Star Blizzard Sends RedFlick Archives to Plant Windows Tasks
Reply-stage archives lead to RedFlick scheduled tasks and CosmicPulse. Hunt the task names, trace the archive, and verify senders through a known channel.
Reader edition
The Feed
WSO2 API Flaw Draws Conflicting Accounts as CISA Confirms Exploitation
CISA describes file upload and possible code execution; WSO2 describes a JWT bypass and account takeover. Check product builds and reconcile the attack path with WSO2.
CISA Flags Exploited Zammad Session Flaw Leading to Code Execution
CISA lists an exploited session flaw with code execution as the Zammad user. Zammad says 6.5 and older are exploitable; move those installations to 7.2.0 and triage exposure.
CISA Lists Exploited F5 BIG-IP APM Flaw Allowing Code Execution
The exposed configuration is an APM OAuth Authorization Server virtual server. Request F5’s interim iRule for triage, then install the applicable final fix.
Cisco Talos Uses CAIRN to Hunt AI Malware From Sample Metadata
CAIRN groups malware candidates by AI-related metadata, then separates artifact presence from behavior and confirmed families. Triage noisy matches before calling an incident.
Storm-2570 Reuses Remote Access to Steal Data and Deploy Ransomware
Microsoft tracked the same affiliate through four ransomware ecosystems. Hunt renamed MeshAgent services, domain-controller copies and cloud-transfer tooling before encryption.
Norwegian Cruise Line Ship Doors Accept Cloned Keycards
Some shipboard access readers accept a copied card identifier. Identify UID-only doors, shield issued cards and add supervised access to sensitive areas while seeking a fix.
Microsoft Brings Sensitive AI Upload Blocking to Entra Networks
Purview classifies files and text while Entra enforces network policy for employee and on-behalf-of agent traffic. Confirm forwarding and an active blocking rule before relying on it.
CISA Flags Exploited Zammad Flaw That Elevates Service Account to Root
A local zammad account can escalate to root. CISA lists exploitation; the vendor disputes the reported scope and recommends upgrading to 7.2.0.
IBM Turbonomic Operator Grants Cluster-Wide Access to Secrets
Prometurbo's service account could read secrets outside its own namespace. Reinstall the fixed agent and test the operator's effective permissions.
MikroTik RouterOS Rekey Error Exposes Routers With Open SSH
CISA lists a RouterOS SSH rekey flaw as exploited. It lets unauthenticated clients reach a command path and can chain with a second flaw; update and restrict SSH.
HP BIOS Flaw Lets Kernel Attackers Write to Protected Firmware Memory
An HP-specific InsydeH2O SMM handler accepts unsafe memory parameters from a local kernel attacker. Check HP PCs for exposure and install a model-matched BIOS update when HP lists one.
Fortinet FortiMail Attackers Write Files Through Its Web Interface
CISA lists an exploited FortiMail arbitrary-file-write flaw. Fortinet urges operators to disable IBE or restrict management access while branch upgrades are forthcoming.