Fortinet has issued an emergency weekend patch for a critical vulnerability in its FortiClient Enterprise Management Server (EMS), identified as CVE-2026-35616. The flaw is confirmed to be under active exploitation in the wild.
Vulnerability Details
Affected Product: FortiClient EMS versions 7.4.5 and 7.4.6
Identifier: CVE-2026-35616
CVSS Score: 9.1 (Critical)
Exploitation Status: Actively Exploited
Risk & Impact
Triage: Urgent. Organizations with internet-exposed FortiClient EMS should treat this as an emergency and apply the hotfix immediately.
Attack Vector: The flaw is an improper access control vulnerability that allows an unauthenticated, remote attacker to execute arbitrary code or commands via specially crafted requests. This can be achieved by bypassing API authentication and authorization controls.
Ease of Exploit: Low. The attack does not require authentication or user interaction.
Action Plan
Immediate Action: Apply the emergency hotfixes provided by Fortinet for versions 7.4.5 and 7.4.6. A full patch will be included in the upcoming FortiClientEMS version 7.4.7.
Workaround: No workaround is available; applying the hotfix or upgrading is the only mitigation.
Detection: Over 2,000 FortiClient EMS instances are reportedly exposed online. Administrators should monitor for signs of compromise detailed in Fortinet's PSIRT advisory.
Relevant professional terms
Zero-Day Vulnerability
A flaw in software or hardware that is discovered and exploited by attackers before the vendor is aware of it or has released a patch. This vulnerability was exploited as a zero-day before being reported.
Remote Code Execution (RCE)
An attack vector that allows a malicious actor to execute arbitrary commands or code on a remote target machine or in a remote process. Successful exploitation of this flaw can lead to RCE.
A sophisticated supply chain attack compromised the popular LiteLLM Python library, injecting credential-stealing malware into specific versions.
This incident, attributed to the threat actor TeamPCP, was actively exploited to harvest sensitive data from developer environments.
Vulnerability Details
Affected Product: LiteLLM Python package versions 1.82.7 and 1.82.8.
Identifier: This supply chain attack does not have a specific CVE identifier, but is tracked under Snyk ID SNYK-PYTHON-LITELLM-15762713.
Exploitation Status: Actively Exploited. Malicious packages were available on PyPI for several hours on March 24, 2026.
Risk & Impact
Triage: Critical. Immediate investigation and credential rotation are required for any environment where the affected versions were installed.
Attack Vector: The attack originated from a compromised CI/CD pipeline, where the threat actor stole PyPI publishing tokens. This allowed them to publish malicious versions of LiteLLM directly to the PyPI registry, which were then installed by developers.
Ease of Exploit: Trivial. The malware executed automatically upon installation of the compromised package or upon startup of any Python process if version 1.82.8 was installed.
Action Plan
Immediate Action: Upgrade to a safe version of LiteLLM, such as v1.83.0 or newer. All credentials (SSH keys, cloud tokens, API keys) on potentially affected systems should be rotated immediately.
Workaround: If an immediate upgrade is not possible, organizations should vendor a known-safe version internally until the package is restored on PyPI.
Detection: Hunt for network connections to malicious domains `models[.]litellm[.]cloud` and `checkmarx[.]zone`. Scan systems for the presence of the compromised package versions.
Relevant professional terms
Supply Chain Attack
An attack strategy that targets less-secure elements in an organization's software supply network, such as third-party libraries, build tools, or CI/CD pipelines, to compromise a final product or system.
Infostealer
A type of malware designed to covertly gather sensitive information from a compromised system. This can include credentials, API keys, financial data, and other private information which is then exfiltrated to an attacker-controlled server.
North Korean state-sponsored actors executed a sophisticated, six-month social engineering campaign against the Solana-based Drift Protocol, culminating in the theft of approximately $285 million.
The operation involved building trust through in-person meetings before deploying malicious software to gain control.
Attack Overview
Attack Path: Attackers posed as a quantitative trading firm, building rapport with Drift employees at international conferences over six months to facilitate the compromise. The final intrusion likely involved tricking employees into using malicious software, including a mobile app or a malicious code repository.
Attacker:Democratic People's Republic of Korea (DPRK), attributed to the group UNC4736 (also known as Golden Chollima).
Impact Assessment
Data Stolen: Approximately $285 Million in various cryptocurrencies.
Operational Impact: Drift suspended all platform deposits and withdrawals to contain the incident. The protocol's Total Value Locked (TVL) collapsed significantly following the attack.
Strategic Takeaway
This attack demonstrates the severe risk of patient, long-term social engineering campaigns that weaponize human trust to bypass technical security controls.
Relevant professional terms
Social Engineering
A manipulation technique used to deceive individuals into divulging confidential information or performing actions to breach security.
Solana
A high-performance public blockchain platform designed to host decentralized and scalable applications.
Ransomware Gangs Exploit Drivers to Blind Defenses
Executive Summary
Qilin and Warlock ransomware operators are disabling hundreds of EDR tools by exploiting vulnerable third-party drivers.
This "Bring Your Own Vulnerable Driver" (BYOVD) technique allows the threat actors to execute their ransomware payloads without being detected by security software.
Key TTPs
Initial Access: Exploitation of public-facing applications, such as unpatched SharePoint and Fortinet devices, and spearphishing campaigns.
Execution: Use of legitimate remote administration tools like PsExec and RDP for lateral movement and ransomware deployment.
Defense Evasion: Use of the BYOVD technique to load a vulnerable driver, which is then used to terminate security processes at the kernel level.
Campaign Analysis
The adoption of BYOVD by distinct ransomware groups like Qilin and Warlock highlights a strategic shift towards more sophisticated evasion tactics.
This method allows attackers to neutralize endpoint defenses effectively, increasing the probability of a successful attack.
BYOVD (Bring Your Own Vulnerable Driver): An attack technique where an adversary loads a legitimate, but vulnerable, third-party driver onto a system to gain kernel-level privileges and disable security software.
EDR (Endpoint Detection and Response): A category of security tools that monitor endpoint devices (like laptops and servers) to detect, investigate, and respond to cyber threats.
German federal authorities have publicly identified 31-year-old Russian national Daniil Maksimovich Shchukin as the alleged leader of the notorious GandCrab and REvil ransomware gangs.
This action exposes a key figure responsible for widespread cyber extortion campaigns.
The Scheme
TTP 1: Pioneered "double extortion," charging victims to both decrypt files and prevent the publication of stolen data.
TTP 2: Utilized a Ransomware-as-a-Service (RaaS) model, paying affiliates to breach networks and deploy the malware.
TTP 3: Gained initial access through phishing emails, exploit kits, and compromised remote access services.
Outcome: An international search is underway for Shchukin, who is believed to be in Russia.
Assets Seized/Forfeited: Over $317,000 in cryptocurrency was seized by the U.S. Justice Department in 2023.
Strategic Takeaway
The public identification of a high-level ransomware operator, even without immediate arrest, disrupts their operations and signals a coordinated international effort to dismantle cybercrime hierarchies.
Relevant Terms
Doxes: To publicly identify or publish private information about someone, especially as a form of punishment or revenge.
Ransomware-as-a-Service (RaaS): A subscription-based model where cybercriminals pay to use pre-developed ransomware tools to carry out attacks.
