Don’t swing at everything
Welcome to this week’s edition of the Threat Source newsletter. Lately I've found myself thinking a lot about the Australian TV series Mr. Inbetween (IMDb 8.7/10) — not because I'm a hitman for hire, but because I literally feel in-between. Specifically, in-between what I'd call the "pre-Mythos" and “post-Mythos” eras. We've crossed a capability threshold, and it's not just one model family driving that — Codex 5.3 and GPT-5.5 deliver comparable or better performance , and Tulongfeng or GLM-5.2 (an incredibly powerful open-weight model, MIT-licensed) show the frontier isn't limited to closed models anymore. On the other side of that line, real-world impact hasn't caught up yet and we're living in an artificial buffer zone. For me, defining the “pre-” and “post-” status comes down to the gap between "vulnerability discovery" and "vulnerability publication." Last week’s Patch Tuesday gave a signal of change, as Joe pointed out , so maybe the buffer zone has come to an end. Let's dive into the 2026 Q2 stats. As in past years, we're seeing a steeper curve than the year before — a solid 49% YoY growth, though still not the hockey-stick moment I keep waiting for. By the end of June we were tracking close to 200 CVEs per day. Using the keyword methodology described here , I found 452 AI-related CVEs this calendar year. If "openclaw" is added to the keyword list, that number jumps by another 536 — a reminder that these counts are sensitive to keyword drift. Given how much the keyword list keeps changing, I'm reconsidering whether to keep publishing this particular metric going forward. KEVs, by contrast, "only" grew 13% — a small April spike aside, it's fairly flat relative to total CVE growth. Networking-gear-related CVEs continued their climb, now accounting for 24% of KEV-related vulnerabilities (up from 20% in Q1) — consistent with the trend I flagged last quarters. As in previous quarters, CVEs from 2024 or earlier still make up about 24% of everything we're tracking. More strikingly, even though the standard enterprise patch cycle is described to run 30–90 days, 181 days into 2026, 46% of today's actively-exploited (KEV) CVEs still trace back to 2025 or earlier. Old vulnerabilities don't retire, new ones keep arriving, and machine-speed vulnerability discovery is going to keep outpacing human-speed patching. Which brings me back — once again — to EPSS as a tool for prioritizing patching against this dataset. If you patched purely by CVSS 9+, you'd be urgently chasing ~3,700 CVEs — but 95% of those sit below 5% EPSS, meaning the real-world odds of exploitation are tiny. Of the 32 CVSS 9+ CVEs with EPSS ≥ 50%, 25 are already on CISA's KEV list. The remaining seven outliers are still high-probability by EPSS but haven't made KEV yet — worth watching. Ray Shoesmith (Mr. Inbetween) once told his therapist, "You know, if I hit somebody, I generally got a pretty good reason." Same principle applies to patching. Don't swing at everything — swing at what you have good reason to believe is coming for you. The one big thing Cisco Talos has discovered "msaRAT," a new Rust-based remote access trojan (RAT) deployed by the Chaos ransomware group. Built on the Tokio asynchronous runtime, it establishes a covert command-and-control (C2) channel by hijacking Chrome or Edge browsers via the Chrome DevTools Protocol (CDP). The infection starts with a deceptive MSI file masquerading as a Windows update that loads the payload directly into memory, paving the way for ransomware deployment. Why do I care? This RAT is a master of evasion, living off the browser to build its C2 infrastructure without ever directly touching the network. By routing traffic through legitimate browser processes and trusted services, msaRAT easily bypasses traditional network-based detections. Additionally, its use of the Tokio runtime enables highly efficient, parallel execution of malicious tasks, accelerating the attacker's ability to establish persistence and deploy doubl…
AI Analysis
Technical Summary
The analysis covers Q2 2026 vulnerability trends, noting a 49% year-over-year increase in CVEs and the persistence of older vulnerabilities actively exploited in the wild. It critiques patching strategies that rely solely on CVSS scores, advocating for prioritization using exploitation likelihood metrics such as EPSS. A significant finding is the discovery of msaRAT, a Rust-based remote access trojan deployed by the Chaos ransomware group. msaRAT leverages the Tokio asynchronous runtime and abuses the Chrome DevTools Protocol to hijack Chrome or Edge browsers, creating covert command-and-control channels that bypass traditional network detection. Infection begins with a disguised MSI file that loads the payload directly into memory, enabling stealthy ransomware deployment. The report advises monitoring for specific behavioral indicators and unusual MSI activity. No vendor advisory or patch information is provided, and no affected software versions are specified.
Potential Impact
The impact includes stealthy remote access and control by attackers using msaRAT, enabling ransomware deployment with evasion of traditional network-based detection methods. The malware's use of legitimate browser processes for command-and-control complicates detection and response. Additionally, the ongoing high volume of vulnerabilities and slow patching cycles increase exposure to exploitation risks. The report does not specify direct impacts on particular software versions or systems beyond the described malware behavior.
Mitigation Recommendations
No official patch or remediation guidance is provided in the source. Defenders should focus on behavioral monitoring to detect abuse of the Chrome DevTools Protocol and unauthorized WebRTC connections. They should scrutinize unexpected MSI files, especially those masquerading as Windows updates and downloading to the ProgramData directory, and monitor for unusual curl commands and plain HTTP traffic over port 443. Prioritized patching based on exploitation likelihood (e.g., EPSS scores) rather than CVSS alone is recommended to manage vulnerability risk effectively. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Don’t swing at everything
Description
Welcome to this week’s edition of the Threat Source newsletter. Lately I've found myself thinking a lot about the Australian TV series Mr. Inbetween (IMDb 8.7/10) — not because I'm a hitman for hire, but because I literally feel in-between. Specifically, in-between what I'd call the "pre-Mythos" and “post-Mythos” eras. We've crossed a capability threshold, and it's not just one model family driving that — Codex 5.3 and GPT-5.5 deliver comparable or better performance , and Tulongfeng or GLM-5.2 (an incredibly powerful open-weight model, MIT-licensed) show the frontier isn't limited to closed models anymore. On the other side of that line, real-world impact hasn't caught up yet and we're living in an artificial buffer zone. For me, defining the “pre-” and “post-” status comes down to the gap between "vulnerability discovery" and "vulnerability publication." Last week’s Patch Tuesday gave a signal of change, as Joe pointed out , so maybe the buffer zone has come to an end. Let's dive into the 2026 Q2 stats. As in past years, we're seeing a steeper curve than the year before — a solid 49% YoY growth, though still not the hockey-stick moment I keep waiting for. By the end of June we were tracking close to 200 CVEs per day. Using the keyword methodology described here , I found 452 AI-related CVEs this calendar year. If "openclaw" is added to the keyword list, that number jumps by another 536 — a reminder that these counts are sensitive to keyword drift. Given how much the keyword list keeps changing, I'm reconsidering whether to keep publishing this particular metric going forward. KEVs, by contrast, "only" grew 13% — a small April spike aside, it's fairly flat relative to total CVE growth. Networking-gear-related CVEs continued their climb, now accounting for 24% of KEV-related vulnerabilities (up from 20% in Q1) — consistent with the trend I flagged last quarters. As in previous quarters, CVEs from 2024 or earlier still make up about 24% of everything we're tracking. More strikingly, even though the standard enterprise patch cycle is described to run 30–90 days, 181 days into 2026, 46% of today's actively-exploited (KEV) CVEs still trace back to 2025 or earlier. Old vulnerabilities don't retire, new ones keep arriving, and machine-speed vulnerability discovery is going to keep outpacing human-speed patching. Which brings me back — once again — to EPSS as a tool for prioritizing patching against this dataset. If you patched purely by CVSS 9+, you'd be urgently chasing ~3,700 CVEs — but 95% of those sit below 5% EPSS, meaning the real-world odds of exploitation are tiny. Of the 32 CVSS 9+ CVEs with EPSS ≥ 50%, 25 are already on CISA's KEV list. The remaining seven outliers are still high-probability by EPSS but haven't made KEV yet — worth watching. Ray Shoesmith (Mr. Inbetween) once told his therapist, "You know, if I hit somebody, I generally got a pretty good reason." Same principle applies to patching. Don't swing at everything — swing at what you have good reason to believe is coming for you. The one big thing Cisco Talos has discovered "msaRAT," a new Rust-based remote access trojan (RAT) deployed by the Chaos ransomware group. Built on the Tokio asynchronous runtime, it establishes a covert command-and-control (C2) channel by hijacking Chrome or Edge browsers via the Chrome DevTools Protocol (CDP). The infection starts with a deceptive MSI file masquerading as a Windows update that loads the payload directly into memory, paving the way for ransomware deployment. Why do I care? This RAT is a master of evasion, living off the browser to build its C2 infrastructure without ever directly touching the network. By routing traffic through legitimate browser processes and trusted services, msaRAT easily bypasses traditional network-based detections. Additionally, its use of the Tokio runtime enables highly efficient, parallel execution of malicious tasks, accelerating the attacker's ability to establish persistence and deploy doubl…
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The analysis covers Q2 2026 vulnerability trends, noting a 49% year-over-year increase in CVEs and the persistence of older vulnerabilities actively exploited in the wild. It critiques patching strategies that rely solely on CVSS scores, advocating for prioritization using exploitation likelihood metrics such as EPSS. A significant finding is the discovery of msaRAT, a Rust-based remote access trojan deployed by the Chaos ransomware group. msaRAT leverages the Tokio asynchronous runtime and abuses the Chrome DevTools Protocol to hijack Chrome or Edge browsers, creating covert command-and-control channels that bypass traditional network detection. Infection begins with a disguised MSI file that loads the payload directly into memory, enabling stealthy ransomware deployment. The report advises monitoring for specific behavioral indicators and unusual MSI activity. No vendor advisory or patch information is provided, and no affected software versions are specified.
Potential Impact
The impact includes stealthy remote access and control by attackers using msaRAT, enabling ransomware deployment with evasion of traditional network-based detection methods. The malware's use of legitimate browser processes for command-and-control complicates detection and response. Additionally, the ongoing high volume of vulnerabilities and slow patching cycles increase exposure to exploitation risks. The report does not specify direct impacts on particular software versions or systems beyond the described malware behavior.
Mitigation Recommendations
No official patch or remediation guidance is provided in the source. Defenders should focus on behavioral monitoring to detect abuse of the Chrome DevTools Protocol and unauthorized WebRTC connections. They should scrutinize unexpected MSI files, especially those masquerading as Windows updates and downloading to the ProgramData directory, and monitor for unusual curl commands and plain HTTP traffic over port 443. Prioritized patching based on exploitation likelihood (e.g., EPSS scores) rather than CVSS alone is recommended to manage vulnerability risk effectively. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Article Source
- {"url":"https://blog.talosintelligence.com/dont-swing-at-everything/","fetched":true,"fetchedAt":"2026-07-23T18:17:07.364Z","wordCount":1317}
- Classification
- {"confidence":0.76,"severitySource":"default","classifier":"rss-v2"}
Threat ID: 6a625aa39c2644c7f87f494f
Added to database: 07/23/2026, 18:17:07 UTC
Last enriched: 07/23/2026, 18:17:19 UTC
Last updated: 09/05/2026, 13:12:20 UTC
Views: 88
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.