Microsoft has released an update to address CVE-2026-32202, a zero-click authentication coercion vulnerability stemming from an incomplete previous fix. The flaw is currently Actively Exploited by the Russia-linked APT28 threat group in campaigns targeting Ukraine and European Union countries.
Vulnerability Details
Affected Product: Microsoft Windows (Windows Shell and SmartScreen components, all supported versions)
Identifier: CVE-2026-32202
CVSS Score: 4.3 (Medium)
Exploitation Status: Actively Exploited
Risk & Impact
Triage: Immediate patching is critical due to active exploitation by state-sponsored actors.
Attack Vector: Network-based authentication coercion via auto-parsed malicious LNK (shortcut) files, forcing the victim’s system to authenticate to an attacker-controlled server.
Ease of Exploit: Low complexity; requires no user interaction (zero-click) once the malicious file is processed by the operating system.
Action Plan
Immediate Action: Apply the April 2026 Microsoft Patch Tuesday security updates to upgrade to the latest patched versions.
Workaround: Restrict outbound NTLM traffic to remote servers and block malicious LNK files at email and web gateways.
Detection: Monitor for unusual outbound authentication requests (e.g., NTLM/SMB) to external IP addresses and hunt for suspicious auto-parsing LNK files.
Relevant professional terms
Zero-Click Attack
A cyberattack that requires no interaction from the victim to execute, often triggering automatically when a payload is received or parsed by the system.
Authentication Coercion
A technique where an attacker forces a victim’s machine to automatically authenticate to a rogue server, allowing the attacker to capture credentials or relay the authentication.
A severe vulnerability, identified as CVE-2026-35414, has been discovered in OpenSSH that allows attackers to bypass access controls and gain full root shell access. The flaw, which lurked undetected for 15 years, is currently patched in the latest release and poses a significant risk due to its stealthy nature.
Vulnerability Details
Affected Product: OpenSSH versions prior to 10.3
Identifier: CVE-2026-35414
CVSS Score: 8.1 (High)
Exploitation Status: Proof-of-Concept Available
Risk & Impact
Triage: Critical Urgency
Attack Vector: A code reuse error causes the parser to interpret a comma in an SSH certificate principal name as a list separator. An attacker with a valid certificate containing a principal like “deploy,root” can bypass access controls and authenticate as root.
Ease of Exploit: High (Researchers developed a working exploit in 20 minutes)
Action Plan
Immediate Action: Upgrade to Version 10.3
Workaround: Restrict the use of commas in certificate principals and audit trusted Certificate Authorities (CAs).
Detection: Log-based detection is highly unreliable as the attack registers as a legitimate authentication; hunt for anomalous root access or malformed certificate principals.
Relevant professional terms
Certificate Principal
A string in an SSH certificate that specifies the identity or username the certificate holder is authorized to authenticate as.
Root Shell
A command-line interface that provides administrative (superuser) privileges, allowing unrestricted access to the operating system and its configurations.
Attackers compromised the elementary-data PyPI package via GitHub Actions script injection to distribute an infostealer. The forged release targets developers to harvest sensitive credentials and cryptocurrency wallets.
Key TTPs
Initial Access: Attackers used GitHub Actions script injection to push a forged release to PyPI.
Execution: A malicious elementary.pth file executes obfuscated Python code automatically upon interpreter startup.
Defense Evasion: The payload uses code obfuscation and .pth auto-execution to run without explicit package imports.
Campaign Analysis
This supply chain attack highlights the severe risk of CI/CD pipeline compromises. By exploiting Python’s .pth file behavior, attackers ensured stealthy execution across all infected environments.
Targeting & Infrastructure
Target Profile: Developers and data engineers using the elementary-data dbt observability tool.
Infrastructure: Payload beacons to a custom domain for credential exfiltration.
State Malware Sabotages Precision Engineering Systems
Executive Summary
Discovered by SentinelOne, the “fast16” framework is a 2005-era, state-sponsored cyber sabotage tool predating Stuxnet. It targets high-precision engineering and simulation software to subtly corrupt physical-world calculations.
Key TTPs
Initial Access: Self-propagates via network shares using default or weak administrator passwords.
Execution: Utilizes an embedded Lua 5.0 virtual machine within a service wrapper (svcmgmt.exe).
Defense Evasion: Checks for single-core processors to confirm it is running on legacy target hardware, and deploys a kernel driver (fast16.sys) to intercept and patch executable code in memory.
Campaign Analysis
Dating back to 2005, fast16 proves state-grade cyber-sabotage was operational years earlier than previously thought. It bridges the gap between early covert programs and modern modular toolkits like Stuxnet.
Targeting & Infrastructure
Target Profile: High-precision simulation suites (e.g., LS-DYNA, PKPM) used in civil engineering, physics, and nuclear research.
Infrastructure: Designed exclusively for legacy, single-core systems running Windows 2000 and XP.
Relevant Terms
Lua Virtual Machine: A lightweight, embeddable scripting engine used to execute code, allowing malware to remain modular without recompiling.
Kernel Driver: A highly privileged program operating at the core of an OS, granting deep access to system processes and hardware.
Pro-Ukrainian hacktivist group PhantomCore is actively exploiting a three-vulnerability chain in TrueConf video conferencing software to compromise Russian organizations. The campaign grants attackers remote code execution and full host control.
Key TTPs
Initial Access: Exploiting a 3-vulnerability chain in TrueConf or via phishing archives.
Defense Evasion: Creating rogue administrative users (e.g., “TrueConf2”) via DLL side-loading to maintain stealth.
Campaign Analysis
Active since 2022, PhantomCore leverages niche SaaS vulnerabilities to establish long-term footholds. Their operations focus on data theft, espionage, and occasionally deploying ransomware variants.
Targeting & Infrastructure
Target Profile: Russian enterprises, government agencies, and organizations utilizing TrueConf software.
Infrastructure: Reverse SSH tunnels and custom C2 tools (PhantomSscp, MacTunnelRat) for large-scale operations.
Relevant Terms
DLL Side-Loading: A cyberattack method where a malicious Dynamic Link Library is placed in a directory so a legitimate program loads it instead of the real one.
Reverse Shell: A connection where the target machine initiates communication back to the attacker’s system, bypassing inbound firewall rules.
Threat actors deployed 73 cloned sleeper extensions on the Open VSX repository to distribute GlassWorm v2 malware. The campaign targets developers across multiple IDEs to steal credentials and deploy trojans.
Key TTPs
Initial Access: Typosquatting legitimate VS Code extensions to build visual trust before pushing malicious updates.
Execution: Obfuscated JavaScript retrieves and installs a secondary .vsix payload from GitHub via CLI commands.
Defense Evasion: Utilizing sleeper packages, transitive dependencies, and Zig-based droppers while explicitly avoiding Russian systems.
Campaign Analysis
GlassWorm evolved from embedding binaries to using thin loaders and transitive dependencies. This shift keeps malicious logic hidden in obfuscated JavaScript, bypassing standard security scans.
Targeting & Infrastructure
Target Profile: Software developers using VS Code, Cursor, Windsurf, and VSCodium.
Infrastructure: Open VSX repository for initial loaders and GitHub releases for hosting secondary payloads.
Relevant Terms
Typosquatting: Registering names similar to popular software to trick users into downloading malicious files.
Transitive Dependencies: Indirect software dependencies where a program relies on a package that relies on another package.
A former executive at US defense contractor L3Harris Trenchant stole and sold classified zero-day exploits to a Russian cyber weapons broker. These powerful hacking tools, originally developed for Western intelligence, have now fallen into the hands of the Russian government and Chinese criminals.
Key TTPs
Initial Access: Exploitation of zero-day vulnerabilities (e.g., iOS and Google Chrome).
Campaign Analysis
The insider threat resulted in the proliferation of military-grade exploits to adversarial nation-states and cybercriminals. This severely compromises the operational security of Western intelligence and endangers global targets.
Targeting & Infrastructure
Target Profile: Global targets of Russian intelligence and Chinese cybercriminal syndicates.
Relevant Terms
Zero-Day: A software vulnerability unknown to the vendor, meaning no patch exists yet.
Exploit Broker: An individual or entity that buys and sells software vulnerabilities and hacking tools.
