Unit 42 discovered a rogue virtual machine used by the cybercrime group Muddled Libra during an incident response investigation. The VM provided insights into the group's operational methods, including reconnaissance, tool downloads, persistence establishment, certificate theft, and interactions with the target's infrastructure. Muddled Libra created the VM after gaining unauthorized access to the target's VMware vSphere environment. The group's tactics involve minimal malware use, preferring to leverage the target's assets. Their attack chain included creating a VM, downloading tools, establishing C2, using stolen certificates, and attempting data exfiltration. The article details the group's activities, tools used, and troubleshooting efforts during the attack.
The KRVTZ-NET IDS alerts dated 2026-02-11 represent network reconnaissance activity detected by an intrusion detection system. The alerts are categorized as low severity and are based on open-source intelligence (OSINT) observations without specific exploit details or affected product versions. No known exploits or patches are associated with this activity, indicating it is likely preliminary scanning or probing rather than an active attack. The threat is primarily informational, highlighting reconnaissance efforts that could precede more targeted attacks. Organizations should monitor for unusual network activity and strengthen detection capabilities to identify potential follow-on threats. Given the lack of specific vulnerabilities or exploits, the immediate risk is low but warrants vigilance. The threat is relevant globally, especially in regions with high network infrastructure usage and strategic importance. Due to the reconnaissance nature and low severity, the suggested severity is low. Defenders should focus on improving network visibility and anomaly detection to mitigate potential escalation.
VoidLink is a Linux C2 framework that generates implant binaries for cloud and enterprise environments. The implant, likely built using an LLM coding agent, demonstrates advanced capabilities including multi-cloud targeting, container awareness, and kernel-level stealth. It fingerprints cloud environments across AWS, GCP, Azure, Alibaba Cloud, and Tencent Cloud, harvesting credentials and detecting container runtimes. The malware includes plugins for container escape and Kubernetes privilege escalation, as well as a kernel-level rootkit that adapts its approach based on the host's kernel version. C2 communications use AES-256-GCM over HTTPS, disguised as normal web traffic. VoidLink highlights the growing concern of LLM-generated implants reducing the skill barrier for producing sophisticated malware.
The SSHStalker Linux botnet has infected approximately 7,000 systems by leveraging traditional mass-compromise techniques. It uses a pipeline that deploys various scanners and malware to propagate and maintain control over infected devices. Although it employs old methods, the botnet remains effective in targeting Linux environments. There are no known exploits in the wild specifically tied to this botnet, and no CVSS score has been assigned. The threat is rated medium severity due to its ability to compromise numerous systems and potentially disrupt operations or facilitate further attacks. European organizations running Linux servers or IoT devices are at risk, especially those with weak SSH credentials or exposed services. Mitigation requires focused hardening of SSH access, continuous monitoring for unusual scanning activity, and rapid incident response to contain infections. Countries with significant Linux infrastructure and high-value targets in technology and finance sectors are more likely to be affected. Given the botnet’s reliance on old techniques, organizations can defend effectively by applying best practices and proactive network hygiene.
China-linked UNC3886 targeted all four major telecom providers, but did not disrupt services or access customer information. The post Singapore: Rootkits, Zero-Day Used in Chinese Attack on Major Telecom Firms appeared first on SecurityWeek .
Quantickle is a browser-based tool designed for creating visual representations of threat research. The post RSAC Releases Quantickle Open Source Threat Intelligence Visualization Tool appeared first on SecurityWeek .
CVE-2026-2096 is a critical authentication bypass vulnerability in Flowring's Agentflow product, allowing unauthenticated remote attackers to read, modify, and delete database contents. The flaw arises from missing authentication controls on a specific functionality, enabling attackers to bypass normal access restrictions without any user interaction or privileges. With a CVSS 4.0 score of 9.3, this vulnerability poses a high risk to confidentiality, integrity, and availability of affected systems. No known exploits are currently reported in the wild. European organizations using Agentflow, especially in sectors relying on database integrity and confidentiality, face significant risks. Mitigation requires immediate deployment of patches once available, network segmentation, and strict monitoring of database access. Countries with higher adoption of Flowring products and critical infrastructure sectors, such as Germany, France, and the UK, are more likely to be targeted. Due to the ease of exploitation and severe impact, this vulnerability demands urgent attention from defenders.
CVE-2025-12063 is an authorization bypass vulnerability in Axis Communications AB's AXIS Camera Station Pro version 6. It allows a non-admin user to modify or remove certain data objects without proper permissions due to an insecure direct object reference (CWE-639). The vulnerability requires low privileges and no user interaction but can only be exploited remotely with adjacent network access. While it does not impact confidentiality or availability, it can cause integrity loss by unauthorized modification of data. No known exploits are currently reported in the wild, and no patches have been published yet. European organizations using AXIS Camera Station Pro version 6 should be cautious, especially those with extensive physical security deployments. Mitigation involves strict access control reviews, network segmentation, and monitoring for suspicious activities. Countries with high adoption of Axis products and critical infrastructure reliance on video surveillance, such as Germany, France, and the UK, are most likely affected. The CVSS score is 5.7, indicating a medium severity level.
CVE-2025-13064 is a medium severity vulnerability in Axis Communications AB's AXIS Camera Station Pro version 6. It involves a server-side injection caused by an uncaught exception (CWE-248) that allows a malicious administrator, using a tampered client, to inject and execute malicious scripts on the server. The vulnerability requires high privileges (admin access) and no user interaction. Exploitation impacts availability but not confidentiality or integrity, and no known exploits are currently in the wild. The attack vector is remote and requires an authenticated attacker using a compromised client. European organizations using AXIS Camera Station Pro for video surveillance could face service disruptions if exploited. Mitigation involves ensuring client integrity, restricting admin client usage, and monitoring for anomalous server behavior. Countries with high adoption of Axis surveillance products and critical infrastructure reliance on video monitoring, such as Germany, France, the UK, and the Netherlands, are most likely affected. Given the limited impact scope and exploitation complexity, the severity is medium.
CVE-2026-24327 is a medium-severity vulnerability in SAP Strategic Enterprise Management's Balanced Scorecard BSP application caused by a missing authorization check. An authenticated attacker with legitimate access could view information they are not authorized to see, impacting confidentiality with no effect on integrity or availability. The vulnerability affects multiple versions of the SEM-BW product line. Exploitation requires network access and low complexity but does not require user interaction. No known exploits are currently in the wild. European organizations using affected SAP SEM versions may face risks of unauthorized data disclosure. Mitigation involves applying SAP patches when available, reviewing and tightening authorization roles, and monitoring access logs for suspicious activity. Countries with significant SAP enterprise deployments and critical industries relying on SAP SEM, such as Germany, France, and the UK, are most likely affected.
CVE-2026-24326 is a medium-severity vulnerability in SAP S/4HANA Defense & Security (Disconnected Operations) caused by a missing authorization check. An attacker with valid user privileges can invoke remote-enabled function modules to directly update standard SAP database tables without proper authorization. This flaw impacts data integrity but does not affect confidentiality or availability. The vulnerability affects multiple versions of SAP S/4HANA Defense & Security, from EA-DFPS 600 through 809. Exploitation requires network access and valid user credentials but no user interaction. No known exploits are currently reported in the wild. European organizations using affected SAP modules, especially in defense and security sectors, should prioritize patching and access control reviews. Countries with significant SAP deployments and strategic defense industries, such as Germany and France, are most likely impacted. Mitigation involves implementing strict role-based access controls, monitoring for unusual database modifications, and applying vendor patches once available. Overall, the vulnerability poses a moderate risk due to its limited impact scope and exploitation prerequisites.
CVE-2026-24324 is a medium severity vulnerability in SAP BusinessObjects Business Intelligence Platform (AdminTools) that allows an authenticated user with standard privileges to execute a crafted query causing the Content Management Server (CMS) to crash. This results in a denial of service condition affecting system availability, while confidentiality and integrity remain intact. Exploitation requires no user interaction but does require valid user credentials. The vulnerability affects versions ENTERPRISE 430, 2025, and 2027 of the platform. No known exploits are currently reported in the wild. The CVSS score is 6.5, reflecting a network attack vector with low complexity and no privileges beyond user level. European organizations relying on SAP BusinessObjects for business intelligence and reporting could face operational disruptions if targeted. Mitigation involves monitoring user activities, restricting access to AdminTools, and applying patches or vendor guidance once available. Countries with significant SAP deployments and critical industries using SAP BI platforms, such as Germany, France, and the UK, are most likely to be impacted.
CVE-2026-24320 is a low-severity vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP) caused by improper neutralization of CRLF sequences in HTTP headers, leading to memory corruption and potential leakage of memory content. The flaw arises from logical errors in memory management when processing specially crafted input containing unique characters. Exploitation requires an authenticated attacker with low privileges and does not require user interaction. The vulnerability impacts confidentiality slightly but does not affect integrity or availability. No known exploits are currently reported in the wild. Multiple versions of SAP NetWeaver and ABAP Platform, including widely used releases, are affected. European organizations using these SAP products should assess their exposure and apply mitigations promptly. Due to the low CVSS score (3.1) and limited impact, the threat is not critical but still warrants attention to prevent information disclosure. Countries with significant SAP enterprise deployments, such as Germany and the UK, are most likely to be affected.
CVE-2026-24312 is a medium-severity vulnerability in SAP Business Workflow caused by a missing authorization check that allows an authenticated administrative user to escalate privileges by exploiting permissions from less sensitive functions. This flaw primarily impacts data integrity by enabling unauthorized high-privilege actions, while confidentiality and availability impacts are low or none. The vulnerability affects multiple SAP_BASIS versions from 7.52 through 8.16. Exploitation requires authenticated administrative privileges and some user interaction, limiting the attack scope. No known exploits are currently in the wild. European organizations using affected SAP versions could face risks of unauthorized data manipulation within critical business workflows. Mitigation involves applying vendor patches once available, reviewing and tightening role-based access controls, and monitoring administrative activities for suspicious privilege escalations. Countries with significant SAP enterprise deployments and critical industries relying on SAP workflows, such as Germany, France, and the UK, are most likely to be affected.
CVE-2026-23684 is a race condition vulnerability in SAP Commerce Cloud affecting versions HY_COM 2205, COM_CLOUD 2211, and 2211-JDK21. The flaw allows an attacker to manipulate product entries in a shopping cart, potentially causing erroneous product values to be checked out. This vulnerability impacts data integrity but does not affect confidentiality or availability. Exploitation requires no privileges or user interaction but has a high attack complexity. No known exploits are currently in the wild. The CVSS score is 5.9, indicating a medium severity. European organizations using SAP Commerce Cloud for e-commerce operations could face financial discrepancies and transactional errors if exploited. Mitigation involves applying vendor patches once available, implementing strict concurrency controls, and monitoring transaction logs for anomalies. Countries with significant SAP Commerce Cloud deployments and strong e-commerce sectors, such as Germany, the UK, France, and the Netherlands, are most likely to be affected.
CVE-2026-0486 is a medium severity vulnerability affecting ABAP based SAP systems where a remote-enabled function module fails to perform necessary authorization checks for authenticated users. This results in unauthorized disclosure of system information, impacting confidentiality with no effect on integrity or availability. The vulnerability affects specific versions including ST-PI 2005_1_700, 2008_1_710, 740, and 758. Exploitation requires network access and authenticated user privileges but no user interaction. Although no known exploits are currently reported in the wild, the vulnerability poses a risk of information leakage that could aid further attacks. European organizations using these SAP versions should prioritize patching or mitigating this issue to prevent unauthorized data exposure. Countries with significant SAP deployments, such as Germany and the UK, are particularly at risk. Mitigation involves strict access control reviews, monitoring for unusual access patterns, and applying SAP security notes once available. Given the medium CVSS score of 5.0, the threat is moderate but should not be overlooked due to the critical role SAP systems play in enterprise operations.
CVE-2026-0485 is a high-severity vulnerability in SAP BusinessObjects BI Platform that allows unauthenticated attackers to cause a denial-of-service by crashing the Content Management Server (CMS) through specially crafted requests. Exploitation leads to repeated CMS crashes and automatic restarts, resulting in persistent service disruption and complete unavailability of the CMS. The vulnerability affects multiple versions including ENTERPRISE 430, 2025, and 2027. No confidentiality or integrity impact is reported, and no user interaction or authentication is required. Although no known exploits are currently in the wild, the ease of exploitation and high impact on availability make this a critical concern for organizations relying on SAP BusinessObjects for business intelligence operations. European organizations using these SAP versions should prioritize mitigation to prevent operational disruptions. Specific mitigations include network-level filtering, strict access controls, and monitoring for anomalous CMS requests. Countries with high SAP adoption and critical industries such as Germany, France, and the UK are most likely to be affected.
CVE-2026-0484 is a medium-severity vulnerability in SAP NetWeaver Application Server ABAP and SAP S/4HANA that allows an authenticated attacker with limited privileges to exploit a missing authorization check. This flaw enables modification of text data within the system, impacting data integrity without affecting confidentiality or availability. The vulnerability arises from improper validation related to URL redirection (CWE-601) and affects multiple SAP_BASIS versions from 700 through 816. Exploitation requires authentication but no user interaction, and no known exploits are currently reported in the wild. The vulnerability's impact is primarily on the integrity of application data, which could lead to unauthorized changes in business-critical information. European organizations using affected SAP versions are at risk, especially those with extensive SAP deployments in finance, manufacturing, and supply chain sectors. Mitigation requires applying SAP patches once available and implementing strict access controls and monitoring of transaction codes. Countries with significant SAP market penetration and critical infrastructure relying on SAP, such as Germany, France, and the UK, are most likely to be affected. The CVSS score of 6.5 reflects a medium severity due to the integrity impact and the need for authenticated access.
