Welcome to the weekly highlights and analysis of the blueteamsec (and my wider reading). Not everything makes it in, but the best bits do. A community member is doing daily AI generated podcast of the last 24hours of posts.
Operationally this week supply chain attacks continue to be substantial in software eco-systems. The reporting below is extensive from both the cyber threat intelligence providers as well as from victims..
In the high-level this week:
The Bank, FCA and HM Treasury joint statement on Frontier AI models and cyber resilience - Bank of England, Financial Conduct Authority and HM Treasury outline - “In line with our operational resilience rules and expectations, regulated firms and financial market infrastructures (FMIs) (referred to as ‘firms’), need to take action to plan for and mitigate cybersecurity risks posed by frontier AI.”
the NCSC funded Research Institute for Sociotechnical Security annual report - RISCS publishes - “If cyber security doesn’t work for people, it doesn’t work. Sociotechnical problems and solutions cut across all areas of cyber security, but there are four key themes around which these problems and solutions cluster:
1. Barriers and Incentives (including Economics)
2. Future Risks and Resilience (including AI)
3. Cultures and Communications (including International Relations)
4. Usability and Trust (including Insider Threat) “
DSIT cyber security newsletter - May 2026 - Department for Science, Innovation & Technology publish - “New statistics from the UK cyber security sectoral analysis 2026 show strong growth in the sector, with cyber firms generating revenue of £14.7 billion, up 11% on last year. The number of companies is up 20% to 2,603 whilst the sector has created 2,300 new jobs, bringing total direct employment in the sector to 69,600 people.”
HM Government licensing cyber security tech for a global market - Department for Science, Innovation and Technology and Government Office for Technology Transfer case study - “Following a competitive process, a global IP licence for SilentGlass has been agreed with a UK‑based company. The device is now available globally. The licensed product will enable wider access to a high‑assurance cyber security solution originally developed for government use, supporting safer deployment of digital technologies and helping share the benefits of public sector innovation more widely across the UK and globally.”
CISA Enhances Known Exploited Vulnerabilities Catalog to Include New Nomination Form - CISA announce - “New form bolsters quality of submissions and reinforces community-driven approach to drive down our collective cybersecurity risk”
Hackers have breached tank readers at US gas stations; officials suspect Iran is responsible - CNN reports - “US officials suspect Iranian hackers are behind a series of breaches of systems that monitor the amount of fuel in storage tanks serving gas stations in multiple states, according to multiple sources briefed on the activity. The hackers responsible have exploited automatic tank gauge (ATG) systems that were sitting online and unprotected by passwords, allowing them in some cases to tinker with display readings on the tanks but not the actual levels of fuel in them, the sources said.”
2026 Data Breach Investigations Report - Verizon release - “31% of breaches now start with software vulnerabilities, beating stolen passwords as the top way attackers get in. Hackers are shifting their focus from tricking people to exploiting systems.” - still shows than passkeys are important to address the other 59%
Recommendation of the Government Plenipotentiary for Cybersecurity regarding the Signal messenger - Polish Government publish - “The Government Plenipotentiary for Cybersecurity has issued a recommendation to entities within the National Cybersecurity System to mitigate the risks associated with using the Signal messenger. This is due to the increased activity of APT-type hacking groups targeting account takeovers on this messenger.”
Update of the PACS requirements repository to version 2.0 - ANSSI update - “For the substantial qualification level, consultants' knowledge and skills are no longer verified through written and oral examinations but through an assessment of the organization and processes implemented by the service provider to verify and maintain the knowledge and skills of its consultants. This new provision will allow PACS (Professional Advisory Services Centers) providing substantial-level services to have a larger pool of consultants, and therefore reduce the time required to obtain a qualified service.”
Opinion 15/2026 on the Europrivacy certification criteria regarding their approval by the Board as European Data Protection Seal to be used as tool for transfers pursuant to Articles 42 and 46 GDPR - European Data Protection Board opines - “Certification mechanisms to be used as a tool for transfers should enable data importers to demonstrate the existence of appropriate safeguards in order to ensure that the level of protection of natural persons guaranteed by the GDPR will not be undermined when transferred personal data will be processed outside the EEA”
Reporting on/from China
China’s Science and Technology Strategy in Perspective - RAND Corporation publish - “China’s S&T system has grown increasingly sophisticated and globally influential, yet its emphasis on control, security, and centralized coordination differentiates it from Western research models that are based on transparency and institutional autonomy. These dynamics— combining high capacity for technological mobilization with limited openness—shape both China’s domestic trajectory and its international partnerships”
Why China Is Now a Peer Competitor to the United States in Cyberspace - Centre for Strategic & International Studies outlines - “China has systematically evolved and matured its cyber capabilities over the last 15 years (if not longer), to such an extent that it sets it apart from other U.S. adversaries in cyberspace. Across the full levers of statecraft, whether intelligence, diplomacy, military, economic, or societal levers, China demonstrates an ability to mobilize a whole-of-society approach to dominating cyberspace. And in some specific areas, such as offensive cyber (OC) capabilities, China even outpaces the United States, making it no surprise that the Dutch Military Intelligence and Security Service recently labeled China as being “on an even footing” with the United States in OC”
How ByteDance plans to turn OpenClaw craze into a profitable AI business - South China Morning Post reports - “ByteDance’s Volcano Engine, the cloud unit that released an OpenClaw-based cloud agent tool ArkClaw, is betting that the next phase of artificial intelligence will hinge on cheaper tokens, higher inference efficiency and longer context windows. “Agent-related token consumption still accounts for a single-digit percentage of total token usage, but it is growing,” said Li Guodong, chief architect of ArkClaw
China’s tech giants look to rewrite the e-commerce playbook with AI agents - South China Morning Post reports - ”Liu is one of China’s over 900 million e-commerce users taking part in what has become a massive nationwide retail experiment. Tech companies are racing to replace the rigid, traditional search bar with agentic AI, a move aimed at transforming online shopping from the previous routine of manual clicks into a more streamlined, natural dialogue.”
China Establishes New Agency for the Low-Altitude Economy - Caixin Global reports - “The Low-Altitude Safety Department is responsible for formulating development plans to help develop commercial activity in the airspace close to the ground, including those for coordinating safety and building flight dispatch platforms and service stations, according to information on the website of the Civil Aviation Administration of China (CAAC).”
China’s Cyber Law Development Report (2025) - Cyberspace Administration of China publishes
Q&A on the “China Cyber Law Development Report (2025)” - “As of December 2025, China had promulgated more than 180 laws in the cyber domain, providing a solid institutional guarantee for building a cyber power. First, it improved the basic system in the cyber domain, amended the "Cybersecurity Law of the People's Republic of China," enriched the guiding principles for cybersecurity work, clarified the provisions on artificial intelligence security and development, improved the legal liability system, expanded the scope of extraterritorial application, and further consolidated the legal foundation for building a cyber power.”
Annual Report on Cyberspace Asset Mapping and Reverse Mapping 2025 - Tsinghua University, Beijing Haidian District Internet Emergency Center, Sichuan University, Shandong Port Technology Group Qingdao Co., Ltd., National University of Defense Technology, Yuanjiang Shengbang Security Technology Group Co., Ltd., China Huadian Corporation, Cyberspace Mapping Professional Committee of China Command and Control Society publish - showing how deeply they think about mapping the Internet.
AI
Safeguarded AI funding call - NCSC supported ARIA announce - “As part of our updated programme thesis, we seek to test and accelerate the hypothesis that AI-enabled formal methods can make high-assurance cyber defence practical at scale. Within Technical Area 2, this funding call pursues the question: given the advances in AI and formal methods, what are the most ambitious, security-critical systems we can verify today?”
Project Glasswing: An initial update - Anthropic publish - of 23,000 candidate findings led to 1,596 reports disclosed
AI-generated reporting: Lessons learned from Cisco Talos Incident Response - Cisco share - “Various types of inconsistencies in AI output frequently diminish the efficiency gains that AI reporting processes promise to deliver. At their core, most inconsistencies stem from the probability-driven nature of LLMs. These models generate output by predicting the next token, typically a word or sub-word, in a sequence, based on model weights and training data. In essence, this means that no two LLM outputs will be identical, even when provided with the exact same prompt multiple times.”
Will it become harder to oversee AI systems? - UK AI Security Institute discuss - “In a new report, we map the current landscape of AI oversight, and how it is likely to change. The report draws on 25 expert interviews across frontier AI developers, government, NGOs, and academia, together with a literature review and independent analysis of pathways to the degradation of oversight. We identify current oversight methods, and the properties of current AI systems that these methods rely on. We also examine the pathways by which they could degrade, and the technical levers available to preserve them.”
Cyber proliferation
Starlink users, beware – Israeli tech can reveal your identity - Haaretz reports - “Sold to governments, these systems do not hack into Starlink or intercept its traffic. Instead, sales documents obtained for this investigation revealed that they map the locations of Starlink terminals across the globe, exposing the location of those connecting to the internet through the devices.”
Bounty Hunting
Canadian man arrested by international authorities, charged with administrating KimWolf DDoS botnet - US Department of Justice announce - “According to court documents, on April 10, 2026, U.S. authorities criminally charged Jacob Butler, aka “Dort,” 23, of Ottawa, Canada, with offenses related to the development and operation of the KimWolf botnet. KimWolf was a DDoS-for-hire service which infected over a million devices worldwide, including devices located in Alaska. The complaint remained sealed pending Butler’s arrest.”
Cybercriminal VPN used by ransomware actors dismantled in global crackdown - EuroPol announce - “A VPN service used by cybercriminals to conceal ransomware attacks, data theft, and other serious offences has been dismantled in an international operation led by France and the Netherlands, with support from Europol and Eurojust.”
Chinese SMS Blaster Scammer Attacks Eurovision in Vienna - CommsRisk reports - “A 32 year old Chinese national was arrested by Austria's Cobra tactical police unit outside the Eurovision Song Contest. The scammer's 6 year old son was also in the car.”
Market Incentives
Korean Regulators Recruit Hackers to Test Financial Apps and Trading Systems - The Korea Bizwire reports - “Under the program, participants can search for security flaws in websites, mobile applications and home trading systems operated by financial firms and receive rewards of up to 10 million won, or roughly $7,400, per verified case.”
The Insurability Frontier of AI Risk: Mapping Threats to Affirmative Coverage, Silent Exposures, and Exclusions - AIFT publish - “Three patterns emerge. First, affirmative AI coverage is beginning to differentiate by primary risk emphasis: public materials often position Munich Re around model performance and drift, Armilla and parts of the Lloyd’s market around hallucination and broader AI liability, Tokio Marine Kiln and CFC around IP and technology E&O concerns, Apollo ibott around emerging autonomous system liability, and Coalition around deepfake and AI-enabled cyber response. Second, legacy lines retain silent-AI exposure where AI is an instrumentality rather than the legal cause of loss. Third, foundation model concentration is the clearest genuinely novel insurability frontier because upstream model failure can correlate losses across many cedents at once; the relevant market design question is which insurability constraint each candidate structure relaxes, not merely which systemic risk template exists.”
M&S profit slumps in fallout from cyber attack - CityAM reports - “The 141-year-old retailer said it faced a “year of two halves” as it battled back to its feet in the first half of the year following the cyber attack, and pushed to return to growth in the second half.”
No reflections this week, but I did record a feature with the Patrick and James over at Risky Business. This is around preparation and response to our latent technical debt being surfaced by AI and how we evolve are patching approaches and beyond,,.
Not getting this via email? Subscribe:
Think someone else would benefit? Share:
All attribution is by others and not the UK Government unless specifically stated as such, please see the legal text at the end.
Have a lovely Saturday…
Ollie
Cyber threat intelligence
Who is doing what to whom and how allegedly.
Reporting on Russia
Nothing overly of note this week
Reporting on China
Introducing Showboat: A new malware family taunts defenses and targets international telecom firms
Black Lotus Labs detail this alleged Chinese operation and capability which is noteworthy for the sector targeting.
Black Lotus Labs identified a new Linux malware family we dubbed “Showboat.” The campaign has been active since at least mid-2022.
Showboat is a modular post-exploitation framework designed for Linux systems, capable of spawning a remote shell, transferring files and functioning as a Socks5 proxy.
Multiple threat clusters aligned with the People’s Republic of China (PRC) have been observed using the same post-exploitation frameworks and techniques in recent years. Showboat was in use by at least one, and likely several, PRC-aligned threat activity clusters.
The campaign impacted a telecommunications provider in the Middle East and impersonated telecom firms in Southeast Asia.
Black Lotus Labs collaborated with PricewaterhouseCoopers’ Threat Intelligence teams through the research process. We will continue to hunt for samples of this and similar malware to protect our customers and critical infrastructure.
Inside Red Lamassu’s JFMBackdoor
PwC pick up the story of the above alleged Chinese operation with further capability analysis which is again noteworthy due to sector focus.
Our analysis revolves around an open directory found during our hunting of Red Lamassu, containing both an aforementioned kworker sample, alongside a fully featured Windows backdoor, which we call JFMBackdoor. Delivered via DLL side-loading, JFMBackdoor supports a range of capabilities, including: remote shell access, file system operations, network proxying, screenshot capture, and self-removal capabilities.
Chinese APT Campaign Targets Entities with Updated FDMTP Backdoor
DarkTrace detail this alleged Chinese campaign where the initial access approach is not known.
Beginning in late September 2025, multiple affected hosts were observed making requests to domains impersonating content delivery networks (CDNs), including infrastructure masquerading as Yahoo- and Apple-affiliated services. Across these cases, Darktrace identified a consistent behavioral execution pattern: the retrieval of legitimate binaries alongside malicious Dynamic Link Libraries (DLLs), enabling sideloading and execution of a modular .NET-based Remote Access Trojan (RAT) framework.
..
Across cases, the same ordered sequence appears: retrieval of a legitimate executable, (2) retrieval of a matching .config file, (3) retrieval of the malicious
DLL, (4) repeated DLL downloads over time, and (5) command-and-control (C2) communication. The .config file retrieves a malicious binary, while the legitimate binary provides a legitimate process to run it in.
Darktrace assesses with moderate confidence that this activity aligns with publicly reported Twill Typhoon tradecraft. The observed use of FDMTP, DLL sideloading, and overlapping infrastructure is consistent with previously observed operations, though not unique to a single actor. While initial access was not directly observed, previous Twill Typhoon campaigns have typically involved spear-phishing.
https://www.darktrace.com/blog/chinese-apt-campaign-targets-entities-with-updated-fdmtp-backdoor
Webworm: New burrowing techniques
Eric Howard detail the capabilities of an alleged Chinese threat actor which is noteworthy due to a pivot in focus to Europe.
ESET researchers analyzed the 2025 activity of Webworm, a China-aligned APT group that started out targeting organizations in Asia, but has recently shifted its focus to Europe. Even though this is our first public blogpost on the group, we have been observing Webworm’s activities ever since Symantec first reported on this threat actor in 2022. Over the years, we have seen that this threat actor continually changes its tactics, techniques, and procedures (TTPs).
Since its discovery in 2022, the Webworm APT group has been actively updating its toolset and targeting.
In 2025, the group started employing backdoors that use Discord and Microsoft Graph API for C&C communication.
ESET researchers decrypted over 400 Discord messages and a bash history file discovered on an operator server with reconnaissance commands used against more than 50 unique targets.
In addition to backdoors, Webworm leverages multiple existing and custom proxy tools.
The group uses GitHub to stage its malware.
https://www.welivesecurity.com/en/eset-research/webworm-new-burrowing-techniques/
Suspected China-Linked Threat Actor Targets Global Manufacturer with Undocumented TencShell Malware
Idan Tarab,Dr. Guy Waizel,Zohar Buber and Shani Kurtzberg detail an alleged Chinese operation which is noteworthy due to a new implant but also the fact they are using Donut.
[We] identified and blocked an attempted intrusion against a global manufacturing customer involving TencShell, a previously undocumented, Go-based implant derived from the open-source Rshell C2 framework.
The activity appeared in traffic associated with a third-party user connected to the customer environment.
The attack chain used a first-stage dropper, Donut shellcode, a masqueraded .woff web-font resource, memory injection, and web-like C2 communication. We assess the activity as suspected China-linked based on the apparent Rshell lineage, Tencent-themed API impersonation, and infrastructure patterns, While this pattern is relevant to our suspected China-linked assessment, it is not sufficient on its own for attribution.
From PDB strings to MaaS: Tracking a commodity BadIIS ecosystem used by Chinese-speaking threat
Joey Chen builds on the existing reporting of this alleged Chinese actor and operation. Noteworthy for the intent of search engine optimisation.
Cisco Talos has uncovered a BadIIS variant — identifiable by its embedded “demo.pdb” strings — that functions as commodity malware. This variant is likely sold or shared among multiple Chinese-speaking cybercrime groups that operate under a malware-as-a-service (MaaS) model for continuous monetization.
Analysis of program database (PDB) file paths reveals a sustained, multi-year development effort by an author operating under the alias “lwxat”, spanning from at least September 2021 through January 2026, with evidence of rapid iterative updates, feature branching, and reactive evasion tactics targeting specific security vendors such as Norton.
Talos recovered a dedicated builder tool that allows threat actors to generate configuration files, customize payloads, and inject parameters into BadIIS binaries — enabling capabilities including traffic redirection to illicit sites, reverse proxying for search engine crawler manipulation, content hijacking, and backlink injection for malicious search engine optimization (SEO) fraud.
Beyond BadIIS, the same author has developed a suite of auxiliary tools — including service-based installers, droppers, and persistence mechanisms that automate deployment, ensure survivability across IIS server restarts, and evade detection through custom Base64 encoding and obfuscation techniques.
https://blog.talosintelligence.com/from-pdb-strings-to-maas-tracking-a-commodity-badiis-ecosystem/
Reporting on North Korea
North Korean-Linked Threat Actor Targets Developers with New npm Infostealer RAT
Moshe Siman Tov Bustan and Nir Zadok detail an alleged North Korean operation which is noteworthy due to the alleged actor but also what they are looking to steal and thus have downstream impact around.
The package, ‘terminal-logger-utils,’ targets Telegram data, SSH keys, crypto wallets, cloud configurations (AWS, GCP, Azure), environment variables, and more. Three dependent packages import it and trigger the malicious behavior when installed: pretty-logger-utils, ts-logger-pack, and pinno-loggers.
The threat actor behind the upload – jpeek895 – was previously reported on kmsec.uk for uploading a similar npm package linked to DPRK activity.
https://www.ox.security/blog/north-korean-npm-infostealer-rat/
Analysis of APT-C-55 (Kimsuky) group’s attack activities involving the distribution of malicious payloads via GitHub and Dropbox
360 Threat Intelligence Center in China report an alleged North Korean operation. The attacks are rudimentary but an important reminder on what to block.
Kimsuky launches a phishing attack via an .lnk file . After the user clicks to run the script , the script within the .lnk file decrypts and opens the bait file to mislead the victim. Simultaneously, it downloads the `taskschd.vbs` script from Dropbox to execute malicious functions. This VBS script then downloads and executes the `downloader` script from the attacker's GitHub repository . The downloader further downloads two Powershell scripts : one uploads basic information about the victim's computer to the attacker's repository and creates a scheduled task to execute ` taskschd.vbs` ; the other, ` ps1` , downloads encrypted data and decrypts an AsyncRAT variant to steal sensitive information.
Reporting on Iran
Nothing overly of note this week
Iran-linked Operators Suspected in ATG Breaches
Censys drop a truth bomb around an alleged Iranian operation..
This report follows CNN’s 15 May 2026 report that US officials suspect Iran-linked operators of breaching internet-facing Automatic Tank Gauges (ATGs) at US gas stations. Censys finds 6,502 ATG services on 6,057 hosts (excluding hosts where any service is labeled
HONEYPOT) still reachable on the public internet today. Every ATG service indexed in Censys is reachable without authentication. The protocol has no login. A single unauthenticatedI20100command returns the station’s brand, street address, phone number, and live tank readings on 60.1% of these services.
6,502 ATG services on 6,057 hosts in 65+ countries, May 2026. Honeypots excluded.
3,907 services (60.1%) leak a full
I20100in-tank inventory: station brand, name, address, sometimes a phone number, and live volume / ullage / water-bottom readings.United States: 4,224 hosts (70%). Considered separately, Puerto Rico is second at 350 hosts, of which 347 sit on a single ISP (COQUI-NET / DATACOM CARIBE). Top US ASNs are residential and small-business broadband and cellular ISPs: Verizon Wireless / CELLCO-PART (667), Comcast / CMCS (373), CYBERA Inc. (281), Charter / CHARTER-20115 (241), AT&T (208), UUNET / Verizon Business (171). Comcast and Charter each appear under multiple ASNs in the long tail.
Notable brands found running ATG: Shell (602), Mobil (184), BP (78), Texaco (68), Puma (52, LatAm), Marathon (47), Exxon (41), Sunoco (37), Gulf (32), Citgo (31), Chevron (23), Valero (23).
https://censys.com/iran-linked-operators-suspected-in-atg-breaches/
Tracking Iranian APT Screening Serpens’ 2026 Espionage Campaigns
Unit42 detail an alleged Iranian operation which is on going with new capability. Noteworthy as it shows continued investments and skill / knowledge evolution.
Screening Serpens primarily targets technology sector professionals, using highly tailored social engineering. The group frequently uses personalized recruitment lures that impersonate trusted brands and hiring platforms, to trick targets into initiating the infection chain.
We assess with moderate-high confidence that the campaigns discussed in this article are conducted by Screening Serpens. The group has maintained a consistently high operational tempo throughout March and April 2026.
We have grouped the six newly discovered RAT variants into two new malware families that were deployed in concurrent espionage campaigns. Based on the timing of deployment, our analysis indicates two sets of coordinated cyberattacks. At least one variant was compiled and deployed with specific timing instructions.
Our analysis reveals a continuous cycle of development and deployment, characterized by specialized and upgraded variants with diverse functionalities, as shown in each targeted campaign.
The most critical evolution in the group’s recent campaign uses a technique called AppDomainManager hijacking. This hijack method manipulates the initialization phase of .NET applications to proactively disable the application’s own security mechanisms via a legitimate configuration file. The disabled security in these apps left the targeted entities vulnerable to the deployed multi-functional RATs.
https://unit42.paloaltonetworks.com/tracking-iran-apt-screening-serpens/
Reporting on Other Actors
How Storm-2949 turned a compromised identity into a cloud-wide breach
Microsoft Defender Security Research Team detail how some criminal threat actors have cloud skills which is noteworthy if you don’t have comprehensive defensive coverage of your cloud environment.
Storm-2949 didn’t rely on traditional malware and other on-premises tactics, techniques, and procedures (TTPs). Instead, they leveraged legitimate cloud and Azure management features to gain control-plane and data-plane access, which they then used to execute code remotely on VMs, and access sensitive cloud resources such as Key Vaults and storage accounts, among others. These activities allowed them to move laterally across cloud and endpoint environments while blending into expected administrative behavior.
ZionSiphon OT Malware First Attempts? Psyops? Both?
DomainTools highlight some interesting and important discrepancies which raise more questions than they answer.
ZionSiphon is a malware sample (“SCADA_SecurityPatch_v8.4.exe”) that has been circulating in public sandboxes since 2025. It is best understood as a Windows-based implant with explicit industrial control system (ICS) targeting intent but with a critical limitation in its verification of geographic data that fundamentally constrains its operational viability. While earlier analysis established the malware as functionally capable at the host level, subsequent findings confirm the presence of a critical XOR bug in its geographic validation logic, preventing the payload from activating in its intended environment. Additionally, there is no evidence of vendor-specific protocol handling, no confirmed register mapping, and no interaction with PLC firmware or engineering toolchains. The malware appears to rely on file-based or high-level configuration manipulation, which may not translate into actual process changes in most industrial environments.
The malware’s architecture remains coherent and deliberate. It combines geographic scoping, environment-aware execution, and embedded process manipulation logic, demonstrating a structured conceptual model of water treatment and desalination systems. Its internal string corpus provides high-confidence evidence of targeting, including references to Mekorot and major desalination facilities such as Sorek, Hadera, Ashdod, Palmachim, Shafdan, and Eilat water plants in Israel, alongside a dense vocabulary covering reverse osmosis, chlorine dosing, and salinity control. Filesystem-based validation and vendor-associated paths further reinforce that the malware is engineered to identify and operate within specific industrial environments.
https://dti.domaintools.com/research/threat-intelligence-report-zionsiphon
The Gentlemen Ransomware Group — Leak Analysis
Alexandre Dulaunoy, Chaitanya H., Dani [Varys] K, Ellis Stannard, Eric Taylor, Jeffrey Bell, Katya K, Nick Smart, Olivier Ferrand, Pedro Moura, Rakesh Krishnan, Vlad G, and Valéry Rieß-Marchive provide some useful insights from their analysis of this leak from a criminal group.
The Gentlemen are assessed with moderate-high confidence to be a Black Basta successor faction — a splinter group formed by experienced Black Basta affiliates and operators who carried forward playbooks, infrastructure access, and operational methodology when Black Basta collapsed in early-to-mid 2025. This is not a rebrand (different leadership structure, different brand identity, different locker), but an organisational descendant with direct personnel continuity from the Conti → Black Basta lineage.
https://ransom-isac.org/blog/the-gentlemen-leak-analysis/
SHub Reaper | macOS Stealer Spoofs Apple, Google, and Microsoft in a Single Attack Chain
Phil Stokes detail an interesting social engineering led campaign.
Reaper uses fake WeChat and Miro installers as lures, but what stands out is the way the infection chain shifts its disguise at each stage. The payload may be hosted on a typo-squatted Microsoft domain, executed under the guise of an Apple security update, and persist from a fake Google Software Update directory. Alongside the previously documented SHub feature set, the build also adds an AMOS-style document theft module with chunked uploads.
Living off the Land with VS Code: Inside a Sophisticated Phishing Campaign
JoeSecurity detail a campaign which is interesting for victimology as well as the use of VS Code tunnels etc.
In this blog post, we examine a multi-stage phishing campaign targeting staff members of the Punjab Safe Cities Authority (PSCA) and PPIC3 in Pakistan. The attack leveraged two distinct infection vectors, both relying on the same underlying infrastructure.
https://joesecurity.org/blog/8858614039441223943
Middle East Malicious Infrastructure Report: 1,350+ C2 Servers Mapped Across 98 Providers
Hunt.io highlight the concentration risk associated with C2 hosting in the middle east.
More than 1,350 C2 servers were identified across 98 Middle East infrastructure providers within the past 3 months.
C2 infrastructure dominates malicious activity (~96.8%), far exceeding phishing infrastructure (~0.5%) and publicly reported IOCs (~0.5%), while malicious open directories account for the remaining ~2.2% of observed artifacts.
Saudi Arabia’s STC (Saudi Telecom Company) hosts 981 C2 servers, representing 72.4% of all detected C2 infrastructure in the region, the largest concentration observed across any single provider globally.
A small set of hosting providers accounts for a disproportionate share of malicious infrastructure, with STC, SERVERS TECH FZCO (UAE), OMC (Israel), Türk Telekom, and Regxa (Iraq) hosting the largest volumes of detected C2 servers.
IoT-focused botnets (Hajime, Mozi, and Mirai) combined with offensive frameworks (Tactical RMM, Cobalt Strike, Sliver) represent the dominant malware families operating across Middle Eastern infrastructure.
Middle Eastern hosting environments support diverse malicious operations, including state-sponsored espionage campaigns, MaaS (Malware-as-a-Service) platforms, cryptomining operations, and targeted intrusion activity.
https://hunt.io/blog/middle-east-malicious-infrastructure-report
Supply Chain Attacks
Various reporting as there are so many. Here is a sample from the past week..
TeamPCP compromises NPM maintainer with over 540 packages - https://opensourcemalware.com/blog/teampcp-compromises-npm-maintainer-with-over-540-packages
Mini Shai-Hulud Hits @antv Ecosystem, 639 Compromised npm Package Versions - https://socket.dev/blog/antv-packages-compromised
New Actors Deploy Shai-Hulud Clones: TeamPCP Copycats Are Here - https://www.ox.security/blog/new-actors-deploy-shai-hulud-clones-teampcp-copycats-are-here/
Compromised Nx Console version 18.95.0 - https://github.com/nrwl/nx-console/security/advisories/GHSA-c9j4-9m59-847w
Popular node-ipc npm Package Infected with Credential Stealer - https://socket.dev/blog/node-ipc-package-compromised
Megalodon: New CI/CD Malware Spreads Across GitHub, Infecting ~5,000+ Repositories - https://www.ox.security/blog/megalodon-cicd-malware-github/
Coruna Respawned: Compromised art-template npm Package Leads to iOS Browser Exploit Kit - https://socket.dev/blog/coruna-respawned-compromised-art-template-npm-package
Discovery
How we find and understand the latent compromises within our environments.
Nothing overly of note this week…
Defence
How we proactively defend our environments.
A blueprint for formal verification of Apple corecrypto - Apple Security Research
Apple Security Engineering and Architecture (SEAR) and Hardware Technologies Formal Verification outline their approach to formal verification of their cryptography implementation at least for PQC..
https://security.apple.com/blog/formal-verification-corecrypto/
A Deep Dive into Codex Windows Sandbox
Jonathan Johnson details but makes an important call to action also..
My biggest request to OpenAI, and to any other company building these endpoint AI tools, is logging. Defenders need visibility into what command or code was executed, under which sandbox identity, with which policy, and against which workspace. Even basic structured logs around command execution, sandbox mode, network mode, process identity, and blocked actions would go a long way for detection. Having this custom logging alongside what Windows already provides would add richer context for detection opportunities.
https://jonny-johnson.medium.com/a-deep-dive-into-codex-windows-sandbox-a2489bf4ae91
Incident Writeups & Disclosures
How they got in and what they did.
Investigating unauthorized access to GitHub-owned repositories
Github detail..
On Monday May 18, we detected and contained a compromise of an employee device involving a poisoned VS Code extension published by a third party. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.
Our current assessment is that the activity involved exfiltration of GitHub-internal repositories only. The attacker’s current claims of ~3,800 repositories are directionally consistent with our investigation so far.
https://github.blog/security/investigating-unauthorized-access-to-githubs-internal-repositories/
Our response to the TanStack npm supply chain attack
OpenAI detail..
On May 11, 2026 UTC, TanStack, a widely used open-source library, was compromised as part of a broader software supply chain attack known as Mini Shai-Hulud.
Two employee devices in our corporate environment were impacted by this attack. Upon identification of the malicious activity, we worked quickly to investigate, contain, and take steps to protect our systems. As part of our investigation and response, we engaged a third-party digital forensics and incident response firm.
We observed activity consistent with the malware’s publicly described behavior, including unauthorized access and credential-focused exfiltration activity, in a limited subset of internal source code repositories to which the two impacted employees had access. We confirmed that only limited credential material was successfully exfiltrated from these code repositories and that no other information or code was impacted.
https://openai.com/index/our-response-to-the-tanstack-npm-supply-chain-attack/
Grafana Labs security update: Latest on TanStack npm supply chain ransomware incident
Grafana Labs details..
On May 16, 2026, Grafana Labs confirmed a targeted attack by a cybercrime group that gained unauthorized access to our GitHub repositories and downloaded our codebase. They then issued a ransom demand under threat of data disclosure.
From edge appliance to enterprise compromise: Multi-stage Linux intrusion via F5 and Confluence
Microsoft Defender Security Research Team break down an observed end to end compromise which will be useful for defensive teams to understand.
In this incident, the threat actor compromised an internet-facing firewall appliance and used trusted relationships to pivot to an internal Linux host. From there, the threat actor compromised a vulnerable SaaS application and leveraged its credentials to conduct relay-style authentication attacks against Active Directory.
Vulnerability
Our attack surface.
Google API keys keep working after you delete them
Joe Leon details the 23 minutes of exposure which I suspect will down to database or similar synchronisation.
When you delete a Google API key, it says it’s immediately deleted. Our testing says ~23 minutes. During that window, an attacker with a leaked key keeps access to your data and enabled APIs (including Gemini). You have no way to revoke it faster or confirm when it stops working. Google closed our original report as “won’t fix”.
https://www.aikido.dev/blog/google-api-keys-deletion
CVE-2026-45585: Windows BitLocker Security Feature Bypass Vulnerability
Microsoft issues a CVE and provides mitigation..
No, if you are using TPM+PIN the vulnerability is not exploitable.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45585
FortiAuthenticator Improper access control on API endpoints
Fortinet detail..
An Improper Access Control vulnerability [CWE-284] in FortiAuthenticator may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.
https://fortiguard.fortinet.com/psirt/FG-IR-26-128
DirtyCBC: When Linux Kernel Decrypt-Before-MAC Turns Authenticated Encryption Into a Page-Cache Write
Kamil Leoniak details this vulnerability which is interesting training corpus..
Linux kernel page-cache poisoning via AES-256 chosen-plaintext on the RxGK RESPONSE path and why authenticated encryption did not stop it.
https://delphoslabs.com/blog/36142374-e1fe-80a9-9456-d3c64df81bd5/%20linux-rxgk-decrypt-mac
CVE-2026-46333: Local Root Privilege Escalation and Credential Disclosure in the Linux Kernel ptrace Path
Saeed Abbasi shows the value of code review and understanding state machines..
During ongoing research into Linux kernel privilege boundaries, TRU identified a narrow window in which a privileged process that is dropping its credentials remains reachable through ptrace-family operations even though its dumpable flag should have closed that path. By pairing this window with the pidfd_getfd() syscall (added in v5.6-rc1, January 2020), an attacker can capture open file descriptors and authenticated inter-process channels from a dying privileged process and re-use them under their own uid.
Offense
Attack capability, techniques and trade-craft.
Nothing overly of note this week…
Exploitation
What is being exploited..
Ghost CMS Mass Compromised via CVE-2026-26980, Now Fueling ClickFix Attacks
Alex.Turing, Wang Hao, huxin, rootkite and Acey9 detail a watering hole style attack which involves exploitation of SQL injection.
The attacker exploited the high-risk SQL injection vulnerability CVE-2026-26980 in Ghost CMS to obtain the target site's Admin API Key without authorization, and then used the Ghost Admin API to tamper with articles in bulk, injecting malicious JavaScript loaders at the bottom of the pages to assist FakeCaptcha attacks — that is, by forging Cloudflare human verification pages to lure users into executing malicious commands locally.
ssh-keysign-pwn
_SiCk publishes this exploit which I suspect will have a long tail of impact..
Steal SSH host private keys and /etc/shadow via the ptrace_may_access mm-NULL bypass + pidfd_getfd. Pre-31e62c2ebbfd kernels.
https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn
Tooling and Techniques
Low level tooling and techniques for attack and defence researchers
Crashing Through Defenses: Exploiting Segfaults and Chaining around Intel CET
Marcos Bajo , Ritvik Goyal , Apostolos Chatzianagnostou , and Christian Rossow introduce a new exploitation primitive.
This paper introduces Segmentation Fault Oriented Programming (SFOP), a novel code reuse attack that exploits previously unidentified weaknesses in the interaction between Intel CET and the Linux signal handling subsystem. Unlike other code reuse techniques, SFOP does not require program-specific features, and can reliably exploit any vulnerable application on modern x86 64 Linux with Intel CET enabled. SFOP enables an attacker to execute arbitrarily many function calls with fully controlled arguments, turning a single memory corruption vulnerability into arbitrary code execution. We demonstrate the practical impact of SFOP through real-world exploits, and discuss mitigation strategies to prevent SFOP attacks.
https://cispa.saarland/group/rossow/papers/sfop-ieeesp2026.pdf
https://github.com/signal-sfop/sfop/
HDD Firmware Hacking Part 1
Ryan Miceli creates the stuff of nightmares for those managing persistence risk..
Rather than keep this topic in obscurity I decided to open source the IDA and firmware related scripts I wrote to help others start looking into HDD firmware. I’m interested to see what other people find in these devices and would love to see things like backdoor commands documented, tools to try and fingerprint firmware, and maybe even decompilation of firmware (even though it’s completely pointless and I would never trust it anyway). You can find all my work on my GitHub
FalkorDB
Numerous folk develop this which will have application in a number of cyber defence use cases.
Ultra-fast, Multi-tenant Graph Database
FalkorDB is the first queryable Property Graph database to leverage sparse matrices for representing the adjacency matrix in graphs and linear algebra for querying.
Key Features
Sparse Matrix Representation: Utilizes sparse matrices to represent adjacency matrices, optimizing storage and performance.
Linear Algebra Querying: Employs linear algebra for query execution, enhancing computational efficiency.
Property Graph Model Compliance: Supports nodes and relationships with attributes, adhering to the Property Graph Model.
OpenCypher Support: Compatible with OpenCypher query language, including proprietary extensions for advanced querying capabilities.
https://github.com/FalkorDB/falkordb
Navigating the MTE Landscape: iOS Memory Protection Deep Dive
Atlan PINABEL and Patrick VENTUZELO navigate through these slides from OffensiveCON
https://fuzzinglabs.com/wp-content/uploads/2026/05/Navigating_iOS_MTE_Landscape.pdf
Striga: Lifting x86 to LLVM IR with Python
mrexodia lowers the bar of entry..
The goal of this post is to lower the barrier of entry and let you experiment with lifting to LLVM IR. For inspiration you can look at the Static Devirtualization of Themida post that was just released by Back Engineering Labs, as well as the Pushan: Trace-Free Deobfuscation of Virtualization-Obfuscated Binaries paper by ASU researchers published in March.
https://secret.club/2026/05/21/striga.html
Footnotes
Some other small (and not so small) bits and bobs which might be of interest.
Annual, quarterly and monthly reports
Nothing overly of note this week, but keep an eye on the Awesome Annual Security Reports 2026 collection
To study how chips really work, MIT researchers built their own operating system
Artificial intelligence
Fundamental
Applied non-cyber
Applied cyber specific
Hack-Verifiable Environments: Towards Evaluating Reward Hacking at Scale
Hunting Vulnerability Variants in AI Infra: Measurement and Reference-Driven Detection
PocketAgents: A Manifest-Driven Library of Autonomous Defense Agents
SecureForge: Finding and Preventing Vulnerabilities in LLM-Generated Code via Prompt Optimization
Detecting Offensive Cyber Agents: A Detection-in-Depth Approach
Ti-iLSTM: A TinyDL Approach for Logic-Level Anomaly Detection in Industrial Water Treatment Systems
A First Measurement Study on Authentication Security in Real-World Remote MCP Servers
Benchmarking Autonomous Agents against Temporal, Spatial, and Semantic Evasions
Automated Repair of TEE Partitioning Issues via DSL-Guided and LLM-Assisted Patching
Finding Missing Input Validation in TEEs via LLM-Assisted Symbolic Execution
Quality-Assured Fuzz Harness Generation via the Four Principles Framework
A Large Language Model Approach to Generating Bypass Rules for Malware Evasion in Analysis Sandbox
FuzzingBrain V2: A Multi-Agent LLM System for Automated Vulnerability Discovery and Reproduction
VIPER-MCP: Detecting and Exploiting Taint-Style Vulnerabilities in Model Context Protocol Servers
Prompt2Fingerprint: Plug-and-Play LLM Fingerprinting via Text-to-Weight Generation
Books
Nothing overly of note this week..
Events
47th IEEE Symposium on Security and Privacy - accepted papers
The IEEE Conference on Dependable and Secure Computing (DSC 2026) - Call of Papers
Finally finally the NCSC’s podcast series.
Unless stated otherwise, linked or referenced content does not necessarily represent the views of the NCSC and reference to third parties or content on their websites should not be taken as endorsement of any kind by the NCSC. The NCSC has no control over the content of third party websites and consequently accepts no responsibility for your use of them.
This newsletter is subject to the NCSC website terms and conditions which can be found at https://www.ncsc.gov.uk/section/about-this-website/terms-and-conditions and you can find out more about how will treat your personal information in our privacy notice at https://www.ncsc.gov.uk/section/about-this-website/privacy-statement.