Inferlume

Top CVEs

CVE-2026-20182 (CVSS 10.0): Authentication bypass in Cisco Catalyst SD-WAN Controller and Manager. No credentials required. Exploitation confirmed by Cisco Talos under UAT-8616. CISA Emergency Directive 26-03 issued with federal remediation deadline of May 17, 2026. Post-exploitation behavior includes NETCONF access used to alter network fabric configuration across entire SD-WAN deployments. Patch immediately; treat any unpatched SD-WAN controller as potentially already compromised.

CVE-2026-41089 (CVSS 9.8): Stack-based buffer overflow in Windows Netlogon service. Unauthenticated remote code execution on domain controllers. Affects Windows Server 2012 through 2025. Patched May 12, 2026 as part of May Patch Tuesday. No confirmed in-the-wild exploitation at time of writing, but Netlogon-targeting exploits have historically been weaponized rapidly. Treat as P0 with a 48-hour deployment target on all domain controllers.

CVE-2026-41096 (CVSS 9.8): Heap-based buffer overflow in Windows DNS Client. Unauthenticated RCE triggered by a specially crafted DNS response. No user interaction required. Can be triggered passively against any Windows host resolving DNS through a compromised or adversary-controlled resolver. Particularly relevant for environments using third-party DNS resolvers or split-DNS configurations.

CVE-2026-0300 (Critical, CVSSv4 score confirmed critical): Unauthenticated buffer overflow in the PAN-OS User-ID Authentication Portal on PA-Series and VM-Series firewalls. Remote code execution with root privileges when portal is exposed to untrusted networks. Exploitation confirmed in the wild. Listed in CISA KEV. Suspected state-sponsored cluster CL-STA-1132 observed post-exploitation deploying Earthworm and ReverseSocks5 tunneling tools and deleting logs and crash files to maintain stealth.

CVE-2026-41103: Elevation of privilege in Microsoft Entra ID. Forged credential presentation enables full user impersonation, bypassing identity provider controls. Microsoft rates exploitation as "more likely." High blast radius in cloud-heavy and federated identity environments.

CVE-2026-41940: Missing authentication for a critical function in WebPros cPanel and WHM and WP Squared. Enables unauthenticated invocation of privileged operations. Listed in CISA KEV under BOD 22-01 with active exploitation confirmed and federal remediation deadline applied.

CVE-2026-20122, CVE-2026-20128, CVE-2026-20133: Trio of Cisco Catalyst SD-WAN Manager flaws covering arbitrary file overwrite, recoverable password storage, and sensitive information exposure. Actively exploited per CISA. Collectively enable privilege escalation and credential harvesting in SD-WAN management environments. Remediate alongside CVE-2026-20182.

CVE-2026-45185 ("Dead.Letter", CVSS 9.8): Use-after-free in Exim MTA affecting GnuTLS-built versions 4.97 through 4.99.2. Unauthenticated RCE via BDAT over TLS path. Fixed in Exim 4.99.3. Automated scanning activity on port 25 observed within hours of disclosure. Applies to Debian and Ubuntu-based Exim deployments. If patch cannot be applied immediately, disable BDAT chunking extension as a temporary mitigation.

ICS advisory batch (May 2026): New Siemens and Schneider Electric advisories alongside CISA and CERT@VDE alerts covering Sentron data managers, Simatic S7 PLC web servers, and Ruggedcom networking gear. Flaws include critical vulnerabilities enabling device takeover, root command execution, and cross-site scripting in industrial environments. Directly internet-reachable OT devices should be treated as highest priority.

Attack Vectors This Week

The dominant initial access vector this week was exploitation of internet-facing applications and management portals, operating without user interaction and bypassing traditional phishing-dependent defense models. CVE-2026-20182 and CVE-2026-0300 both follow the same structural template: a network-accessible management or authentication surface, a memory-corruption or logic flaw requiring no credentials, and a short path to persistent, high-privilege access at a network chokepoint. Neither required a user to click anything. Both were exploited before a significant portion of the affected install base could patch.

Ransomware and data-extortion operations layered on top of established footholds through double-extortion mechanics. Nitrogen at Foxconn combined pre-encryption data exfiltration with BYOVD-based security tool disablement before deploying ransomware, compressing the window in which defenders could intervene. ShinyHunters at Canvas used bulk credential and identity harvest to enable downstream extortion and phishing, without needing to deploy destructive payloads at all. The Gentleman operation assembled a modular intrusion chain specifically designed to blend into legitimate infrastructure at every stage, using blockchain-based C2, commercial RMM for lateral movement, and legitimate cloud storage for exfiltration.

Phishing remains a significant downstream vector even when it is not the initial intrusion method. Microsoft's Q1 2026 email threat data documented 8.3 billion phishing emails detected in the quarter, with a rise in QR-code-based and CAPTCHA-gated lures. The Canvas breach in particular creates a durable phishing supply: names, email addresses, institutional affiliations, and private messages from 275 million users provide enough personalization material to build convincing, targeted lures for months after the incident.

Actor and Infrastructure Patterns

UAT-8616 is the week's most operationally significant actor, not because of novelty but because of confirmed depth. Activity documented back to at least 2023, a CVSS 10.0 entry point now being actively exploited, and post-compromise behavior oriented toward persistent network fabric control rather than immediate destructive impact. This is an adversary operating on an intelligence and access timeline, not a ransomware timeline. The use of NETCONF for configuration-layer persistence is notable: it is harder to detect than file-based implants and survives many standard remediation steps.

Nitrogen ransomware presents as a well-organized double-extortion operation with demonstrated capability to disable endpoint security through BYOVD before executing encryption. The Foxconn campaign shows pre-positioned access, large-scale exfiltration infrastructure, and targeting logic oriented toward maximum leverage through supply chain data rather than simple operational disruption. The group maintains a dark-web leak site where timed publication pressure is used as a negotiation tool, with selective publication of high-value sample documents as proof of access.

FamousSparrow's evolved tooling tells a clear story about active development within the threat group. The Deed RAT and Terndoor backdoors deployed in the Azerbaijani campaign used DLL sideloading with API hooking specifically to defeat sandbox analysis, indicating awareness of and adaptation to the defensive tooling used in the target environment. The reuse of the same Exchange entry point across three intrusion waves is not carelessness; it is a rational operational choice when the attacker knows the defender's remediation verification is incomplete.

The Gentleman operator's infrastructure choices reflect an emerging pattern in the broader ransomware ecosystem: deliberate selection of components that individually appear legitimate. EtherHiding C2 via Ethereum cannot be taken down by sinkholing a domain. GoTo Resolve is a commercially licensed RMM tool. Rclone and Wasabi are standard cloud utilities. TukTuk's assessed AI-generated origin, if confirmed, would represent an early field example of AI-assisted malware framework construction producing operationally functional code. Each piece has a plausible benign explanation; the combination does not.

CL-STA-1132's post-exploitation behavior at PAN-OS targets, specifically log deletion, crash file removal, and deployment of tunneling tools designed to blend into normal traffic, confirms that at least one actor exploiting CVE-2026-0300 is prioritizing stealth and persistence over rapid monetization.

MITRE ATT&CK Themes

T1190 (Exploit Public-Facing Application): CVE-2026-20182, CVE-2026-0300, CVE-2026-45185, and the Cisco SD-WAN companion CVEs all represent unauthenticated exploitation of internet-facing services for initial access. The FamousSparrow ProxyShell and ProxyNotShell Exchange exploitation fits the same technique. This is the confirmed leading initial access vector in Mandiant M-Trends 2026.

T1486 (Data Encrypted for Impact): Nitrogen ransomware at Foxconn and The Gentleman's domain-wide encryption both represent data encrypted for impact as the terminal stage of a double-extortion chain following pre-encryption exfiltration.

T1562.001 (Impair Defenses: Disable or Modify Tools): Nitrogen's documented BYOVD use of the vulnerable Topaz Antifraud driver (CVE-2023-52271) to disable endpoint security tooling before encryption is a confirmed instance of this technique in active campaigns this week.

T1021.002 (Remote Services: SMB and Windows Admin Shares): Relevant to lateral movement enabled by CVE-2026-41089 Netlogon exploitation path to domain controllers, and to broader Windows-environment post-exploitation documented in The Gentleman case.

T1572 (Protocol Tunneling): CL-STA-1132's post-exploitation deployment of Earthworm and ReverseSocks5 at PAN-OS targets represents tunneling-based C2 designed to blend into legitimate traffic and evade network detection.

T1568.002 (Dynamic Resolution: Domain Generation Algorithms) and T1102 (Web Service): EtherRAT's use of Ethereum blockchain for C2 via EtherHiding fits the broader category of adversary use of legitimate web services and decentralized infrastructure to make C2 resilient to takedown.

T1078 (Valid Accounts): CVE-2026-41103 in Entra ID enables forged credential presentation that passes identity provider validation; the Canvas breach creates a large-scale valid-account risk through credential reuse and downstream phishing.

T1041 (Exfiltration Over C2 Channel): Nitrogen exfiltrated over 8TB from Foxconn infrastructure through established exfiltration infrastructure before deploying ransomware. The Gentleman exfiltrated data to Wasabi via Rclone prior to encryption.

T1574.002 (Hijack Execution Flow: DLL Side-Loading): FamousSparrow used evolved DLL sideloading with API hooking in the Azerbaijani campaign specifically to evade sandbox-based behavioral analysis.

T1219 (Remote Access Software): The Gentleman's use of GoTo Resolve as a legitimate commercial RMM for lateral movement is a documented abuse of remote access tooling to blend into normal IT operations.

Threat Detection

YARA Rule: PAN-OS CVE-2026-0300 Post-Exploitation Tunneling Tools (CL-STA-1132)

rule PANOS_CVE_2026_0300_Earthworm_ReverseSocks5
{
  meta:
    description = "Detects Earthworm and ReverseSocks5 tunneling tools observed in post-exploitation activity following CVE-2026-0300 intrusions attributed to CL-STA-1132"
    reference   = "F5 Labs Weekly Threat Bulletin May 13 2026"
    author      = "NightWatch CTI"
    date        = "2026-05-17"
    tlp         = "WHITE"

  strings:
    // Earthworm binary string artifacts
    $ew1 = "Earthworm"      nocase ascii wide
    $ew2 = "ew_for_win"     nocase ascii
    $ew3 = "ew_for_linux"   nocase ascii

    // ReverseSocks5 binary string artifacts
    $rs1 = "ReverseSocks5"  nocase ascii wide
    $rs2 = "rs5_tunnel"     nocase ascii

    // Common tunneling config artifacts
    $cfg1 = "ssocksd"       nocase ascii   // Earthworm SOCKS server mode flag
    $cfg2 = "-s socks"      nocase ascii

  condition:
    uint16(0) == 0x5A4D and
    filesize < 10MB and
    (
      1 of ($ew*) or
      1 of ($rs*) or
      (1 of ($cfg*) and filesize < 3MB)
    )
}

YARA Rule: FamousSparrow Deed RAT and Terndoor Loader Artifacts

rule FamousSparrow_DeedRAT_Terndoor_Loader
{
  meta:
    description = "Detects DLL sideloading artifacts and anti-sandbox strings associated with FamousSparrow Deed RAT and Terndoor deployments in Azerbaijani energy sector campaign"
    reference   = "Bitdefender Labs FamousSparrow May 2026"
    author      = "NightWatch CTI"
    date        = "2026-05-17"
    tlp         = "WHITE"

  strings:
    // PE-in-PE dropper pattern consistent with sideloaded loaders
    $pe_marker = { 4D 5A ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 45 }

    // API hooking stub artifacts observed in evolved Deed RAT loader
    $hook1 = "NtQueryInformationProcess" ascii
    $hook2 = "ZwSetInformationThread"    ascii

    // Anti-sandbox environment checks documented by Bitdefender
    $sb1 = "SbieDll.dll"    nocase ascii   // Sandboxie
    $sb2 = "vmtoolsd.exe"   nocase ascii   // VMware
    $sb3 = "vboxservice"    nocase ascii   // VirtualBox
    $sb4 = "wireshark"      nocase ascii   // Analysis tool detection

    // DLL export names common in sideloaded loaders
    $exp1 = "DllRegisterServer" ascii
    $exp2 = "ServiceMain"       ascii

  condition:
    uint16(0) == 0x5A4D and
    filesize < 8MB and
    (
      ($pe_marker and 2 of ($sb*)) or
      (1 of ($hook*) and 1 of ($sb*)) or
      (all of ($exp*) and 1 of ($sb*))
    )
}

SIGMA Rule: Nitrogen Ransomware BYOVD via Topaz Antifraud Driver (CVE-2023-52271)

title: Nitrogen Ransomware BYOVD via Topaz Antifraud Driver
id: a7c3d1e2-9f04-4b8a-c66d-nitrogen-byovd
status: experimental
description: >
  Detects loading of vulnerable Topaz Antifraud drivers associated with
  BYOVD technique used in Nitrogen ransomware campaigns to disable endpoint
  security tooling prior to encryption. References CVE-2023-52271.
author: NightWatch CTI
date: 2026-05-17
references:
  - Cybersecurity Dive Foxconn coverage May 2026
logsource:
  product: windows
  category: driver_load
detection:
  selection:
    ImageLoaded|endswith:
      - '\topazaf.sys'
      - '\topazaf64.sys'
      - '\topazantifraud.sys'
  filter_legitimate:
    Signed: 'true'
    SignatureStatus: 'Valid'
    # Exclude if loaded from expected vendor installation path
    ImageLoaded|startswith:
      - 'C:\Program Files\Topaz'
  condition: selection and not filter_legitimate
falsepositives:
  - Legitimate Topaz Antifraud product deployments on financial terminals
    where vendor installation path and valid signature are both present
level: high
tags:
  - attack.defense_evasion
  - attack.t1562.001
  - cve.2023-52271

SIGMA Rule: Exim CVE-2026-45185 Dead.Letter BDAT TLS Anomaly

title: Exim Dead.Letter RCE Exploitation Attempt via BDAT TLS Anomaly
id: d9a4c2b1-8e31-4f2a-b77c-exim45185dead
status: experimental
description: >
  Detects anomalous BDAT-over-TLS connection patterns consistent with
  CVE-2026-45185 exploitation. Triggers on TLS close_notify received
  mid-BDAT body transfer, which is the precondition for the use-after-free
  condition in GnuTLS-built Exim versions 4.97 through 4.99.2.
author: NightWatch CTI
date: 2026-05-17
references:
  - https://fieldeffect.com/blog/critical-exim-flaw-gnutls-builds
logsource:
  category: application
  product: exim
detection:
  selection_bdat_tls_anomaly:
    EventMessage|contains:
      - 'BDAT'
      - 'GnuTLS'
    EventMessage|contains:
      - 'close_notify'
      - 'unexpected close'
      - 'connection lost'
  filter_normal_quit:
    EventMessage|contains: 'QUIT'
  timeframe: 60s
  condition: selection_bdat_tls_anomaly and not filter_normal_quit
falsepositives:
  - Legitimate SMTP clients aborting connections mid-transfer
  - Network resets during legitimate bulk mail delivery
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026-45185

SIGMA Rule: The Gentleman EtherRAT EtherHiding Blockchain C2 Beacon Pattern

title: The Gentleman EtherRAT EtherHiding Blockchain C2 Communication
id: b2e5f7a1-3c09-4d6e-a88f-gentleman-etherrat
status: experimental
description: >
  Detects network patterns consistent with EtherRAT EtherHiding C2 activity
  used in The Gentleman ransomware campaign. EtherHiding resolves C2
  configuration by querying Ethereum smart contract event logs via public
  blockchain RPC endpoints. Unusual or repeated outbound connections to
  Ethereum RPC nodes from non-blockchain workloads should be investigated.
author: NightWatch CTI
date: 2026-05-17
references:
  - The DFIR Report The Gentleman May 2026
logsource:
  category: network
  product: zeek
detection:
  selection_eth_rpc:
    dest_port:
      - 8545    // Standard Ethereum RPC
      - 8546    // Ethereum WebSocket RPC
    http.method: 'POST'
    http.uri|contains:
      - 'eth_getLogs'
      - 'eth_call'
      - 'eth_getTransactionByHash'
  filter_known_blockchain_systems:
    src_ip|cidr:
      - '0.0.0.0/0'   // Replace with known blockchain infrastructure CIDRs
    # Exclude known crypto workloads or DevOps pipeline nodes in your environment
  condition: selection_eth_rpc and not filter_known_blockchain_systems
falsepositives:
  - Legitimate blockchain development or Web3 application workloads
  - Crypto trading or wallet software on authorized endpoints
level: medium
tags:
  - attack.command_and_control
  - attack.t1102
  - attack.t1568.002

SIEM Pseudocode: Entra ID Forged Credential Impersonation Detection (CVE-2026-41103)

-- SIEM pseudocode: Detect potential Entra ID credential forgery and impersonation
-- CVE-2026-41103: Entra ID EoP via forged credentials
-- Adapt field names to your log schema. Do not assume SIEM product.

SELECT
  user_principal_name,
  source_ip,
  auth_method,
  token_issued_at,
  role_assigned,
  mfa_claim,
  mfa_required_by_policy
FROM identity_sign_in_logs
WHERE
  event_type IN ('SignIn', 'TokenIssuance', 'DirectoryAccess')
  AND auth_result = 'Success'
  AND (
    -- MFA claim absent when policy requires it
    (mfa_claim = false AND mfa_required_by_policy = true)
    OR
    -- Sign-in from IP with no prior history for this user in last 30 days
    (source_ip NOT IN (
      SELECT DISTINCT source_ip
      FROM identity_sign_in_logs
      WHERE user_principal_name = outer.user_principal_name
        AND event_time >= CURRENT_TIMESTAMP - INTERVAL 30 DAY
    ))
    OR
    -- Privileged role token issued without MFA event in preceding 5 minutes
    (
      role_assigned IN ('GlobalAdmin', 'PrivilegedRoleAdmin', 'SecurityAdmin', 'ApplicationAdmin')
      AND NOT EXISTS (
        SELECT 1 FROM identity_sign_in_logs AS mfa_check
        WHERE mfa_check.user_principal_name = outer.user_principal_name
          AND mfa_check.mfa_claim = true
          AND mfa_check.event_time BETWEEN token_issued_at - INTERVAL 5 MINUTE AND token_issued_at
      )
    )
  )
  AND event_time >= CURRENT_TIMESTAMP - INTERVAL 14 DAY
GROUP BY user_principal_name, source_ip, auth_method
-- Correlate findings with: conditional access policy change events,
-- PIM role activation logs, and any concurrent impossible travel alerts

SIEM Pseudocode: Canvas-Themed Phishing Surge Detection

-- SIEM pseudocode: Detect Canvas breach-themed phishing emails
-- Expected surge following ShinyHunters Canvas breach disclosure
-- Adapt field names to your email security log schema.

SELECT
  message_id,
  sender_address,
  recipient_address,
  subject,
  received_time,
  url_list,
  attachment_names
FROM email_security_logs
WHERE
  received_time >= TIMESTAMP '2026-05-10'
  AND (
    LOWER(subject) LIKE '%canvas data breach%'
    OR LOWER(subject) LIKE '%canvas security incident%'
    OR LOWER(subject) LIKE '%canvas account%'
    OR LOWER(subject) LIKE '%instructure breach%'
    OR LOWER(body_text) LIKE '%update your canvas password%'
    OR LOWER(body_text) LIKE '%canvas account has been compromised%'
    OR (
      LOWER(url_list) LIKE '%canvas%'
      AND LOWER(url_list) LIKE '%login%'
      AND sender_domain NOT IN ('instructure.com', 'canvaslms.com')
    )
  )
ORDER BY received_time DESC
-- Alert on: external senders using Canvas-themed subjects,
-- any link to canvas-lookalike domains, and credential-harvest page patterns

SIEM Pseudocode: Cisco SD-WAN CVE-2026-20182 Post-Exploitation NETCONF Anomaly

-- SIEM pseudocode: Detect anomalous NETCONF activity following
-- CVE-2026-20182 exploitation in Cisco Catalyst SD-WAN environments
-- Adapt to your network device syslog or NETCONF audit log schema.

SELECT
  source_ip,
  destination_ip,
  netconf_operation,
  config_target,
  session_user,
  event_time
FROM netconf_audit_logs
WHERE
  event_time >= CURRENT_TIMESTAMP - INTERVAL 7 DAY
  AND (
    -- NETCONF session from unexpected source IPs
    source_ip NOT IN (SELECT allowed_ip FROM netconf_allowlist)
    OR
    -- Bulk edit-config operations outside change windows
    (netconf_operation = 'edit-config'
     AND event_time NOT BETWEEN change_window_start AND change_window_end)
    OR
    -- Interface or routing table modifications without corresponding ticket
    (netconf_operation IN ('edit-config', 'delete')
     AND config_target IN ('interfaces', 'routing', 'bgp', 'vpn-instance')
     AND change_ticket_id IS NULL)
  )
ORDER BY event_time DESC
-- Correlate with: authentication logs for the same source IP,
-- SD-WAN controller login events, and any configuration diff alerts
-- UAT-8616 pattern: NETCONF used to alter VPN and routing fabric post-compromise