Cyber Threat Intelligence Digest: Week 41

Executive Summary -
Highlights of Cyber Threat Intelligence Digest

Vulnerabilities

Check Point Releases PoC for Two LiteLLM Vulnerabilities CVE-2026-35029 and CVE-2026-59823 - On 13 October 2026, Check Point Research disclosed technical details and proof-of-concept (PoC) exploit code for two vulnerabilities, CVE-2026-35029 and CVE-2026-59823, affecting LiteLLM versions earlier than 1.83.9. LiteLLM addressed both vulnerabilities in version 1.83.9. At the time of writing, Check Point Research has not reported any known instances of active exploitation.

CVE-2026-35029 is an improper access control vulnerability that, if exploited, allows low-privileged threat actors to perform administrative actions on affected systems. CVE-2026-59823 is a server-side request forgery (SSRF) vulnerability that, if exploited, allows authenticated threat actors to redirect gateway requests to attacker-controlled servers.

Docker Discloses Hub Flaw CVE-2026-105445 - On 12 October 2026, Docker disclosed and patched CVE-2026-105445, a critical vulnerability in Docker Hub’s identity and access management flow. CVE-2026-105445 is a personal access token reassignment vulnerability affecting the account-to-organisation conversion flow between 26 August 2024 at 20:33 UTC and 30 September 2026 at approximately 19:10 UTC. During conversion, Docker Hub reassigned the converted account’s personal access tokens to the named organisation owner without rotating or revoking the token secret, requesting the named owner’s confirmation, or notifying the owner. A threat actor could create a Docker Hub account, generate a personal access token, convert the account to an organisation, name a target user as owner, and continue using the still-active token with the target user’s registry-level scope.

Within the scope of the transferred token, a threat actor could potentially authenticate to Docker Hub as the target user at the registry level and pull, push, or delete container images in repositories and organisations where the target had access. Docker stated that the flaw did not provide access to the Docker Hub web interface and could not be used to change the target user’s password, email address, or two-factor authentication settings, or otherwise take over the account.

Ivanti Patches Actively Exploited Connect Secure Zero-Day CVE-2026-104935 Used in Unauthenticated Root-Level RCE Chain - On 13 October 2026, Ivanti disclosed and patched CVE-2026-104935, an actively exploited vulnerability affecting limited versions of Ivanti Connect Secure. The flaw is an authentication bypass and remote code execution (RCE) vulnerability affecting Ivanti Connect Secure versions 22.8R2.4, 25.1.2.2, and 25.1.1.1 and earlier. Remote unauthenticated threat actors can exploit the flaw as part of a low-complexity attack chain to execute arbitrary commands on vulnerable appliances. Volexity reported observing a previously unknown threat actor, tracked as UTA0576, exploiting a zero-day chain against a fully patched Ivanti Connect Secure appliance in early October 2026. The chain combined an authentication bypass, a file write vulnerability, and a privilege escalation issue to achieve unauthenticated root-level code execution. Ivanti tracks the authentication bypass and RCE components under CVE-2026-104935, and Volexity stated that Ivanti is still working on a fix for the privilege escalation issue.

Post-exploitation activity focused on credential access, Active Directory reconnaissance, and anti-forensics. Volexity observed attempts to extract credentials stored on the Ivanti appliance, collect configuration and authentication data, query Active Directory for LAPS passwords and BitLocker recovery keys, conduct password spraying, inspect LDAP traffic, exfiltrate limited Active Directory metadata, and tamper with Ivanti runtime and Linux audit logs.

Potential Threats

Threat Actors Abuse Trusted SaaS Platforms to Conduct Phishing - On 9 October 2026, KnowBe4 Threat Lab published an analysis of phishing campaigns using Living Off Trusted Services (LOTS), a technique in which threat actors abuse legitimate SaaS platforms and their notification infrastructure to deliver malicious links. LOTS activity accounted for approximately 53,000 of 544,000 threat emails analysed between June and August 2026, with DocuSign and QuickBooks responsible for nearly two-thirds of the volume. Threat actors register free or trial accounts, then create signature requests, payment confirmations, or file-sharing notifications containing malicious links, which the platforms deliver via their own infrastructure, passing SPF, DKIM, and DMARC checks and bypassing secure email gateways. Victims are then led to credential harvesting pages, including adversary-in-the-middle (AiTM) proxies capable of defeating non-phishing-resistant MFA, device-code phishing that yields authenticated session tokens, or prompts to install legitimate RMM tools such as ScreenConnect, AnyDesk, and Atera.

DocuSign was the highest-volume vector, with link expiration complicating retrospective investigation, while Adobe Sign was the fastest growing, more than doubling in volume through abuse of approval workflows, HTML attachments, and QR codes. Google Drive campaigns embedded malicious links in comments that @-mentioned victims, and SharePoint notifications impersonated internal Microsoft 365 sharing activity. Dropbox, Box, Notion, WeTransfer, SurveyMonkey, and Smash were also abused to host fraudulent landing pages, deliver weaponised files, or disguise malicious destinations behind trusted services.

Threat Actors Exploit Bricksforge Vulnerability CVE-2026-85097 for PHP File Upload and Remote Code Execution - On 8 October 2026, Patchstack reported active exploitation of CVE-2026-85097, a critical-severity arbitrary file upload vulnerability in the Bricksforge plugin for WordPress (versions up to and including 3.1.8.9) that enables remote code execution (RCE), with exploitation attempts first observed on 7 October 2026. The flaw stems from insufficient validation of the user-supplied URL field within the “temporaryFileUploads” parameter during form submission. Threat actors can exploit it by obtaining a valid nonce through the “bricksforge_regenerate_nonce” AJAX endpoint, uploading a GIF/PHP polyglot file that passes MIME type validation, and modifying file metadata to associate the uploaded image with a PHP destination URL, resulting in arbitrary PHP code execution. Observed activity primarily targeted the /wp-json/bricksforge/v1/form_submit endpoint with crafted temporaryFileUploads parameters, using alternative PHP extensions, case manipulation, encoded extensions, and modified metadata to bypass validation, with some attempts targeting WordPress upload directories using PHP filenames matching login_admin_*.php.

Patchstack identified 63 unique source IP addresses and two clusters showing signs of coordinated, automated exploitation. The first involved 44 IP addresses sending 56 identical requests within seconds, while the second involved three IP addresses testing 25 PHP extension and encoding variations against the same temporary file. Organisations are advised to update Bricksforge to version 3.1.8.10 or later and review logs for suspicious temporaryFileUploads activity, unexpected PHP files in upload directories, and requests to newly created PHP files.

Threat Actors Exploit AhsayCBS Vulnerabilities to Deploy Webshells and XMRig Cryptominers - On 8 October 2026, Huntress reported active exploitation of CVE-2026-105133 and CVE-2026-105134 in AhsayCBS versions up to and including 10.3.4, a cloud backup management console commonly used by managed service providers. Unidentified threat actors chained the vulnerabilities to achieve unauthenticated remote code execution (RCE), with exploitation first observed on 7 October 2026 and five organisations targeted as of 8 October. CVE-2026-105133 is an improper authentication flaw in the checkSysPwd function, while CVE-2026-105134 is a replication receiver flaw in /rps/api/json/UpdateReceivers.do that allows a random token to substitute valid credentials, enabling threat actors to configure a malicious receiver and drop a JSP webshell. No patch was available at the time of reporting, and Huntress recommended restricting management interface access to trusted IP addresses or VPNs.

Following exploitation, threat actors downloaded Taskgmr.ps1, msedge.exe, edge.exe, and config.json from imagefiles-backup[.]oss-ap-southeast-7[.]aliyuncs[.]com and deployed XMRig as edge.exe, connecting to mining pools at 51[.]195[.]127[.]124:8029 and xmr.kryptex[.]network. Persistence was established via a SYSTEM-level service named MicrosoftEdgeUpdateSvc executing msedge.exe, assessed to be a modified copy of NSSM used to restart the miner after crashes or reboots. Taskgmr.ps1, an apparently AI-assisted PowerShell script, stopped the service when Task Manager opened and restarted it on close. In one incident, threat actors used certutil.exe to download WinRing0x64.sys, a vulnerable kernel driver likely used to give the miner low-level hardware access.

General News

Co-creator of Empire Market dark web marketplace given 40-year sentence - The co-creator of the dark web cybercriminal marketplace Empire Market, Raheim Hamilton, was sentenced this week to 40 years in US federal prison and fined $5 million by a US District Judge for his role in facilitating the sale of drugs, hacking tools, and stolen information. Raheim Hamilton pleaded guilty earlier this year to a drug conspiracy charge and agreed to forfeit more than $100 million in bitcoin and several properties in Virginia. He co-owned and operated Empire Market with Thomas Paveyfrom 2018 to 2020, after the pair had previously sold counterfeit US currency on AlphaBay before its shutdown in 2017. Launched on 1 February 2018, Empire Market was organised into categories including “Fraud”, “Drugs & Chemicals”, “Counterfeit Items”, and “Software & Malware”, and facilitated more than 4 million transactions worth $430 million, around $375 million of which related to drug sales including fentanyl, cocaine, methamphetamine, and heroin. The platform’s popularity was driven by encrypted communications and the use of cryptocurrency mixers to launder proceeds, and in at least one instance counterfeit US currency was sold directly to a law enforcement agent.

Thomas Pavey pleaded guilty last year and is due to be sentenced later this month. The Justice Department previously stated it had seized $75 million in cryptocurrency, along with cash and precious metals, during the investigation. Empire Market disappeared abruptly in summer 2020, with its operators stealing an estimated $30 million in bitcoin from users. The Justice Department has prioritised dark web platform takedowns in recent years, targeting marketplaces including BreachForums, BidenCash, and Archetyp. On Thursday, it also announced a plea deal with a third individual, operator of Your Mule Cashout, a money laundering platform that coordinated a network of 15,000 money mules and supporting infrastructure to launder at least $10 million stolen from 750 bank accounts. This individual was arrested in the Republic of Georgia before pleading guilty and faces up to 50 years in prison.

Cyber incident hits grocery stores in US, Netherlands and Belgium - Ahold Delhaize, the Dutch multinational retailer, announced on Monday that it was taking precautionary measures following a cyber security incident, with stores in the US, the Netherlands, and Belgium reportedly affected. The company stated that its teams were assessing and mitigating the issue, including taking some systems offline as a protective measure, and that stores remained open. It did not disclose the nature of the incident or whether customer or employee data had been compromised. Disruption has been reported across distribution centres, online grocery orders, and in-store pricing, although it is unclear whether this stems from the incident itself or the precautionary measures. Ahold Delhaize operates in nine countries, employs more than 400,000 people, and owns US brands including Food Lion and Stop & Shop, where staff have discussed the incident on social media, with managers reportedly describing it as an IT outage, and customers have complained of a lack of information on scheduled deliveries.

In the Netherlands, NOS reported that subsidiaries Albert Heijn, Etos, and Gall & Gall have been affected since Sunday afternoon. Albert Heijn’s website, app, and customer service were unavailable, grocery deliveries were suspended, and electronic shelf labels displayed outdated promotional prices, with the brand stating it had disconnected systems to protect its IT environment but providing no timeline for restoration. In Belgium, VRT News reported that Delhaize customers were unable to place new orders or contact customer service, although the website and app remained accessible. The company previously suffered a cyber attack in 2024 that disrupted prominent US supermarkets and resulted in the theft of information belonging to more than 2.2 million people.

DOJ charges ransomware recovery CEO for secretly paying hackers - The owner of ransomware recovery firm MonsterCloud, Zohar Pinhasi, was charged with wire fraud and wire fraud conspiracy on Wednesday for allegedly falsely claiming the company could decrypt victims’ systems without paying ransoms. The Florida-based firm marketed proprietary decryption tools, but prosecutors allege Pinhasi simply paid the ransoms and charged victims fees far exceeding the original demands. He allegedly charged clients $19 million while paying around $8 million to cybercriminals, including one 2023 case in which an $8,200 ransom was paid and the client charged $150,000. Pinhasi faces up to 20 years in prison if convicted.

MonsterCloud was previously highlighted in a 2019 ProPublica investigation, which found that local governments and police departments were among its clients and that a researcher posing as a victim saw the firm immediately offer to pay the fake attacker. John Pistole, a former FBI deputy director acting as company spokesperson, openly acknowledged that paying ransoms was the business model. The indictment forms part of wider Justice Department efforts targeting the ransomware recovery industry, following four-year sentences handed in May to two ransomware negotiators who conducted covert attacks and colluded with ransomware gangs while purportedly representing victims.

Threat Actor Weekly Graph

Over the past 7 days, we have been tracking the following intent and opportunity changes within our Threat Actor Landscape.

Intent represents the potential targets of a group. When a group is observed attacking a different organisation or entity, their intent will increase.

Opportunity represents the various methods and technologies these groups may use. For example, if a group started using a new attack vector, such as a new kind of ransomware, their opportunity would increase.

Both intent and opportunity are scored out of 100 and are responsible for scoring the group's severity. These updates can be seen below.