BeyondTrust has released patches for a critical pre-authentication remote code execution (RCE) vulnerability, identified as CVE-2026-1731, affecting its Remote Support (RS) and Privileged Remote Access (PRA) products. The flaw allows an unauthenticated, remote attacker to execute arbitrary operating system commands and has been patched.
Vulnerability Details
Affected Product: Remote Support (RS) versions 25.3.1 and earlier, and Privileged Remote Access (PRA) versions 24.3.4 and earlier.
Identifier: CVE-2026-1731.
CVSS Score: 9.9 (Critical).
Exploitation Status: No evidence of active exploitation in the wild has been reported.
Risk & Impact
Triage: Immediate patching is required for all on-premise instances.
Attack Vector: An unauthenticated attacker can send specially crafted network requests to a vulnerable appliance to execute OS commands.
Ease of Exploit: Trivial, as the vulnerability is pre-authentication and requires no user interaction.
Action Plan
Immediate Action: Upgrade to Remote Support (RS) version 25.3.2 or later or Privileged Remote Access (PRA) version 25.1.1 or later. Cloud and SaaS instances have been patched automatically.
Workaround: If patching is not immediately possible for Remote Support, mitigation involves enabling SAML authentication for the public portal and enforcing session key usage.
Relevant professional terms
Remote Code Execution (RCE)
A type of vulnerability that allows a malicious actor to execute arbitrary commands or code on a target machine or in a target process over a network.
Pre-authentication
A phase in an attack that does not require the attacker to have valid login credentials. The vulnerability can be exploited before the authentication process is completed.
A high-severity security bypass vulnerability, CVE-2026-21509, in Microsoft Office is being actively exploited by the Russian state-sponsored group APT28. Microsoft has released an emergency patch to address the flaw, which allows attackers to circumvent security features via malicious documents.
Vulnerability Details
Affected Product: Microsoft Office 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps.
Identifier: CVE-2026-21509
CVSS Score: 7.8 (High).
Exploitation Status: Actively Exploited.
Risk & Impact
Triage: Immediate patching is required. The vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog due to active exploitation by state-sponsored actors.
Attack Vector: The vulnerability is exploited through specially crafted RTF or Word documents sent via spear-phishing emails. Opening the malicious file allows the attacker to bypass Object Linking and Embedding (OLE) security mitigations, leading to code execution without further user interaction.
Ease of Exploit: Low. The exploit only requires the victim to open a malicious document.
Action Plan
Immediate Action: Apply the out-of-band security updates released by Microsoft on January 26, 2026. Users of Office 2021 and later should restart their applications to ensure the server-side fix is applied.
Workaround: Microsoft has provided steps to make a Windows Registry change to mitigate the threat for users who cannot immediately apply the patch.
Detection: Monitor for suspicious process creation from Office applications, COM object hijacking, and changes to Outlook macro security settings. Security vendors have released signatures to detect exploitation attempts.
Relevant professional terms
RTF (Rich Text Format)
A document file format developed by Microsoft for cross-platform document interchange. Its specification allows for embedded objects and complex formatting, which can be abused by threat actors to hide malicious code.
APT28 (Advanced Persistent Threat 28)
A state-sponsored cyber espionage group attributed to Russia's General Staff Main Intelligence Directorate (GRU). Also known as Fancy Bear, the group is known for targeting government, military, and diplomatic organizations, often weaponizing new vulnerabilities quickly.
Software firm SmarterTools was compromised by the Warlock ransomware group, which exploited a critical vulnerability in the company's own SmarterMail product. The attack impacted a data center used for quality control, leading to service disruptions.
Attack Overview
Attack Path: The breach originated from an unpatched virtual machine running SmarterMail, likely exploiting CVE-2026-24423, a critical remote code execution (RCE) flaw. Attackers then moved laterally to other Windows servers.
Attacker: Warlock Ransomware Group
Impact Assessment
Operational Impact: The attack encrypted systems on the office network and a data center, affecting about 12 Windows servers and causing the company's support portal to go down. Network segmentation prevented a wider breach.
Strategic Takeaway
This incident highlights a critical failure in patch management and the inherent risk of a software company being compromised by vulnerabilities in its own products.
Relevant professional terms
Ransomware
A type of malicious software designed to block access to a computer system or data, typically by encrypting it, until a sum of money is paid.
Lateral Movement
The techniques an attacker uses to move through a network after gaining initial access, seeking to access sensitive data and assets.
Threat actors are distributing trojanized 7-Zip installers through a lookalike website to silently turn infected computers into residential proxy nodes. This allows the operators to route malicious traffic through victim machines, effectively hiding their own infrastructure.
Key TTPs
Initial Access: Luring users to a lookalike domain (7zip[.]com) that mimics the official site.
Execution: The user runs a trojanized installer signed with a revoked certificate. This installs a functional 7-Zip copy alongside the malicious proxy payload (hero.exe).
Defense Evasion: The malware modifies firewall rules and installs itself as a service to maintain persistence while appearing legitimate.
Campaign Analysis
This campaign leverages the trusted brand of 7-Zip to ensure a high likelihood of execution by unsuspecting users. The primary impact is the covert absorption of victim PCs into a proxy network for subsequent malicious activities.
Targeting & Infrastructure
Target Profile: Home and corporate users searching for the 7-Zip file compression utility.
Infrastructure: A deceptive website mimicking the official 7-Zip download page.
Actionable Intelligence
Domains:7zip[.]com
Relevant Terms
Residential Proxy: A network of internet devices in homes used by third parties to conceal their true IP address and location.
Trojanized Installer: A legitimate software installer that has been modified to include hidden malicious software.
The threat actor Bloody Wolf (aka Stan Ghouls) is targeting organizations in Uzbekistan and Russia. The campaign uses spear-phishing emails with malicious PDF attachments to deliver the NetSupport Remote Access Trojan (RAT) for system compromise.
Key TTPs
Initial Access: Spear-phishing emails contain malicious PDF decoys written in local languages, which link to the payload.
Execution: A Java-based loader downloads the NetSupport RAT package and executes it using a batch script.
Defense Evasion: The loader displays fake error messages to deceive the user while establishing persistence via Startup folder scripts, registry Run keys, and scheduled tasks.
Campaign Analysis
This campaign highlights the actor's shift to using legitimate remote administration tools like NetSupport RAT, likely to lower operational costs and evade detection. While the primary motive is believed to be financial gain, the extensive use of RATs suggests cyber espionage may also be a goal.
Targeting & Infrastructure
Target Profile: Primarily manufacturing, finance, and IT organizations in Uzbekistan, with additional victims in Russia, Kazakhstan, and other neighboring countries.
Infrastructure: The actor uses a sprawling infrastructure with dedicated domains for specific campaigns and has been observed refreshing it frequently.
Relevant Terms
Remote Access Trojan (RAT): Malware that provides an attacker with full remote control over an infected computer, enabling data theft and surveillance.
Spear Phishing: A targeted email attack aimed at a specific individual or organization to trick them into revealing sensitive information or deploying malware.
Recent advancements show that Large Language Models (LLMs) are becoming significantly more effective at autonomously finding high-severity, unknown software vulnerabilities, signaling a major shift in the cybersecurity landscape.
Key Findings
Anthropic's new model, Claude Opus 4.6, discovered over 500 high-severity flaws in open-source libraries with minimal human prompting.
Unlike traditional fuzzing which uses random inputs, advanced models reason about code like a human researcher to find logical flaws.
Research shows that teams of coordinated LLM agents can successfully exploit over 50% of tested zero-day vulnerabilities, a task where single agents struggle.
The Bottom Line
The rapid improvement of AI in vulnerability discovery fundamentally shrinks the time defenders have to patch unknown flaws. This development democratizes advanced offensive capabilities, forcing a strategic pivot from reactive security to proactive, AI-driven defenses and inherently resilient system architectures. Security leaders must now assume that attackers can automate the discovery of novel exploits at an unprecedented scale.
Relevant Terms
Zero-Day Vulnerability: A software security flaw unknown to the vendor, meaning no patch is available, leaving it open to exploitation.
Fuzzing: An automated software testing technique that inputs large amounts of invalid or random data ("fuzz") to a program to uncover crashes, bugs, and security loopholes.
Federal prosecutors in Connecticut charged two men with orchestrating a multi-year scheme to defraud FanDuel and other online gambling sites. The operation allegedly utilized thousands of stolen identities to generate approximately $3 million in profits.
The Scheme
TTP 1: Purchased stolen Personally Identifiable Information (PII) from darknet markets and Telegram.
TTP 2: Exploited new user promotional bonuses by creating thousands of fraudulent accounts.
TTP 3: Laundered winnings through virtual stored value cards to personal bank and investment accounts.
The Players
Facilitators Arrested:Amitoj Kapoor and Siddharth Lillaney
The Consequence
Outcome: Indicted on 45 counts including fraud, identity theft, and money laundering; released on bond.
Assets Seized/Forfeited: $3 Million (Profits from Scheme)
Strategic Takeaway
This operation reveals how easily threat actors can weaponize stolen identities at scale to exploit promotional incentives, posing a significant financial risk to online service platforms.
Relevant Terms
Identity Theft: The fraudulent acquisition and use of a person's private identifying information, usually for financial gain.
Darknet: A part of the internet that isn't indexed by search engines and requires special software to access, often used for illicit activities.
