate plugin callbacks — baseline required before deploying at high alert level
level: high

YARA — Malicious npm Strapi Plugin Reverse Shell Implant

textrule MaliciousNPM_Strapi_Reverse_Shell_Implant {
    meta:
        description = "Detects reverse shell and C2 implant behavior in malicious npm packages impersonating Strapi CMS plugins"
        author      = "NightWatch CTI"
        date        = "2026-04-19"
        reference   = "https://thehackernews.com/2026/04/36-malicious-npm-packages-exploited.html"
        severity    = "critical"
        tags        = "supply_chain, npm, strapi, reverse_shell"
    strings:
        // Package naming patterns matching the Strapi impersonation campaign
        $s1 = "prod-strapi" ascii
        // Node.js reverse shell primitives observed in malicious packages
        $s2 = "require('child_process')" ascii
        $s3 = "spawn" ascii
        $s4 = "net.Socket" ascii
        // Database exploitation strings — Redis and PostgreSQL targeting
        $s5 = "redis://" ascii
        $s6 = "postgresql://" ascii
        // Shell execution payloads
        $cmd1 = "/bin/bash" ascii
        $cmd2 = "sh -i" ascii
        // Credential harvesting target paths
        $cred1 = ".env" ascii
        $cred2 = "process.env" ascii
        $cred3 = "id_rsa" ascii
    condition:
        // Strapi name + subprocess + shell = high confidence implant
        (($s1 or $s5 or $s6) and ($s2 and $s3 and ($cmd1 or $cmd2))) or
        // Socket + subprocess + credential target path = C2 + harvesting pattern
        ($s4 and $s2 and any of ($cred1, $cred2, $cred3))
}

SIEM Query Pseudocode — CVE-2026-32201 SharePoint Zero-Day Exploitation Indicators

text// SIEM pseudocode — vendor-agnostic
// Detect potential SharePoint spoofing exploitation (CVE-2026-32201)
// Target log sources: IIS access logs, SharePoint ULS logs, WAF logs

SEARCH index=web_logs
  WHERE (
    uri_path CONTAINS "/_layouts/"
    OR uri_path CONTAINS "/webservices/"
    OR uri_path CONTAINS "/_vti_bin/"
  )
  AND http_method IN ("POST", "PUT")
  AND http_status_code IN (200, 302)
// Flag XSS/injection payloads in URI query strings — characteristic of spoofing exploitation
  AND (
    uri_query CONTAINS "<script"
    OR uri_query CONTAINS "javascript:"
    OR uri_query CONTAINS "onerror="
    OR uri_query CONTAINS "onload="
  )

// Score by payload type to prioritize analyst triage
EVAL risk_score = CASE(
    uri_query CONTAINS "<script",    90,
    uri_query CONTAINS "javascript:", 85,
    DEFAULT,                          70
)

// Aggregate by source IP and path to surface scanning bursts
AGGREGATE
  COUNT(*) AS request_count,
  MIN(timestamp) AS first_seen,
  MAX(timestamp) AS last_seen,
  COLLECT(uri_query) AS payloads,
  COUNT_DISTINCT(src_ip) AS unique_sources
  BY host, uri_path, risk_score

// Threshold: repeated attempts or high-confidence payload from any single source
WHERE request_count > 1 OR risk_score >= 85

SORT BY risk_score DESC

OUTPUT timestamp, host, uri_path, uri_query, src_ip, http_status_code, risk_score
// Tune uri_path filters to match your SharePoint deployment's actual path structure
// Add allowlist for known scanning tools and internal health checks to reduce FP rate