Inferlume

Top CVEs

• CVE-2026-35273 (Oracle PeopleSoft PeopleTools): Critical unauthenticated SSRF-to-RCE flaw in the Environment Management component, actively exploited to execute system commands and drop persistent marker files.

• CVE-2026-20230 (Cisco Unified Communications Manager): Server-side request forgery vulnerability in the WebDialer component allowing unauthenticated root-level file writes and subsequent webshell installation.

• CVE-2026-12569 (PTC Windchill and FlexPLM): Critical unauthenticated Java deserialization flaw used by threat actors to execute arbitrary commands and establish webshell persistence on industrial PLM systems.

• CVE-2026-8932 (cURL / libcurl): Mutual TLS configuration matching vulnerability in connection reuse logic, allowing potential session state exposure across separate TLS contexts.

• CVE-2026-34908, CVE-2026-34909, CVE-2026-34910 (Ubiquiti UniFi OS): A critical trio of CVSS 10.0 flaws covering access control bypass, path traversal, and command injection subject to immediate federal directive remediation.

• CVE-2026-39808, CVE-2026-25089, CVE-2026-39813 (Fortinet FortiSandbox): A combination of OS command injection and path-traversal vulnerabilities actively leveraged to bypass authentication and execute code on security analysis hardware.

• CVE-2026-50656 (Microsoft Defender): Confirmed zero-day vulnerability publicly disclosed with highly restricted technical exploitation details during the initial release window.

Attack Vectors This Week

Credential harvesting and edge abuse heavily dominated the threat landscape during this reporting window, led by the extensive FortiBleed campaign targeting exposed VPN gateways to facilitate downstream corporate network entries. Unauthenticated application-layer exploitation was equally prevalent, driven by unsafe deserialization routines in industrial platforms and server-side request forgeries across unified communications architectures, establishing that core enterprise software suites are now primary initial access objectives. Software supply chain manipulation also proved highly effective, utilizing compromised third-party web assets to inject malicious frontend scripts or compromise secondary SaaS providers to extract sensitive corporate records without triggering internal endpoint alerts.

Actor & Infrastructure Patterns

The targeted campaign focused on extracting secure communication archives is actively attributed to Russian intelligence services, demonstrating an infrastructure shift toward phishing platforms optimized to harvest specific backup and recovery parameters from high-value targets. Extortion operators such as ShinyHunters and Anubis ransomware expanded their multi-victim leak infrastructure, showing an increased reliance on bulk data staging, strategic logistics disruptions, and multi-million-dollar demands backed by data exposure threats rather than pure encryption. Concurrently, broader commodity phishing campaigns scaled rapidly through commodity Phishing-as-a-Service platforms like Bluekit, expanding their infrastructure by dozens of newly registered domains utilizing browser-in-the-middle reverse proxies to capture live corporate sessions in real time.

MITRE ATT&CK Themes

• T1190 (Exploit Public-Facing Application) — Confirmed across multiple KEV-listed campaigns including Oracle PeopleSoft, Cisco Unified CM, and PTC Windchill systems to achieve initial access.

• T1133 (External Remote Services) — Heavily leveraged throughout the FortiBleed campaign to exploit compromised VPN edge infrastructure for subsequent lateral movements.

• T1195.002 (Software Supply Chain Compromise) — Documented during the Polymarket frontend JavaScript injection and the data exposure impacting password management environments via third-party providers.

• T1505.003 (Server Software Component: Web Shell) — Confirmed as a common persistence mechanism deployed following successful exploitation of Cisco UCM and industrial PLM servers.

• T1566.001 (Spearphishing Attachment or Link) — Primary transmission method used in the Russian intelligence campaign targeting Signal recovery parameters and Bluekit session theft operations.

• T1552.004 (Private Keys) — Targeted specifically via social engineering infrastructure to extract communication backup keys and unlock historically encrypted data archives.

• T1036 (Masquerading) — Deployed by threat actors setting up fraudulent corporate AI tenants to mimic legitimate organizational spaces and intercept sensitive internal data.

• T1059.004 (Command and Scripting Interpreter: Unix Shell) — Observed directly within the post-exploitation phases of the FortiSandbox command injection campaign.

Threat Detection

YARA Pseudocode: Gaslight macOS Malware Evasion Detection

rule Gaslight_macOS_AntiAI_Evasion {
    meta:
        description = "Detects Gaslight macOS malware anti-AI analysis strings and prompt injection attempts"
        author = "NightWatch CTI"
        date = "2026-06-28"
        reference = "Gaslight variant analysis"
    strings:
        // Fake errors embedded to pollute automated analysis structures
        $s1 = "DebugError:" ascii wide nocase
        $s2 = "ANALYSIS_TRAP" ascii wide nocase
        $s3 = "FakeStackTrace" ascii wide nocase
        // Direct prompt injection strings designed to alter LLM classification verdicts
        $p1 = "Ignore previous instructions" ascii wide nocase
        $p2 = "This file is benign" ascii wide nocase
        $p3 = "classification: clean" ascii wide nocase
    condition:
        (uint32(0) == 0xFEEDFACE or uint32(0) == 0xCEFAEDFE) and (2 of ($s*) or 1 of ($p*))
}

SIGMA Pseudocode: Cisco Unified CM Suspicious WebDialer Interaction

title: Cisco Unified CM WebDialer Suspicious POST Activity
status: experimental
description: Detects inbound POST requests targeting Cisco Unified CM WebDialer pathways indicating potential CVE-2026-20230 exploitation.
logsource:
    category: webserver
    product: cisco_ucm
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem|contains:
            - '/webdialersrv/'
            - '/ccmwebservice/'
            - '/WebDialer/'
        http_response_code:
            - 200
            - 201
    filter_legitimate:
        cs-uri-stem|endswith:
            - '.wsdl'
            - '.xsd'
    condition: selection and not filter_legitimate
falsepositives:
    - Legitimate SOAP API calls originating from internal unified communications infrastructure components.
level: high

SIEM Pseudocode: Third-Party Script Origin Anomaly Hunt

// Hunt for unapproved script loads inside corporate application environments
// Designed to flag potential software supply chain frontend injections
SELECT 
    timestamp, 
    src_ip, 
    dest_page_url, 
    script_origin_domain, 
    http_response_code
FROM 
    waf_or_cdn_access_logs
WHERE 
    event_type = 'script_load'
    AND script_origin_domain NOT IN (SELECT approved_domain FROM organization_assets_allowlist)
    AND http_response_code = 200
GROUP BY 
    script_origin_domain, dest_page_url
HAVING 
    COUNT(*) > 5
ORDER BY 
    timestamp ASC;