The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical authentication bypass vulnerability in Ivanti Endpoint Manager (EPM), identified as CVE-2026-1603, to its Known Exploited Vulnerabilities catalog due to active exploitation. Federal agencies have been ordered to patch immediately.
Triage: Immediate patching is required due to active exploitation and CISA directive.
Attack Vector: Remote unauthenticated attackers can bypass authentication to leak stored credential data. This can lead to further compromise of the EPM management server and connected endpoints.
Ease of Exploit: Low complexity with no user interaction or privileges required.
Action Plan
Immediate Action: Upgrade to Ivanti EPM 2024 SU5 or later.
Workaround: None provided; patching is the only mitigation.
Detection: Monitor for anomalous authentication attempts and unauthorized credential access on EPM servers.
Relevant professional terms
Authentication Bypass
A vulnerability that allows attackers to circumvent normal login procedures and gain unauthorized access to systems or sensitive data.
KEV Catalog
CISA’s Known Exploited Vulnerabilities list that identifies flaws being actively used by threat actors, requiring prioritized patching for federal agencies.
U.S. investigators believe Chinese state-sponsored hackers breached the FBI's Digital Collection System Network, which manages sensitive data from court-authorized wiretaps.
The incident, detected on February 17, has triggered a multi-agency investigation involving the White House and NSA.
Attack Overview
Attack Path: The breach was executed via a supply chain attack, exploiting an internet service provider that was a vendor to the agency to bypass direct FBI defenses.
Attacker: Investigators suspect hackers affiliated with the Chinese government are responsible.
Impact Assessment
Data Stolen: The compromised system contains sensitive data from wiretaps, pen registers, and FISA warrants, including PII of FBI targets. The full scope of data exfiltration is still under investigation.
Strategic Takeaway
This incident highlights how sophisticated adversaries use supply chain vulnerabilities as a primary vector to infiltrate even the most secure government networks, bypassing perimeter defenses.
Relevant professional terms
Supply Chain Attack
A cyberattack that targets an organization by focusing on weaker links in its external partner or supplier network to gain access to the primary target's systems.
FISA Warrant
A warrant issued under the Foreign Intelligence Surveillance Act, authorizing electronic surveillance to obtain foreign intelligence information.
The Quittr app, designed to help users overcome pornography addiction, exposed highly sensitive, personal data of hundreds of thousands of users, including minors.
The exposure stemmed from a persistent security misconfiguration that the app's developers failed to correct despite being notified.
Attack Overview
Attack Path: A misconfigured Google Firebase instance allowed public access to the app's user database. This was not a sophisticated attack but rather a failure to implement basic cloud security controls by the developers.
Impact Assessment
Data Stolen: Intimate user-logged data for over 600,000 users was exposed, including age, masturbation habits, private confessions, and feelings about their pornography consumption. Notably, 100,000 of the affected users identified as minors.
Strategic Takeaway
This incident highlights the critical failure of developers to secure sensitive user data, prioritizing rapid application deployment and monetization over fundamental privacy and security principles.
Relevant professional terms
Data Exposure
An incident where sensitive information is unintentionally left accessible to the public, often due to misconfigurations or inadequate security controls, rather than a malicious breach.
Firebase
A mobile and web application development platform provided by Google. If not configured correctly, its databases can be left open, allowing unauthorized access to stored data.
Russian state-sponsored hackers are conducting a global phishing campaign to hijack the Signal and WhatsApp accounts of government officials, military personnel, and journalists.
The operation aims to access sensitive communications by tricking users into divulging security codes.
Key TTPs
Initial Access: Social engineering via phishing messages, often impersonating a "Signal Support Bot," to create a sense of urgency.
Execution: Attackers trick targets into sharing SMS verification codes and PINs or scanning a malicious QR code to abuse the "linked devices" feature.
Campaign Analysis
This campaign bypasses strong end-to-end encryption by targeting the human element, abusing legitimate application features rather than exploiting software vulnerabilities. The focus on secure communication platforms indicates a strategic effort to intercept sensitive government and military correspondence.
Targeting & Infrastructure
Target Profile: Government officials, civil servants, military personnel, and journalists, with confirmed targets in the Netherlands.
Relevant Terms
Phishing: A social engineering attack where adversaries send fraudulent messages designed to trick a person into revealing sensitive information.
Social Engineering: The psychological manipulation of people into performing actions or divulging confidential information.
ShinyHunters Targets Salesforce Cloud for Data Theft
Executive Summary
The ShinyHunters extortion group is actively stealing data from Salesforce customers by targeting misconfigured Experience Cloud platforms.
Attackers exploit guest user accounts with excessive permissions to access and exfiltrate sensitive company and user data.
Key TTPs
Initial Access: Exploiting overly permissive guest user configurations on public-facing Salesforce Experience Cloud sites, often identified by scanning for the /s/sfsites/aura API endpoint.
Campaign Analysis
This campaign leverages a known misconfiguration issue that Salesforce has previously alerted customers about.
ShinyHunters' claim of a "new bug" is likely a tactic to create urgency, while Salesforce maintains the issue is not a platform vulnerability but a customer-side configuration error.
Targeting & Infrastructure
Target Profile: Organizations using Salesforce Experience Cloud (Aura) sites where guest user permissions are improperly configured to be overly permissive.
Relevant Terms
Extortion Gang: A cybercriminal group that steals sensitive data and then demands a ransom payment to prevent its public release or sale.
Misconfiguration: An error in the security settings or setup of a system, such as a cloud platform, that unintentionally creates a security vulnerability.
Attackers are exploiting FortiGate Single Sign-On (SSO) vulnerabilities to gain administrative access.
Their goal is to exfiltrate device configurations, create rogue admin accounts for persistence, and establish a foothold for deeper network intrusion.
Execution: Attackers use their administrative access to deploy Remote Monitoring and Management (RMM) tools and exfiltrate sensitive files like the NTDS.dit database.
Defense Evasion: Creating multiple generic administrator accounts (e.g., `secadmin`, `itadmin`) to blend in with normal activity and maintain persistent access.
Campaign Analysis
This campaign highlights a shift from simple edge device exploitation to full Active Directory compromise. By exfiltrating firewall configurations and the NTDS.dit file, attackers can harvest credentials offline, enabling widespread lateral movement.
Targeting & Infrastructure
Target Profile: Organizations utilizing FortiGate, FortiWeb, FortiProxy, and FortiSwitchManager devices with FortiCloud SSO enabled.
Infrastructure: Actors have been observed using IP addresses from various hosting providers and Cloudflare-protected IPs to launch attacks.
Domains: Malicious logins observed from user account cloud-noc@mail[.]io.
Relevant Terms
NTDS.dit: A database file on Windows Domain Controllers that stores Active Directory data, including user accounts, groups, and password hashes.
SAML (Security Assertion Markup Language): An open standard for exchanging authentication and authorization data between parties, in particular, between an identity provider and a service provider.
SIM swap attacks exploit human-centric processes at mobile carriers to bypass SMS-based multi-factor authentication, enabling attackers to seize control of high-value financial and social accounts.
Key Findings
The FBI's Internet Crime Complaint Center (IC3) recorded 1,075 SIM swapping complaints in 2023, with associated losses nearing $50 million.
In the U.K., SIM swap fraud cases surged by a staggering 1,055% in one year, rising from 289 incidents to nearly 3,000.
Attackers primarily use social engineering to trick mobile carrier employees into porting a victim's number to a new SIM card.
The Bottom Line
The surge in SIM swap fraud highlights a systemic failure in using telecommunication networks as a primary pillar of identity verification.
This trend forces a strategic imperative for leaders to deprecate SMS-based authentication in favor of more robust methods like authenticator apps or hardware tokens.
Over-reliance on phone numbers as a security backstop is no longer a tenable risk.
Relevant Terms
SIM Swap Attack: A type of account takeover where an attacker fraudulently convinces a mobile carrier to transfer a victim's phone number to a SIM card they control.
Two-Factor Authentication (2FA): A security process where users provide two different authentication factors to verify themselves, one of which is often a code sent via SMS.
