Weekly Threat Bulletin – October 14th, 2026

Flax Typhoon Uses EBurst Against Microsoft 365 and Exchange in Email Espionage

A joint advisory issued by the FBI and international partner agencies exposes the cyber espionage operations of the China-linked, for-profit firm Integrity Technology Group, which has been sanctioned by both the United States and the United Kingdom. Operating since at least January 2021, the threat actors—whose activities align with groups tracked as Flax Typhoon, Ethereal Panda, and RedJuliett—targeted government, law enforcement, healthcare, and religious organizations across Southeast Asia, Africa, and North America. The hackers utilized a custom Python-based scanner named MicroScan, containing over 1,300 scripts, alongside open-source tools to exploit several vulnerabilities, including CVE-2014-6278 (GNU Bash), CVE-2015-3306 (ProFTPD), CVE-2015-5477 (ISC BIND), CVE-2016-3081 (Apache Struts), CVE-2019-11510 (Pulse Connect Secure), CVE-2021-22205 (GitLab), CVE-2021-3199 (ONLYOFFICE), and CVE-2023-22894 (Strapi). Once inside a network, they deployed the EBurst tool for password spraying against Microsoft 365 and Exchange accounts, established persistence via disguised SoftEther VPN installations, and exfiltrated mailbox data using tools like DC.exe, Curlc4.txt, and office-cli, even hosting a web application that granted unidentified third parties access to the stolen emails. Following the September 2024 disruption of the group's 200,000-device "Raptor Train" botnet, defenders are urged to implement multi-factor authentication, monitor for DCSync Active Directory replication, and patch the identified vulnerabilities to mitigate ongoing risks.

Severity: High

Threat Details and IOCs

Mitigation Advice

• Add the domains 'dns.studiocloud[.]xyz' and 'natcloudservice[.]com' to your firewall, DNS sinkhole, and web proxy blocklists. Create detection rules in your EDR for the file names 'live700_v1.exe', 'DC.exe', and for renamed SoftEther installers 'conhost.exe' or 'dllhost.exe'.
• Use your vulnerability scanner to identify all systems running GNU Bash versions vulnerable to CVE-2014-6278 and apply the necessary patches immediately.
• Use your vulnerability scanner to identify all systems running ProFTPD 1.3.5, which is vulnerable to CVE-2015-3306, and upgrade to version 1.3.5a or later.
• Use your vulnerability scanner to identify all systems running ISC BIND versions vulnerable to CVE-2015-5477 and apply the necessary patches immediately.
• Identify all Apache Struts instances vulnerable to CVE-2016-3081. Either apply the security patches or disable Dynamic Method Invocation as an immediate mitigation.
• Immediately identify and patch all Pulse Connect Secure appliances vulnerable to CVE-2019-11510.
• Use your vulnerability scanner to identify all GitLab instances vulnerable to CVE-2021-22205 and apply the necessary patches immediately.
• Identify all ONLYOFFICE Document Server instances vulnerable to CVE-2021-3199. Either apply the security patches or ensure JWT is enabled and used for authentication as an immediate mitigation.
• Use your vulnerability scanner to identify all Strapi instances vulnerable to CVE-2023-22894 and apply the necessary patches immediately.
• In your SIEM or EDR, create a detection rule or run a threat hunting query to identify and alert on Active Directory replication requests originating from any host that is not a domain controller.
• Review external firewall rules to ensure that ports 21, 22, 53, 80, 443, and 1080 are not exposed to the internet unless there is a documented business requirement.
• Audit all connected applications in your Microsoft 365 environment. Scrutinize and remove any applications with high-privilege permissions, such as 'Mail.ReadWrite' or 'Mail.Read.All', that are not recognized and approved.

Compliance Best Practices

• Develop and implement a project to enforce phishing-resistant Multi-Factor Authentication (MFA) for all accounts, prioritizing webmail, VPNs, and other internet-facing systems.
• Establish a formal vulnerability management program that includes regular authenticated scanning, risk-based prioritization using sources like the CISA KEV catalog, and defined Service Level Agreements (SLAs) for patching.
• Integrate security into your software development lifecycle (SDLC) by requiring input sanitization and secure coding training for developers to prevent vulnerabilities like Cross-Site Scripting (XSS).
• Design and implement a network segmentation plan to isolate critical infrastructure, such as domain controllers, from general user networks and web-facing servers.
• Implement a technology lifecycle management policy that includes maintaining a complete asset inventory and proactively replacing all software and hardware that reaches end-of-life (EOL).
• Harden Microsoft 365 and on-premise Exchange servers by disabling legacy authentication protocols and restricting access to management interfaces (e.g., EWS, PowerShell) to a limited set of administrative jump boxes.

CVE-2026-102255 in SonicWall SMA1000 Actively Exploited for SSRF

Active exploitation attempts have been detected targeting a maximum-severity vulnerability, tracked as CVE-2026-102255, which affects the Appliance WorkPlace interface on SonicWall SMA1000 models 6210, 7210, and 8200v. This flaw allows remote, unauthenticated attackers to conduct server-side request forgery (SSRF) by directing the appliance to issue requests on their behalf to access internal functionality. Observed exploitation attempts target the WorkPlace Extraweb interface using a crafted `OPTIONS` request to reach the internal CouchDB service at `127.0.0.1:5984`, attempting to traverse into a CouchDB design document, invoke its `_rewrite` function, and supply an HTTP Basic Authorization header with the credentials `admin:admin`. Although SonicWall patched the vulnerability recently, over 400 SMA1000 appliances remain exposed online, making them high-value targets for threat actors who have historically targeted these gateways to deploy custom malware like Sou5, OrangeTail, and RootRun.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Immediately apply the patch for CVE-2026-102255 to all affected SonicWall SMA1000 models, including 6210, 7210, and 8200v.
• Review network and web server logs for all SonicWall SMA1000 appliances for anomalous OPTIONS requests targeting the WorkPlace Extraweb interface, specifically looking for requests attempting to connect to an internal service at 127.0.0.1:5984.
• In your SIEM or log management platform, create a query to search for any inbound HTTP requests to SonicWall SMA1000 appliances that contain a Basic Authorization header with the credentials 'admin:admin'.
• If patching cannot be performed immediately, implement firewall rules to restrict all access to the SonicWall SMA1000 management and WorkPlace interfaces to only known, trusted IP address ranges.

Compliance Best Practices

• Establish and resource a formal vulnerability management program that includes subscribing to vendor security advisories and CISA's Known Exploited Vulnerabilities (KEV) catalog to ensure rapid identification, risk assessment, and remediation of future vulnerabilities.
• Design and implement network segmentation to create a DMZ for internet-facing appliances like the SonicWall SMA1000. Strictly limit connectivity from this zone to the internal corporate network, allowing access only to specific required resources on a deny-by-default basis.
• Ensure that all logs from edge security appliances, including SonicWall SMA1000 devices, are ingested into a central SIEM. Develop and tune detection rules to alert on anomalous outbound traffic or activity originating from these devices targeting internal systems.
• Implement a continuous asset discovery and inventory process for all internet-facing hardware and software. This inventory should be detailed enough to quickly identify all systems affected by newly disclosed vulnerabilities.

PoC Exploit Released for CVE-2026-59346 Affecting VMware Workstation and Fusion Guest-to-Host

A public proof-of-concept (PoC) exploit has been released for CVE-2026-59346, a critical integer overflow vulnerability in VMware Workstation and Fusion that carries a CVSS v3.1 score of 9.3. The flaw exists within the VMXNET3 virtual network adapter’s TCP Segmentation Offload (TSO) processing inside the host-side `vmware-vmx` process. When calculating segment allocation sizes, a 32-bit multiplication operation can overflow and wrap around, resulting in an undersized memory buffer allocation and a subsequent out-of-bounds write. This vulnerability, which bypasses previous validation checks introduced for CVE-2025-41236, allows a privileged attacker inside a guest virtual machine to execute code on the underlying host. Developed by security researcher Stan S, the Linux guest kernel-module PoC writes crafted descriptors directly into the VMXNET3 transmit ring to trigger a host-side segmentation fault, crashing the host process and powering off the guest VM. The vulnerability affects VMware Workstation and Fusion versions 25H2 and 26H1, and has been resolved in version 26H1u1; no workarounds are currently available.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Scan the network and all endpoints to identify all installations of VMware Workstation and VMware Fusion, specifically looking for vulnerable versions 25H2 and 26H1.
• Upgrade all VMware Workstation installations to version 26H1u1 or later to remediate CVE-2026-59346.
• Upgrade all VMware Fusion installations to version 26H1u1 or later to remediate CVE-2026-59346.
• Review host system logs for unexpected crashes or segmentation faults of the `vmware-vmx` process, which could indicate an attempted exploitation of CVE-2026-59346.

Compliance Best Practices

• Implement and enforce a policy of least privilege for all virtual machine users, restricting administrative access within guest operating systems wherever it is not strictly required for business functions.
• For virtual machines that do not require the performance of the VMXNET3 adapter, configure them to use a different virtual network adapter type, such as E1000e, to reduce the attack surface.
• Enhance the asset management program to maintain a real-time inventory of all installed software, including virtualization platforms like VMware Workstation and Fusion, to accelerate identification and remediation during future security incidents.
• Develop a network segmentation strategy to isolate hosts running virtual machines from critical production networks, limiting the potential impact of a successful guest-to-host escape.

Citrix Warns to Patch CVE-2026-107406 RCE Flaw in NetScaler ADC and Gateway

Citrix has issued an urgent warning for system administrators to patch a critical remote code execution (RCE) and denial-of-service (DoS) vulnerability, tracked as CVE-2026-107406, affecting NetScaler ADC and NetScaler Gateway appliances. Stemming from a memory overflow weakness, the flaw impacts devices configured as a Security Assertion Markup Language (SAML) Identity Provider (IdP) or Service Provider (SP). To mitigate the risk, organizations must upgrade to NetScaler versions 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS, or 13.1.37.283 FIPS/NDcPP and later. Although there are currently no reports of active exploitation for this specific vulnerability, threat monitoring by Shadowserver indicates over 21,000 internet-exposed NetScaler instances, and the advisory follows a series of recently exploited NetScaler zero-days, including CVE-2026-88771, CVE-2026-88772, and CVE-2026-88779.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Identify all NetScaler ADC and NetScaler Gateway appliances in the environment and immediately verify if they are configured as a SAML Service Provider (SP) or Identity Provider (IdP).
• For all vulnerable appliances identified, apply the security updates provided by Citrix to upgrade to NetScaler ADC/Gateway version 14.1-73.46, 13.1-64.29, or later as appropriate.
• Perform a threat hunt on all NetScaler appliances, looking for indicators of compromise such as suspicious files in web-accessible directories, unauthorized local user accounts, or unexpected outbound network connections.

Compliance Best Practices

• Implement and enforce strict firewall rules to ensure the management interfaces of all NetScaler appliances are not exposed to the internet and are only accessible from a secured, internal management network.
• Establish a formal policy and procedure for emergency patching of critical, internet-facing infrastructure, defining a maximum time-to-patch of 48 hours for vulnerabilities known to be actively exploited or with a high likelihood of exploitation.
• Configure all NetScaler appliances to forward system, audit, and traffic logs to a centralized SIEM. Develop and test detection rules specifically designed to alert on anomalous activities indicative of compromise, such as web shell execution or data exfiltration patterns.

Cisco NX-OS Critical Vulnerability CVE-2026-76485 Allows Remote Root Access

Cisco has disclosed three critical stack-based buffer overflow vulnerabilities (CVE-2026-76485, CVE-2026-76486, and CVE-2026-76501) in the Next Generation Operation, Administration, and Maintenance (NGOAM) feature of Cisco NX-OS Software, carrying a CVSS severity score of 9.8. These flaws allow unauthenticated remote attackers to execute arbitrary code with root privileges, trigger process crashes, or cause denial of service on affected Nexus 3000 and Nexus 9000 Series switches operating in standalone NX-OS mode by sending specially crafted packets to an IP interface. While CVE-2026-76485 only requires NGOAM to be enabled, CVE-2026-76486 additionally requires Segment Routing over IPv6 (SRv6) or a Network Virtualization Overlay configuration, and CVE-2026-76501 requires both NGOAM and SRv6. Administrators can verify exposure using commands such as `show feature | include ngoam`, `show feature | include nve`, and `show feature | include srv6`. Although Cisco has released software updates to address these vulnerabilities, organizations can mitigate the risk by disabling the vulnerable feature using the `no feature ngoam` command in global configuration mode or by applying temporary Live Protect shields.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Create an inventory of all Cisco Nexus 3000 and Nexus 9000 series switches operating in standalone NX-OS mode to identify potentially affected assets.
• On all inventoried Cisco Nexus 3000 and 9000 switches, run the command `show feature | include ngoam` to determine if the vulnerable NGOAM feature is enabled.
• On all inventoried Cisco Nexus 3000 and 9000 switches, run the command `show feature | include nve` to determine if the Network Virtualization Overlay feature is enabled, a condition for CVE-2026-76486.
• On all inventoried Cisco Nexus 9000 switches, run the command `show feature | include srv6` to determine if the SRv6 feature is enabled, a condition for CVE-2026-76486 and CVE-2026-76501.
• For all identified vulnerable switches, use the Cisco Software Checker tool to find the correct patched version of NX-OS software and schedule an emergency maintenance window to apply the update.
• If patching cannot be immediately performed, and after confirming no operational impact, disable the vulnerable feature on affected switches by entering global configuration mode and running the command `no feature ngoam`.

Compliance Best Practices

• Establish and implement a formal patch management policy for all network infrastructure, including switches, routers, and firewalls. This policy should define a regular schedule for reviewing and applying security updates based on risk.
• Implement strict access control lists (ACLs) on network device interfaces to restrict management and protocol traffic to only authorized administrative subnets and systems, reducing the attack surface for remote exploits.
• Institute a policy for periodic configuration audits of all network devices to identify and disable any non-essential features or services, adhering to the principle of least functionality to minimize the attack surface.
• Develop and regularly test an incident response and disaster recovery plan specifically for critical network infrastructure failure. The plan should include procedures for failover, device restoration from backup, and stakeholder communication.