Friday, May 29, 2026
Daily digest
Hackers Exploit FortiClient EMS Authentication Bypass (CVE-2026-35616) to Deploy Infostealer
Threat actors are actively exploiting CVE-2026-35616, a critical authentication bypass in FortiClient Enterprise Management Server, to deliver an undocumented credential stealer called EKZ across managed endpoints. The attack abuses the trusted endpoint management infrastructure itself to propagate malware, meaning any organization using FortiClient EMS for endpoint control is a potential target. Patch immediately and audit FortiClient EMS deployments for signs of lateral movement or unexpected credential access.
Unpatched Gogs Zero-Day (CVSS 9.4) Allows Any Authenticated User to Execute Arbitrary Code
A critical, currently unpatched RCE vulnerability in the Gogs self-hosted Git service allows any authenticated user to execute arbitrary code on internet-facing instances — no CVE has been assigned yet. Organizations running Gogs as an internal code repository (common in air-gapped or self-hosted DevSecOps pipelines) should restrict public access and limit authenticated users immediately. No vendor patch is available; mitigations include network-level access controls until a fix is released.
Microsoft: Typosquatted npm Packages ('Mini Shai-Hulud' Campaign) Stealing Cloud and CI/CD Secrets
Microsoft has detailed an active supply chain campaign using typosquatted npm packages to exfiltrate cloud credentials and CI/CD secrets from developer environments. The attack targets common package naming patterns to slip malicious code into build pipelines, directly threatening AWS and other cloud credential stores. Ansible, GitHub Actions, and any npm-consuming pipeline should be audited; enforce package integrity checks and use private registries where possible.
Russian-Linked GREYVIBE Uses ChatGPT and Gemini Throughout Attack Chain Against Ukrainian Targets
A newly identified Russian-linked threat group dubbed GREYVIBE has been using commercial AI tools — including ChatGPT and Gemini — to generate phishing lures, custom malware, and post-exploitation tooling in campaigns targeting Ukrainian military and government entities since at least August 2025. This is a meaningful escalation: AI is being used not just for lure generation but throughout the full attack lifecycle. Defense contractors supporting Ukraine-related work or operating in NATO-adjacent contexts should treat this as a direct threat-intelligence signal.
LLM Agent Used for Post-Exploitation After Marimo CVE-2026-39987 Compromise
An unknown threat actor exploited CVE-2026-39987 in a publicly accessible Marimo notebook to gain initial access, then deployed an LLM agent to autonomously conduct post-exploitation actions including extracting cloud credentials. This represents a concrete, observed case of AI-assisted post-compromise automation — not a theoretical risk — and signals that dwell time between initial access and credential theft may be shrinking dramatically. Organizations running data science notebook environments (Marimo, Jupyter, etc.) in internet-accessible configurations should treat them as high-priority hardening targets.
Microsoft's 'The Gentlemen' Ransomware Analysis: Self-Propagating Go Encryptor with Aggressive Lateral Movement
Microsoft Threat Intelligence has published a deep technical breakdown of The Gentlemen ransomware, a Go-based encryptor deployed by Storm-2697 affiliates that uses per-file ephemeral key encryption and an aggressive self-propagation module to spread across entire networks simultaneously. The simultaneous lateral movement approach is particularly dangerous in flat or semi-segmented environments like those common in Nutanix AHV clusters. The analysis includes detection indicators — security teams should validate coverage against their EDR and SIEM rules now.
Complex Cloud Integration Misconfigurations: Small Errors Enabling Full Compromise via Over-Permissioned Roles and NHIs
Researchers identified an exploit chain in a popular automation service combining over-permissioned IAM roles, exposed secrets, and non-human identities (NHIs) that could have led to full environment compromise. The findings underscore that cloud security failures are rarely a single vulnerability — they are chains of configuration drift, and NHIs (service accounts, API keys, automation tokens) are increasingly the pivot point. AWS GovCloud environments using Ansible or similar automation should audit NHI privilege scopes and secrets rotation cadence.
Dutch Authorities Disrupt Botnet of 17 Million Devices, Seize 200+ Servers
Dutch police took down a massive botnet spanning 17 million infected devices after tracing more than 200 supporting servers to a Netherlands-based hosting provider and compelling the provider to pull the plug. The scale of the takedown highlights how commercial hosting infrastructure continues to underpin large-scale malicious operations. IT admins should cross-reference their threat feeds for IOCs associated with this botnet and check endpoint telemetry for any devices that may have been enrolled.
Google Chrome Rolls Out Device Bound Session Credentials (DBSC) to All Users to Block Cookie Theft
Google has made Device Bound Session Credentials generally available in Chrome, cryptographically binding session cookies to the specific device so stolen cookies cannot be replayed from an attacker-controlled machine. This directly addresses a primary technique used in session hijacking attacks that bypass MFA — a persistent threat in M365 and cloud environments. Admins managing Chrome via Intune or group policy should verify DBSC is not being suppressed by enterprise policy configurations.
OMB and CISA 'Detect, Understand, Respond' Framework Driving Latest Federal Cyber Efforts
CISA's acting director outlined an intergovernmental initiative structured around a 'detect, understand, respond' model aimed at giving critical infrastructure owners improved threat visibility and response support. The effort signals continued federal prioritization of operational cyber defense capabilities, which aligns with CMMC Level 2 incident response and audit logging requirements under NIST 800-171. Defense contractors should watch for any resulting guidance updates that could affect assessment scope or required controls.
AWS Network Firewall Now Supports Native Transit Gateway Attachment — Migration Guide Published
AWS has released guidance on migrating from the inspection-VPC model to a Transit Gateway-attached AWS Network Firewall deployment, which simplifies centralized traffic inspection across multi-VPC architectures. This is directly relevant to AWS GovCloud environments running hub-and-spoke network topologies, as it can reduce routing complexity and management overhead. The blog includes step-by-step migration steps and architecture diagrams worth reviewing before the next infrastructure change window.
HashiCorp Vault 2.0 Adds SCIM Support for Standardized Identity Provisioning
HashiCorp Vault 2.0 introduces beta SCIM support, enabling organizations to standardize user and group provisioning from external identity providers (such as Entra ID / Azure AD) directly into Vault. For environments using Vault for secrets management alongside Intune and M365 GCC High, this can significantly reduce manual provisioning overhead and associated access control drift. The SCIM integration puts Vault lifecycle management in line with enterprise identity governance requirements relevant to NIST 800-171 AC controls.