Inferlume

Top CVEs

1. CVE 2026 42897 Actively exploited pre authentication vulnerability in on premises Microsoft Exchange.

2. CVE 2026 20182 Maximum severity authentication bypass in Cisco Catalyst SD WAN allowing admin access.

3. CVE 2026 0300 Critical buffer overflow in Palo Alto Networks PAN OS leading to unauthenticated RCE.

4. CVE 2026 34926 Trend Micro Apex One zero day directory traversal vulnerability exploited in the wild.

5. CVE 2025 55182 React Server Components deserialization flaw actively exploited by the PCPJack worm.

Attack Vectors This Week

Exploitation of public facing applications and supply chain compromises absolutely dominated the week. Attackers focused heavily on weaponizing recent and legacy vulnerabilities against edge appliances, web servers, and security software. Supply chain attacks took a sophisticated turn, leveraging continuous integration pipelines to distribute signed malware to developer environments. Phishing remained a persistent threat, serving as the initial access vector for significant cyber espionage campaigns.

Actor & Infrastructure Patterns

Threat actors demonstrated a strong preference for living off the land and utilizing legitimate administrative tools for persistence and lateral movement. Cloud Atlas deployed reverse SOCKS proxies, SSH tunnels, and Tor configurations to maintain access in compromised networks. We observed a notable trend of attackers explicitly targeting developer endpoints, injecting persistence hooks into VS Code and other local development tools. Rival threat actors were also seen competing for access, with the PCPJack worm actively killing TeamPCP processes on infected hosts.

MITRE ATT&CK Themes

1. T1190 (Exploit Public Facing Application) Observed consistently across attacks targeting Cisco, F5, and Palo Alto Networks edge appliances.

2. T1195.002 (Compromise Software Supply Chain) Demonstrated by the TeamPCP compromises of npm and PyPI packages via CI runner abuse.

3. T1078 (Valid Accounts) Used extensively by threat actors pivoting from edge appliances to internal systems like Atlassian Confluence.

4. T1573 (Encrypted Channel) Leveraged by Cloud Atlas using reverse SSH and Tor to bypass outbound firewall restrictions.

5. T1486 (Data Encrypted for Impact) Reflected in the targeted destructive wiper payloads deployed alongside credential harvesting worms.

Threat Detection

rule Detect_Mini_Shai_Hulud_Wiper {
    meta:
        description = "Detects the destructive wiper payload associated with the Mini Shai Hulud campaign"
        author = "NightWatch CTI"
        date = "2026 05 24"
    strings:
        $s1 = ".vscode/tasks.json" ascii
        $s2 = "~/.claude/settings.json" ascii
        $c2_1 = "83.142.209.194" ascii
        $wipe_trigger = "rm rf /" ascii
    condition:
        all of ($s*) and $c2_1 and $wipe_trigger
}

title: Suspicious Confluence Child Process
description: Detects suspicious commands executed by the Atlassian Confluence Java process indicating potential exploitation.
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        ParentImage|endswith: '/bin/java'
        ParentCommandLine|contains: ' atlassian confluence '
        CommandLine|contains:
            'chmod 777 /dev/shm'
            'base64 d '
            'curl o /dev/shm/'
    condition: selection