Generated · Archived snapshot 10 findings · 4 CVEs
On this page

Exploitation Report

Executive Summary

Russian state actor Star Blizzard has escalated its phishing operations against Ukrainian-linked organizations by adopting a novel malware installation technique dubbed "RedFlick" to deploy the CosmicPulse backdoor. This shift from the previously observed ClickFix methodology demonstrates the group's continued adaptation to defensive measures while maintaining focus on NGOs, think tanks, and journalists. Simultaneously, multiple critical infrastructure vulnerabilities have come under active exploitation, including a pre-authentication command injection in Zimbra Collaboration Suite, an authentication bypass in Cisco Catalyst SD-WAN Manager, and a high-severity memory overflow in Citrix NetScaler ADC and Gateway appliances.

Active exploitation of the Citrix NetScaler vulnerability (CVE-2026-88772) has enabled threat actors to achieve root access, deploy custom web shells and tunneling malware, harvest credentials, and move laterally into internal networks across government, financial services, technology, education, and legal sectors in North America and Europe. The Cisco SD-WAN Manager zero-day (CVE-2026-76504) is being exploited to escalate to administrative privileges without authentication, with fixed releases now available but no workaround provided. Apple has also confirmed targeted exploitation of an out-of-bounds write flaw (CVE-2026-86950) in what it describes as an extremely sophisticated manner.

Beyond traditional vulnerability exploitation, attackers are increasingly abusing trusted AI platforms and legitimate remote management tools. Custom ChatGPT GPTs promoted through sponsored search results are being weaponized to deliver ClickFix lures that deploy remote access trojans, while phishing campaigns leveraging MSP360 and ScreenConnect installers are establishing persistent remote access. The Dutch Institute for Vulnerability Disclosure suffered a network breach through a chain of two zero-days in the Zammad ticketing system, and cryptocurrency exchange Bitget lost $387.5 million via a zero-day in unspecified third-party security products. Mass credential exposure on GitHub—over 543,000 valid secrets—continues to fuel initial access operations.

Active Exploitation Details

HighActive exploitationPatchCVE-2026-73570#

  • Description: An unauthenticated operating system command injection flaw in Zimbra Collaboration Suite (ZCS) that allows remote code execution when Simple Network Management Protocol (SNMP) is enabled. The vulnerability resides in the SNMP component and can be triggered without authentication.
  • Impact: Attackers can deploy web shells, access mailbox data, harvest authentication secrets, and achieve full compromise of the email server.
  • Status: The vulnerability has been patched, but active exploitation has been observed in the wild by Microsoft Security Research team.

CriticalActive exploitationPatchCVE-2026-76504#

  • Description: A critical zero-day authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager that allows a remote, unauthenticated attacker to access the Manager's API with administrative privileges. The flaw enables privilege escalation to admin level without any prior credentials.
  • Impact: Full administrative control over the SD-WAN management platform, enabling network-wide configuration changes, traffic manipulation, and potential lateral movement across managed devices.
  • Status: Actively exploited in the wild. Cisco released fixed versions on September 30, 2026. No workaround is available.

CriticalActive exploitationPatchCVE-2026-88772#

  • Description: A critical memory overflow vulnerability in the Datagram Transport Layer Security (DTLS) protocol handling of Citrix NetScaler ADC and NetScaler Gateway appliances. The flaw allows pre-authentication shellcode execution through a carefully crafted DTLS handshake.
  • Impact: Attackers achieve root access on the appliance, deploy custom web shells and tunneling malware (WHIPSHOT and SLAPSHOT), steal credentials, and pivot into internal networks. Targeted sectors include government, financial services, technology, education, and legal/professional services in North America and Europe.
  • Status: Actively exploited as a zero-day before patching. Exploit details have been publicly disclosed. Mandiant Consulting and Google Threat Intelligence Group observed exploitation in September 2026.

CriticalActive exploitationInvestigateCVE-2026-86950#

  • Description: An out-of-bounds write vulnerability in Apple products that is being weaponized in highly targeted attacks. Apple characterizes the exploitation as extremely sophisticated.
  • Impact: Targeted compromise of Apple devices, likely enabling arbitrary code execution with elevated privileges.
  • Status: Actively exploited in targeted attacks. Patch status not specified in available reporting.

CriticalActive exploitationInvestigate#

  • Description: A chain of two zero-day vulnerabilities in the open-source Zammad ticketing system that were exploited to breach the Dutch Institute for Vulnerability Disclosure (DIVD) network. The exploitation was described as AI-driven.
  • Impact: Full network breach of a vulnerability disclosure organization, potentially exposing vulnerability intelligence and coordination data.
  • Status: Zero-days exploited in the wild against a high-value target. Patch status not specified in available reporting.

CriticalObservedPatch#

  • Description: A critical pre-authentication remote code execution vulnerability in MikroTik RouterOS that can also cause denial-of-service conditions. CISA has issued a warning about this flaw.
  • Impact: Remote code execution on routing infrastructure without authentication, enabling network interception, traffic manipulation, and infrastructure compromise.
  • Status: CISA warning issued indicating active exploitation risk. Patch availability not specified in available reporting.

HighPotentialPatch#

  • Description: A set of high-severity vulnerabilities affecting TeamViewer client and host software. TeamViewer has urged customers to patch "as soon as possible."
  • Impact: Potential remote code execution or privilege escalation through the remote access software, which could lead to full system compromise.
  • Status: Vendors urging immediate patching. Active exploitation status not explicitly confirmed in available reporting.

HighNot observedPatch#

  • Description: A high-severity flaw in OpenSSL's DTLS implementation that can leak heap memory to the peer or crash the program. The issue occurs when a handshake message retransmission starts while a larger handshake message is partially processed.
  • Impact: Memory disclosure potentially exposing cryptographic material or sensitive data, and denial-of-service via application crash.
  • Status: Fixed in OpenSSL releases dated September 29, 2026. No active exploitation reported.

HighNot observedPatch#

  • Description: A vulnerability in Unsloth Studio that allows malicious AI models to execute arbitrary Python code during routine model inspection through the trust_remote_code setting.
  • Impact: Arbitrary code execution on systems inspecting untrusted AI models, enabling supply chain compromise through machine learning model sharing.
  • Status: Patched. Exploitation status in the wild not reported.

CriticalActive exploitationInvestigate#

  • Description: A zero-day vulnerability in unspecified third-party security products that was exploited to breach cryptocurrency exchange Bitget, resulting in $387.5 million theft.
  • Impact: Full compromise of exchange infrastructure leading to massive cryptocurrency theft.
  • Status: Zero-day exploited in the wild. Vendor and product not publicly identified in available reporting.

Affected Systems and Products

Attack Vectors and Techniques

Threat Actor Activities