CVE-2021-4034 is an out-of-bounds read and write vulnerability in the Red Hat polkit pkexec utility that allows privilege escalation to administrative rights. It has a high severity score of 7.8 and has been exploited in the wild, including use in ransomware campaigns.
The Yoba malware campaign distributes cryptocurrency mining malware by abusing digitally signed AI application executables from OpenAI and Anthropic to evade detection. It uses DLL sideloading with malicious DLLs loaded alongside legitimate signed binaries. The infection chain includes YobaDropper and YobaLoader components that employ anti-analysis techniques such as process verification, execution delays, and regional language exclusions. Command and control communication uses Telegram profile images, domain generation algorithms, DNS over HTTPS via Google, and public hosting services to retrieve encrypted payloads. While primarily observed deploying the XMRig miner, the loader architecture can support additional Windows executables and PowerShell payloads, indicating potential expansion beyond cryptojacking.
An espionage campaign named CL-UNK-1211 targeted government and state-affiliated Linux infrastructure from October 2025 to April 2026. The attackers used AI-generated payloads with conversational annotations indicating involvement of large language models or automated AI agents. They deployed web shells, custom cross-platform backdoors including SysGoRAT malware, and open-source tools to maintain persistent access. The campaign involved extensive reconnaissance, database dumping, mailbox enumeration targeting social media accounts linked to government emails, and advanced defense evasion techniques such as disabling endpoint protections, erasing system logs, and planting deceptive red-team markers to disguise malicious activity as legitimate security assessments.
ClingSTUN is a Linux malware campaign targeting vulnerable Internet-facing IoT and network edge devices by exploiting known vulnerabilities. It installs a back-connect proxy backdoor that enables persistent remote access and converts compromised devices into proxy nodes. The malware supports multiple Linux architectures and employs techniques such as boot persistence, process concealment, remote command execution, and self-propagation. It abuses public STUN infrastructure to facilitate NAT traversal. The campaign targets devices from multiple vendors including D-Link, EnGenius, Realtek, TP-Link, AVTECH, Ivanti, Tenda, and Lantronix, emphasizing risks from unpatched and exposed devices.
Operation Master is a sophisticated cybercrime campaign exploiting a GlobalProtect authentication bypass vulnerability (CVE-2026-0257) to compromise enterprise networks across multiple countries. The attackers conducted extensive network scanning to identify high-value targets, executed SQL injection attacks with privilege escalation to steal databases, and exfiltrated Active Directory credentials. They monetized stolen data by selling it on underground forums and operating a multi-tenant automated invoice fraud platform that sent millions of phishing messages and fraudulent links. The operation employed advanced phishing techniques including M365 OAuth device-code phishing and voice-based credential harvesting, with payments collected via PIX through serverless proxies.
CVE-2025-55182, known as React2Shell, is a critical Remote Code Execution vulnerability affecting React Server Components (RSC) and related frameworks such as Next.js, Waku, and Vite. It arises from improper input deserialization in RSC payloads, enabling attackers to execute arbitrary code. Exploitation has been observed in cloud environments targeting containerized workloads, facilitating initial access, credential theft, cryptomining, and deployment of advanced backdoors. Public exploit code is available, and the vulnerability is actively exploited in the wild, including use in ransomware campaigns. No specific affected versions or patch information is provided. Detection templates exist to aid identification of exploitation attempts.
