Cyber Threat Intelligence Digest: Week 44

Executive Summary -
Highlights of Cyber Threat Intelligence Digest

Vulnerabilities

Cisco Patches Actively Exploited SSL VPN DoS Vulnerability CVE-2026-76418 Affecting Secure Firewall ASA and FTD Software - On 28 October 2026, Cisco reported active exploitation of CVE-2026-76418, a high-severity vulnerability affecting its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. Cisco first identified exploitation in October 2026 but has not disclosed further details about the activity at the time of writing. The flaw is an unchecked return value to NULL pointer dereference vulnerability in the SSL remote access VPN functionality of the affected software, stemming from logic errors associated with secondary authentication configured for a tunnel group. Successful exploitation allows an unauthenticated remote threat actor to trigger a denial-of-service (DoS) condition by sending a crafted VPN connection request.

To address CVE-2026-76418, Cisco has released software updates for the affected products. Cisco has also identified temporary mitigations for organisations unable to patch immediately. These include disabling the tunnel group list if DefaultWEBVPNGroup does not use secondary authentication, or removing secondary authentication from the default group if it is enabled.

Canonical Patches Critical Vulnerability CVE-2026-112816 Affecting LXD and MicroCloud - On 28 October 2026, Canonical disclosed a critical vulnerability, CVE-2026-112816, affecting LXD and MicroCloud versions 4.0.14, 5.0.10, 5.21.8, and 6.9. Canonical addressed the vulnerability in LXD versions 4.0.15, 5.0.11, 5.21.9, and 6.10.1, and MicroCloud versions 2.1.5 and 3.4.1. There is no evidence of active exploitation at the time of writing. CVE-2026-112816 is an improper certificate validation vulnerability that allows an unauthenticated threat actor with network access to the HTTPS API and a trusted client’s public certificate to impersonate that client without possessing its private key.

The authentication logic checks every certificate in a client-supplied chain against the trust store, although the TLS handshake establishes private-key possession only for the leaf certificate. A threat actor could therefore append a trusted public certificate to their own chain and obtain the corresponding identity’s permissions, potentially gaining access to clusters, managed virtual machines, and host root privileges depending on the impersonated identity. Standalone LXD installations ordinarily use a local socket and expose the HTTPS API only when administrators configure core.https_address. In MicroCloud, a threat actor could capture a joining cluster member’s public certificate and subsequently authenticate as that member.

Barracuda Patches CVE-2026-111560 and CVE-2026-116606 Affecting Six Security Products - On 2 November 2026, Barracuda disclosed and patched two vulnerabilities, CVE-2026-111560 and CVE-2026-116606, affecting six of its security products. CVE-2026-111560 affects Email Security Gateway (ESG), Load Balancer Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG), while CVE-2026-116606 affects only ESG. Barracuda released product-specific patches, including BNSF-40425 and BNSF-40430 for ESG, BNADC-16586 for ADC and WAF, BNMA-32468 for BMA, BNWF-60060 for WCC, and BNYF-24789 for WSG. At the time of writing, there are no reports of active exploitation.

CVE-2026-111560 is an OS command injection vulnerability affecting all six products, stemming from improper validation of timezone settings. Successful exploitation allows threat actors with administrative access to execute arbitrary system commands with root privileges. CVE-2026-116606 is a pre-authentication authorisation bypass vulnerability affecting ESG, which allows unauthenticated threat actors to bypass authorisation checks and modify device settings through a crafted backup file. When chained with CVE-2026-111560, the vulnerabilities allow threat actors to gain root access to the affected device.

Potential Threats

Threat Actors Use CyberStrikeAI to Automate Domain Compromise, Credential Theft, and Data Exfiltration - On 2 November 2026, Kaspersky’s Securelist reported a campaign using CyberStrikeAI, an open-source, Go-based penetration testing framework that pairs an LLM orchestrator with a C2 server and implants, to automate post-exploitation against educational organisations in Africa and Latin America. Initial access likely came via a compromised Microsoft SQL Server, from which the threat actors ran discovery commands through sqlservr.exe and downloaded RogueWinRM and GodPotato. Around two weeks later, PowerShell retrieved the implant from hxxp://185[.]186[.]245[.]144:8081/b[.]exe, saving it as C:\Windows\Temp\svchosts.exe. CyberStrikeAI panels were identified on 185[.]186[.]245[.]144 and 104[.]234[.]26[.]163, with fastcdn[.]bar and media[.]fastcdn[.]bar also linked to the infrastructure.

The implant persisted via a scheduled task named SystemUpdate, performed local and roughly five hours of domain reconnaissance (including LDAP, LAPS, SCCM, and Azure metadata checks), and used dnslog[.]cn for connectivity testing. After a four-day pause, the threat actors dumped the SAM, SYSTEM, and SECURITY hives and LSASS memory via comsvcs.dll MiniDump, then used wdiag2.exe for DCSync and Golden Ticket activity. They escalated privileges with multiple Potato variants and PrintSpoofer, moved laterally using Impacket WMIExec, SMB, and WMI/CIM methods, and exfiltrated data over the C2 channel via HTTP POST requests to /check_in with an X-Implant-Token header. The final phase took under an hour.

Threat Actors Actively Attempt to Exploit Critical WordPress CryptoPayment Gateway Vulnerability CVE-2026-81648 to Access Wallet Credentials - On 2 November 2026, Defused Cyber reported observed exploitation attempts targeting CVE-2026-81648, a critical vulnerability in the CryptoPayment Gateway WordPress plugin versions 1.2.1 to 1.2.2. The vulnerability stems from a missing authorisation check on an AJAX endpoint, allowing unauthenticated threat actors to invoke administrative functions to retrieve payment-gateway settings containing wallet credentials in cleartext, overwrite the gateway configuration, and delete arbitrary files on the server. These capabilities could compromise payment processing and expose credentials used to access associated wallets. There is no fixed version at the time of writing, and no evidence of successful compromise or theft of cryptocurrency.

Defused Cyber reported that the observed attempts originated from infrastructure advertised as providing anonymous VPS hosting without know-your-customer requirements. The researchers did not identify the responsible threat actors or disclose a verified count of affected websites, though a list of IOCs is available on its platform. As of 3 November, version 1.2.2 remained the latest release. The WordPress Plugin Directory closed the plugin on 28 August due to an unspecified security issue, and although it had accumulated 1,845 downloads, its active installation count is unknown.

Threat Actors Use Microsoft Teams Help Desk Impersonation in Separate ESC1 and ESC8 Attacks - On 30 October 2026, Microsoft Threat Intelligence reported two separate attacks in which unknown threat actors impersonated IT support personnel through Microsoft Teams messages and calls. Both began with employees approving remote-control sessions, primarily through Quick Assist, before diverging into different Active Directory Certificate Services (AD CS) abuse paths. The threat actors transferred archives, executed scripts via portable Python, Bun, or Java environments, and examined system and AD CS configurations, without exploiting any vulnerabilities in Teams or Quick Assist. In the first attack, two social-engineering waves compromised two workstations, and the threat actors abused ESC1, a certificate template misconfiguration allowing users to request certificates for other identities. They obtained certificates for 11 privileged accounts and used one to perform DCSync against a domain controller. Microsoft Defender contained most affected identities and blocked over 1,000 SMB file-access attempts, but one privileged account excluded from automated containment remained accessible and was used to exfiltrate file server data to an external SFTP server via Rclone renamed as SearchApp.exe.

In the second attack, the threat actors used PetitPotam to coerce NTLM authentication from a domain controller and relayed it to an AD CS Web Enrollment service lacking relay protection (ESC8). This yielded a certificate for the domain controller account, which they used with Kerberos PKINIT to obtain a ticket-granting ticket. Microsoft Defender alerted the affected organisation, which isolated the compromised workstation before further progression. Microsoft has not identified the affected organisations, disclosed the volume of stolen data, or attributed either attack.

General News

Google dismantles massive botnet hidden in Android TV boxes - Google, alongside Japanese law enforcement and cyber security firms TrendAI, Human, and Synthient, has dismantled X.CPE, a global botnet embedded in the firmware of more than 1.3 million devices across over 200 countries. The majority of infected devices are Android TV set-top boxes, though telehealth devices, karaoke machines, and digital signage were also affected. Google attributed the scheme to Videostrong Technology, a Chinese Android original equipment manufacturer, and accused it of monetising the backdoor by selling access to criminal affiliates and loading their malware modules onto infected devices. The botnet generated revenue through residential proxy bandwidth resale, data exfiltration, ad fraud, video content delivery, loading additional backdoors, and paid app installs. Videostrong allegedly used obfuscation techniques to pass Google’s security testing and updated the malware in 2024 and 2026, evolving it from single-stage droppers into a modular three-stage architecture. The malware automatically reinstalled if removed and could silently download and execute further files without user consent. Videostrong did not respond to requests for comment.

Google took legal action to seize the domains Videostrong used for command and control and malware delivery, as well as those used by affiliate malware families. A senior Google Threat Intelligence Group representative stated that severing these domains effectively renders the malware benign, and Google claimed the takedown of affiliate C2 infrastructure may have cut off criminal access to a further 10 million compromised devices, many of which are not Android-based. A TrendAI cybercrime research lead warned that affected households and businesses were unknowingly facilitating ad fraud and proxy-enabled attacks, including identity theft. Google has cut ties with Videostrong, banned it and any future subsidiaries from selling Android devices or supplying software to certified vendors, and pledged to strengthen its review process. Google has not stated whether affected customers will be notified or whether malware will be forcibly removed from compromised devices.

British businesses caught in Europe-wide supermarket fridge attacks - A second wave of cyberattacks targeting supermarket and grocery store refrigeration controls across Europe took place in the early hours of Monday, following an earlier wave in France, with unidentified perpetrators remotely defrosting fridges and causing stock to spoil. The Association of Independent Meat Suppliers (AIMS) confirmed that three of its British members were affected via vulnerable Copeland XWEB supervisory controllers, though none lost meat, and British wholesaler Langridge Organic also reported being targeted. Its managing director believed he had interrupted a live attack after observing a fridge being placed into defrost mode and physically disconnecting it from the internet, preventing any spoilage. All affected British suppliers were reportedly running Copeland XWEB firmware version 1.12.1 or earlier, which contains severe authentication bypass vulnerabilities allowing control without a password, despite a firmware update being available since August, when Claroty disclosed almost two dozen vulnerabilities in Copeland’s XWEB Pro controllers. Copeland confirmed certain XWEB monitoring solutions are affected and has re-issued patching and security guidance to customers. No group has claimed responsibility, and neither British nor Belgian authorities have attributed the attacks.

The NCSC confirmed it is assisting affected organisations and worked overnight to proactively contact companies with vulnerable internet-exposed systems. Senior NCSC officials described the national impact as minimal but significant for individual affected businesses, characterised the attacks as unsophisticated and reliant on long-known vulnerabilities, and expressed surprise that such devices remain internet-connected in 2026 despite prior warnings. Speaking at the launch of its annual report, which warns of widespread failure to implement basic cyber protections and a potential unprecedented rise in incidents, the NCSC described the refrigeration attacks as an early indicator of the wider threat. AIMS is urging the government to give the food sector greater prominence in critical national infrastructure designation, as no food sector assets are currently designated and the sector is excluded from the forthcoming Cyber Security and Resilience Bill, which would impose fines of up to £17 million or 4% of global turnover for serious security failures. The EU’s NIS2 legislation does cover food production and distribution, though its breadth has drawn criticism.

UK to look at making software companies liable for cyber breaches - The UK government has committed, in budget documents published on Wednesday, to consult next year on tackling insecure technology at source and determining where liability for cyber breaches should sit, marking the first formal pledge by a British government to examine the issue. The move follows years of reliance on voluntary codes and sustained pressure from the NCSC, whose chief technology officer has repeatedly argued that market incentives fail to reward secure product development. It also follows a House of Commons Business and Trade Committee report urging ministers to make the NCSC’s voluntary software security code of practice legally binding, citing the Jaguar Land Rover attack, estimated to have cost the UK economy £1.9 billion. The consultation will build on an ongoing Law Commission review, running until 14 January, which proposes extending the Consumer Protection Act 1987 to cover software and AI systems. Key details remain unclear, including which department will lead, when it will begin, and whether ministers favour civil liability, statutory vendor obligations, or both, with expanding the PSTI Act a likely option. The current Cyber Security and Resilience Bill stops short of imposing obligations on software developers, while the EU’s Cyber Resilience Act permits fines of up to €15 million or 2.5% of global turnover from December 2027. Any UK regime is expected to align with EU rules but is likely to face resistance from the Business Software Alliance and potential friction with the United States.

Alongside the consultation, the budget commits £154 million in new cyber defence funding. The largest allocation is £70 million for a National Exposure and Real-Time Vulnerability (NERV) Centre at the NCSC, which will use AI to identify vulnerabilities across critical infrastructure and the wider economy, though it is unclear how this will differ from the NCSC’s existing Early Warning and Proactive Notifications services. A further £60 million will fund the first phase of the NCSC’s Cyber Shield, an agentic AI capability to discover and remediate weaknesses across government networks and critical national infrastructure, with the remainder directed at public sector systems including local authorities, hospitals, and schools. Separately, £40 million will establish a National Agentic Security Unit to detect and respond to rogue AI agents, though its host agency has not been confirmed, and the AI Security Institute will receive £120 million over four years to expand frontier AI model testing. The announcements follow a week in which AI-discovered critical PHP flaws forced websites offline globally, prompting the NCSC to urge organisations to patch or take affected systems offline.

Threat Actor Weekly Graph

Over the past 7 days, we have been tracking the following intent and opportunity changes within our Threat Actor Landscape.

Intent represents the potential targets of a group. When a group is observed attacking a different organisation or entity, their intent will increase.

Opportunity represents the various methods and technologies these groups may use. For example, if a group started using a new attack vector, such as a new kind of ransomware, their opportunity would increase.

Both intent and opportunity are scored out of 100 and are responsible for scoring the group's severity. These updates can be seen below.