CVE-2025-1055, CVE-2026-12627, CVE-2026-61500, CVE-2026-79898, CVE-2026-79901
Domains:
catbox[.]moe, wasabisys[.]com, 211[.]248, 211[.]249, 211[.]0, fbijobs[.]gov
Get tomorrow's brief in your inbox
Today: ShinyHunters operator "Rey" is cooperating with FBI from detention in Jordan as the group's arrest wave accelerates. China-linked Warlock ransomware group continues exploiting SharePoint flaws across critical infrastructure in Portuguese and Spanish-speaking countries. Fortra patches three critical flaws in BoKS privileged access manager, including a predictable password generation bug enabling AD service account compromise.
Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware
China-linked threat actor Warlock (aka Longlegs, Storm-2603) continues weaponizing Microsoft SharePoint vulnerabilities across critical infrastructure, government, and education sectors in Portuguese and Spanish-speaking countries spanning Europe, Africa, and Latin America. Recent activity from July 2026 demonstrates multi-stage attacks: initial SharePoint exploitation drops web shells to steal ASP.NET machine keys, enabling remote code execution. Attackers then abuse legitimate tools (Velociraptor for C2, VS Code tunnels for persistence) and deploy a vulnerable K7RKScan.sys driver (CVE-2025-1055) via BYOVD attacks to disable EDR across 40+ hosts within two hours. Ransomware is staged in domain SYSVOL shares for mass deployment via AD replication, hitting at least 33 hosts in one documented intrusion against a critical infrastructure operator. The group leverages DLL sideloading, cloud file-sharing services (catbox[.]moe, wasabisys[.]com) for payload delivery, and living-off-the-land techniques for reconnaissance.
Fortra BoKS Critical Vulnerabilities Enable AD Compromise and RCE
Fortra patched eight vulnerabilities in Core Privileged Access Manager (BoKS), including three critical flaws affecting Unix/Linux fleet management deployments. CVE-2026-79901 (CVSS 9.9, EPSS 0.3%) allows authentication bypass in BoKS Manager instances using BoKS keytab for AD service account management. The vulnerability stems from predictable password generation using pseudo-random sequences seeded with Unix timestamps. Attackers who know the service principal and can estimate password-change time can reproduce candidate passwords and verify them offline using captured Kerberos tickets. CVE-2026-79898 (CVSS 9.1, EPSS 1.0%) is a command injection flaw in crlserver allowing authenticated users to execute shell commands as root on BoKS Master via BCC and WSI REST/SOAP API. CVE-2026-12627 (CVSS 9.8, EPSS 0.4%) is a stack buffer overflow in autoregistration functionality enabling remote memory corruption. Five additional high/medium severity flaws were also patched: heap buffer overflows, out-of-bounds read, insecure temporary file handling, and predictable password generation.
Rejetto HFS Authentication Bypass Under Active Exploitation (CVE-2026-61500)
Critical authentication bypass vulnerability in Rejetto HTTP File Server discovered by Anthropic's Mythos AI model is now under active exploitation. CVE-2026-61500 (CVSS 9.8, EPSS 0.9%) stems from HFS using Math.random() to generate session signing keys. The underlying V8 xorshift128+ PRNG is fully reversible, and application leaks Math.random() outputs. Attackers can use Microsoft's Z3 SMT solver to recover the internal state from leaked outputs and forge valid session cookies, bypassing authentication to gain full admin access and remote code execution. Exploitation began October 3rd from IP addresses in China targeting US and Japan hosts, followed by activity from US-based IPs (173.239.211[.]248, 173.239.211[.]249) likely operating through compromised proxies. HFS previously appeared on CISA's KEV catalog in 2024.
ShinyHunters Operator "Rey" Detained in Jordan, Cooperating with FBI
ShinyHunters member Saif al-Din Khader (aka "Rey," "ReyXBF") was detained by Jordanian authorities on September 29, 2026, and is cooperating with FBI and international law enforcement to identify other group members. Khader previously served as administrator of Scattered LAPSUS$ Hunters (SLH) leak site, Hellcat ransomware data leak site (late 2024), and BreachForums (2024). He told journalist Brian Krebs in November 2025 he had been cooperating with law enforcement since June 2025. This arrest follows the September 26th detention of 24-year-old Amsterdam resident Pepijn van der Stap (offensive security lead at Neo Security), though ShinyHunters denied any connection to van der Stap. FBI director Kash Patel stated "FBI teams are actively working with partners to obtain and execute more leads in the ongoing investigation" and indicated more arrests are imminent. ShinyHunters recently compromised FBI's apply.fbijobs[.]gov portal, stealing three terabytes of data, and hijacked Cl0p's darknet site via unpatched Grav CMS vulnerability. The group has breached over 140 organizations since late 2025, collecting at least $70 million in extortion payments according to FBI.
China-Aligned TA419 Targets AI Policy Experts With Microsoft AitM Phishing
China-nexus espionage group TA419 is conducting credential phishing campaigns against AI policy experts at US think tanks, universities, and law firms using adversary-in-the-middle (AitM) techniques. Active since April 2025, the group impersonates prominent economists, AI policymakers, and Anthropic employees to target individuals involved in US AI policy and regulation. February 2026 campaign impersonated an Anthropic employee with subject "Request for Feedback on Military Integration of Claude." July 2026 activity impersonated former White House Office of Science and Technology Policy leadership. Attack chain begins with benign trust-building emails, followed by shortened URLs leading through Cloudflare Turnstile checks to OneDrive-based AitM credential phishing pages. The pages use "Frameless BitB" technique that spoofs Microsoft sign-in without iframe elements, relying on HTML/CSS/JS to create visual deception. TA419 extended open-source Frameless BitB tooling with custom telemetry and automation to track Microsoft sign-in flow and capture session cookies while proxying to legitimate Microsoft infrastructure, making detection difficult. Group primarily targets defense, national security, energy, international relations, and foreign policy sectors with nexus to US and Japan.
MI5 Warns 100+ UK Academics Funded by Chinese MSS Front Company
UK domestic intelligence service MI5 issued unprecedented Security Service Espionage Alert warning that over 100 UK-linked academics contributed to research projects funded by China's Ministry of State Security (MSS) via front company China General Technology Research Institute (CGTRI, also known as China Academy of General Technology/CAGT). CGTRI funds academic research in China on AI, cybersecurity, covert communications systems, and steganography that directly improves MSS technical capability for espionage. Many academics may be unaware of CGTRI's MSS backing. The body has identifiable staffing overlaps with China's University of International Relations, widely known for MSS affiliation. Research specialties include cybersecurity, signals intelligence, and AI-enabled tools supporting cyber-attacks against UK targets including companies, universities, and public services/infrastructure. MI5 urged UK academic institutions to review ongoing or planned CGTRI collaboration and trace funding sources, warning continued collaboration could result in prosecution under National Security Act 2023 for providing material assistance to foreign intelligence service.
Fortra BoKS Privileged Access Manager Vulnerabilities
Covered in Critical Alerts section. Eight total vulnerabilities patched including three critical-severity flaws in Unix/Linux fleet management product.
Rejetto HFS Authentication Bypass (CVE-2026-61500)
Covered in Critical Alerts section. Critical authentication bypass discovered by Anthropic Mythos AI model, now under active exploitation.
K7 Security Driver Privilege Escalation (CVE-2025-1055)
BYOVD vulnerability in K7RKScan.sys driver (EPSS 0.2%, 13th percentile) actively exploited by Warlock and DragonForce ransomware groups to disable endpoint security solutions. Driver abuse allows attackers to terminate security processes running at kernel level.
Epic Systems Pauses Development for Six-Week Security Sprint
Medical records giant Epic paused most product development for approximately six weeks while working on security improvements after Anthropic's Mythos AI model discovered vulnerabilities in MyChart software. Epic CEO Judy Faulkner told Modern Healthcare the pause focuses on "safeguarding" products. Chief Security Officer Stirling Martin told New York Times some customer configurations could allow outsiders to access patient records without detection in audit logs. Epic's software is used by major healthcare systems nationwide for patient medical record access. The company has not disclosed specific vulnerability details or affected version information.
Italian DPA Fines IQVIA €7 Million for Health Data Processing Violations
Italy's Data Protection Authority fined IQVIA Solutions Italy €7 million for creating database containing health information on one million patients from 800 general practitioners. Data was used for pharmaceutical company research but was not properly anonymized despite company claims. Patient codes combined with detailed health information (year of birth, sex, diagnosis, symptoms, prescriptions, tests, vaccinations, location data) allowed individual patient isolation and re-identification. Database included full identifying information (names, tax codes, addresses, contact details) for 3,300+ patients, over 3,000 linked to health data. Company processed health data without appropriate legal basis, failed to inform patients, defined no retention periods (data dated to 2001), conducted no impact assessment, and implemented inadequate security measures. IQVIA has 120 days to adapt processing practices or ensure doctors perform anonymization independently.
GitHub Repositories Expose 543,000+ Valid Credentials
Truffle Security research found 543,699 unique valid credentials exposed in public GitHub repositories as of July 2026, appearing across 1.1+ million files and repositories including forks. Median exposure time for unique credentials was 784 days. Approximately 10% of working credentials were older than 6.3 years, with oldest dating to 2009. Study scanned 224 million repositories containing 58+ billion files despite GitHub's security measures to prevent accidental sensitive data leaks.
MetaMask Discloses Ongoing Infrastructure Security Incident
Cryptocurrency wallet provider MetaMask disclosed ongoing infrastructure security incident on October 3rd affecting some infrastructure. Company working with external partners and security advisors, states "no immediate threat to MetaMask wallets." As precaution, proactively exiting affected validators within non-custodial staking operations in coordination with clients and partners. MetaMask emphasized staking operations are non-custodial and company does not manage withdrawal keys for client stakes.
OpenAI Faces California DOJ Subpoena Over Cybersecurity Practices
California Attorney General Rob Bonta served OpenAI with investigative subpoena demanding details about model security and risks following September Hugging Face cyberattack. Investigation examines whether frontier models enable or perpetrate cyberattacks during testing, development, or service deployment. Bonta stated developers failing to prevent model-enabled cyberattacks "can and should be held legally accountable." This follows reports of likely escalating FTC probe into OpenAI and other AI developers' cybersecurity practices.
Senate Passes Bipartisan Hospital Cybersecurity Bill
Senate passed Health Care Cybersecurity and Resilience Act by unanimous consent, aimed at helping healthcare providers strengthen cybersecurity defenses and protect patient information. Legislation sponsored by Sens. Cassidy (R-LA), Hassan (D-NH), Cornyn (R-TX), Warner (D-VA), Hyde-Smith (R-MS), and King (I-ME).
Federal Reserve Employee Mishandled Classified Files Before Retirement
Fed Office of Inspector General audit found Federal Reserve Board Division of International Finance employee mishandled sensitive classified files and triggered hundreds of data loss prevention alerts leading to July 2024 retirement. Individual announced plans to retire and expressed "desire to remove files" beforehand. OIG discovered issues during March 2025 offboarding audit, finding "apparent lack of diligence" by Fed in resolving concerns.
Three stories dominate today's brief: law enforcement pressure on ShinyHunters driving cooperation and arrests, China-nexus groups (Warlock, TA419) demonstrating persistent SharePoint exploitation and sophisticated social engineering against AI policy targets, and Anthropic's Mythos AI model proving its value by discovering exploitable cryptographic flaws that traditional methods miss. The Rejetto HFS vulnerability showcases how advanced mathematical reasoning in AI security tools can identify subtle PRNG reversibility issues that require SMT solvers to exploit. Meanwhile, the ShinyHunters investigation demonstrates that even sophisticated cybercrime groups eventually face operational security failures when sustained law enforcement pressure forces internal cooperation.