Daily Security Brief - May 7, 2026

Today: Iranian state-sponsored actors are masquerading ransomware attacks to hide espionage operations. Palo Alto Networks discloses critical zero-day CVE-2026-0300 under active exploitation, with CISA KEV deadline May 9. Backups continue failing during ransomware attacks because attackers destroy them first.

Critical Alerts

Palo Alto PAN-OS Zero-Day Exploitation (CVE-2026-0300)

A buffer overflow in the User-ID Authentication Portal (Captive Portal) of PAN-OS allows unauthenticated remote code execution with root privileges on PA-Series and VM-Series firewalls. CVSS 9.3, CISA added to KEV catalog with remediation deadline May 9, 2026. Exploitation began April 9 targeting limited number of customers with captive portal exposed to public internet or untrusted networks. Unit 42 tracks activity cluster CL-STA-1132 as likely state-sponsored. Post-exploitation includes deployment of EarthWorm and ReverseSocks5 tunneling tools, Active Directory enumeration using firewall service account credentials, and systematic log destruction. First patches expected May 13.

• Action: If User-ID Authentication Portal is enabled, restrict access to trusted internal IPs only or disable if not needed. Review firewall logs for suspicious authentication attempts starting April 9. Check for EarthWorm, ReverseSocks5, or unusual AD enumeration from firewall service accounts. Shadowserver reports 5,800+ publicly exposed VM-Series instances; verify your exposure status. Patch immediately upon May 13 release.
• Sources: Cyberscoop | Unit 42 | CISA

Ransomware & Extortion

MuddyWater Uses Chaos Ransomware Brand as False Flag

Iranian state-sponsored group MuddyWater (Mango Sandstorm, Seedworm, Static Kitten) conducted espionage operation in early 2026 disguised as Chaos ransomware attack. Social engineering via Microsoft Teams involved screen-sharing sessions to harvest credentials and manipulate MFA. Attackers deployed custom Darkcomp RAT (Game.exe), established persistence via DWAgent and AnyDesk, exfiltrated data, and sent extortion emails directing victim to Chaos leak site. No file encryption occurred. Infrastructure overlaps with previous MuddyWater campaigns, and malware was signed with certificate linked to group's Stagecomp and Darkcomp operations. Rapid7 attributes with moderate confidence to Iranian Ministry of Intelligence and Security (MOIS). Pattern mirrors October 2025 attack where MuddyWater used Qilin ransomware against Israeli hospital. Chaos RaaS emerged early 2025, has claimed 36 victims as of late March 2026, primarily U.S. construction, manufacturing, and business services sectors.

• Action: Monitor for unsolicited Microsoft Teams chats from external users requesting screen-sharing or IT support. Review DWAgent and AnyDesk deployments for unauthorized installations. Check domain controller access logs for unusual authentication using service accounts. Train users to recognize vishing and Teams-based social engineering. Implement conditional access policies requiring MFA re-authentication for sensitive actions even during active sessions.
• Sources: The Hacker News | BleepingComputer | SecurityWeek | The Register

Why Backups Fail During Ransomware Attacks

Backups are systematically destroyed before encryption in modern ransomware attacks. Acronis Cyberthreats Report H2 2025 shows 50% increase in attacks year-over-year. Attack sequence: initial access, credential theft, lateral movement, backup discovery, backup destruction, ransomware deployment. Attackers with admin credentials enumerate backup servers, delete or encrypt backup files and snapshots, disable backup agents, modify retention policies, delete Volume Shadow Copies on Windows, target hypervisor snapshots, and exploit API access to cloud backup storage. Common backup failures: no isolation between production and backup systems, weak access controls including shared admin credentials and lack of MFA, no immutability allowing modification or deletion, untested recovery processes revealing incomplete or corrupted backups, and siloed security tools preventing detection of attacks on backup infrastructure.

• Action: Implement immutable backups that cannot be modified or deleted by administrators with standard credentials. Isolate backup infrastructure from production domain using separate credentials and network segmentation. Enable MFA on all backup console access. Test recovery processes under realistic attack scenarios including simultaneous production and backup system compromise. Deploy monitoring that alerts on backup deletion, modification of retention policies, or disabled backup agents. Consider air-gapped or offline backup copies for critical systems.
• Source: BleepingComputer

Business & Infrastructure Threats

Threat Activity Enablers: Infrastructure Backbone for Ransomware and Botnets

Recorded Future identifies threat activity enablers (TAEs) as providers that support malicious cyber activity by providing infrastructure or services to threat actors. TAEs lack physical or virtual storefronts, conduct business only via email or messaging, do not enforce KYC policies, selectively respond to abuse reports to maintain plausible deniability, or openly ignore oversight. TAEs use corporate shell games with front companies across multiple jurisdictions, operate as local internet registries (LIRs) for direct control over IP resources and ASNs, and rapidly rebrand by transferring IP prefixes to newly registered clean-looking entities when scrutiny increases. Recorded Future's Network Threat Density List ranks high-risk TAE networks by Threat Density Score based on concentration of validated malicious activity relative to total IP address prefixes. Case study: Virtualine Technologies shifted IPv4 resources to fraudulently impersonate legitimate German firm metaspinner net GmbH in April 2025. New network became primary distribution hub for Latrodectus and AsyncRAT malware within weeks. When exposed, infrastructure pivoted to new identity within existing autonomous systems.

• Action: Block or heavily scrutinize traffic from networks on Recorded Future's Network Threat Density List. Monitor for new AS numbers or IP blocks associated with known TAE patterns including rapid ownership changes, LIR status without legitimate business presence, or concentration of malware C2 infrastructure. Review firewall and proxy logs for connections to TAE networks. Consider threat intelligence feeds that track bulletproof hosting providers and update block lists when TAEs rebrand.
• Source: Recorded Future Blog

Real Estate Giant Confirms Vishing Incident as ShinyHunters and Qilin Claim Involvement

Title references Cushman & Wakefield vishing incident with competing claims from ShinyHunters and Qilin ransomware groups. Article content was truncated and did not contain substantive details beyond headline reference.

• Source: The Register

General Security News

Vendor Breach Litigation: Banks Face Lawsuits After Third-Party Provider Incidents

Recent high-profile incident shows financial institutions face growing litigation and regulatory risks from vendor-driven data breaches. Within weeks of national bank confirming data security incident at third-party service provider, at least two putative class actions were filed. Financial institutions remain legally liable for vendor security failures under various regulatory frameworks and contract law principles.

• Action: Review third-party risk management program including vendor security assessments, contract terms requiring breach notification timelines, cyber insurance coverage for vendor-caused incidents, and incident response plans that account for vendor-originated breaches. Ensure vendor contracts include indemnification clauses, right to audit security controls, and requirements for vendor cyber insurance. Document due diligence efforts for regulatory defense.
• Source: DataBreaches.net

AI Agent Identity Governance Gap

Gartner Market Guide for Guardian Agents states enterprise adoption of AI agents is accelerating and outpacing maturity of governance policy controls. Traditional IAM designed for human login patterns fails to manage AI agents that run continuously, span multiple applications, acquire permissions opportunistically, and generate activity at machine speed. Orchid Security analysis shows roughly half of enterprise identity activity occurs outside centralized IAM visibility because identities and controls live in applications themselves, not central directories. Ask Orchid AI agent applies identity observability at the source inside applications at binary and configuration layer to answer questions about full identity estate including AI agent inventory, NIST compliance status, and runtime activity monitoring.

• Action: Inventory AI agents operating in your environment including business unit deployments, SaaS platform embedded agents, API integrations, and in-house developed agents. Document what data each agent accesses, what credentials or service accounts it uses, and what permissions it holds. Implement monitoring for agent authentication patterns, permission escalation, and unusual data access. Establish governance process requiring security review before new AI agents are deployed or granted access to production systems.
• Source: The Hacker News

CopyFail Linux Flaw Under Active Exploitation

Article title indicates fresh Linux vulnerability dubbed "CopyFail" is being exploited by attackers. Content was truncated and did not contain technical details, CVE identifier, or specific exploitation information.

• Source: The Register

Patch Priority

• Palo Alto PAN-OS: CVE-2026-0300, CVSS 9.3, unauthenticated RCE on PA-Series and VM-Series firewalls with User-ID Authentication Portal exposed. CISA KEV due May 9. Patch release expected May 13.
• GnuTLS: CVE-2026-3832, security bypass allows acceptance of revoked server certificates via crafted OCSP response. CVE-2026-33845, DoS via DTLS zero-length fragment. CVE-2026-3833, policy bypass due to case-sensitive nameConstraints comparison.
• CoreDNS: CVE-2026-33190, TSIG authentication bypass on encrypted DNS transports. CVE-2026-32936, DoH GET path missing size validation causes CPU and memory amplification. CVE-2026-32934, DNS-over-QUIC unbounded goroutine growth leads to DoS. CVE-2026-33489, transfer plugin subzone ACL bypass.
• Prometheus: CVE-2026-42151, Azure AD remote write OAuth client secret exposed via config API. CVE-2026-42154, remote read endpoint allows DoS via crafted snappy payload.

Vulnerability Disclosures

GnuTLS Certificate and DTLS Vulnerabilities

CVE-2026-3832 allows attackers to bypass certificate revocation checks by crafting malicious OCSP responses, enabling acceptance of revoked server certificates. EPSS 0.000 (8th percentile). CVE-2026-33845 enables DoS attacks via DTLS zero-length fragments. EPSS 0.000 (14th percentile). CVE-2026-3833 bypasses name constraints policies due to case-sensitive comparison, allowing certificates for domains that should be restricted. EPSS 0.000 (13th percentile).

• Action: Update GnuTLS to patched versions when available. Review systems using GnuTLS for TLS/DTLS including VPN concentrators, embedded devices, and Linux servers. Implement certificate pinning or additional revocation checks via CRL distribution points to mitigate CVE-2026-3832 until patched.
• Sources: MSRC CVE-2026-3832 | MSRC CVE-2026-33845 | MSRC CVE-2026-3833

CoreDNS Authentication and DoS Vulnerabilities

CVE-2026-33190 bypasses TSIG authentication on DNS-over-TLS and DNS-over-HTTPS transports, allowing unauthorized zone transfers or updates. EPSS 0.001 (21st percentile). CVE-2026-32936 in DoH GET path lacks size validation, allowing attackers to cause CPU and memory amplification via oversized queries. EPSS 0.001 (28th percentile). CVE-2026-32934 affects DNS-over-QUIC implementation with unbounded goroutine growth leading to resource exhaustion. EPSS 0.001 (34th percentile). CVE-2026-33489 in transfer plugin allows subzone ACL bypass via lexicographic zone comparison, enabling unauthorized zone transfers. EPSS 0.000 (12th percentile).

• Action: Update CoreDNS to latest version addressing these vulnerabilities. Review TSIG configurations and re-test authentication on encrypted transports. Implement rate limiting on DoH and DoQ endpoints. Monitor DNS server resource utilization for unusual goroutine growth or memory consumption. Audit zone transfer ACLs to ensure subzone restrictions are enforced.
• Sources: MSRC CVE-2026-33190 | MSRC CVE-2026-32936 | MSRC CVE-2026-32934 | MSRC CVE-2026-33489

Prometheus Configuration and DoS Issues

CVE-2026-42151 exposes Azure AD remote write OAuth client secrets via config API, allowing unauthorized access to monitoring data or write endpoints. EPSS 0.000 (1st percentile). CVE-2026-42154 allows DoS attacks against remote read endpoint via crafted Snappy-compressed payloads. EPSS 0.000 (6th percentile).

• Action: Upgrade Prometheus to patched versions. Rotate Azure AD OAuth client secrets if CVE-2026-42151 affects your deployment. Restrict access to Prometheus config API to localhost or trusted management networks only. Implement request size limits and rate limiting on remote read endpoints.
• Sources: MSRC CVE-2026-42151 | MSRC CVE-2026-42154

Additional CVE Disclosures

Microsoft Security Response Center published multiple Linux kernel and infrastructure CVEs: CVE-2026-43185 (ksmbd signedness bug in SMB Direct negotiation), CVE-2026-43868 (Apache Thrift Rust implementation vulnerable to CVE-2020-13949 pattern, EPSS 0.000), CVE-2026-6383 (KubeVirt unauthorized subresource access due to improper RBAC evaluation, EPSS 0.000), and numerous other Linux kernel fixes affecting NTFS3, XFS, networking, and device drivers. All have low EPSS scores indicating minimal observed exploitation risk currently.

• Action: Apply Linux kernel updates addressing these CVEs in next maintenance window. Prioritize patching internet-facing systems running ksmbd, containerized infrastructure using KubeVirt, and monitoring systems using Prometheus or CoreDNS.
• Sources: MSRC Update Guide

Trends & Context

Three converging patterns define today's threat landscape. State-sponsored actors increasingly masquerade as cybercriminals to complicate attribution and maintain plausible deniability, as demonstrated by MuddyWater's use of Chaos ransomware branding. Infrastructure providers operating as threat activity enablers provide persistent, resilient backbone for ransomware operations by obscuring ownership through shell companies and rapidly rebranding when exposed. Backup infrastructure continues to be primary target for destruction before ransomware deployment, with successful attacks leveraging inadequate isolation, lack of immutability, and weak access controls to eliminate recovery options before encryption begins.