ITW exploits and new 0-days, global state-sponsored operations, AI frameworks and emerging threats
Vulnerabilities: Google and Microsoft 0-days and several flaws exploited ITW
Over the past week, numerous actively exploited vulnerabilities were detected, including two Google Chrome and Microsoft Outlook 0-days and several flaws subsequently added to CISA’s KEV catalog. Google patched CVE-2026-125350, a Use-After-Free vulnerability in Chromium’s XML component that allows arbitrary code execution within the browser sandbox through a malicious webpage. The vendor confirmed the existence of an ITW exploit without providing further details. In parallel, Microsoft released its November Patch Tuesday updates, which included a fix for the Outlook 0-day CVE-2026-124194 (CVSS 6.5). This vulnerability allows an unauthenticated remote attacker to trick a user into opening a specially crafted message file, triggering a connection to an attacker-controlled network resource without the usual security warning, potentially exposing the NTLMv2 hash and creating an impersonation risk. On 10 November, CISA added both 0-day vulnerabilities to its KEV catalog, along with six other flaws exploited ITW. These included CVE-2026-20320 in Cisco BroadWorks, an XML External Entity (XXE) Injection vulnerability exploited during Operation Snowball by a Chinese-speaking adversary using an autonomous offensive framework based on DeepSeek Flash to steal private keys and SSL credentials from BroadWorks XSP systems; CVE-2026-116606 and CVE-2026-111560 in Barracuda Networks, respectively an Authentication Bypass and an OS Command Injection vulnerability that can be chained to obtain unauthenticated root access to Email Security Gateway (ESG) appliances with accessible administrative interfaces; and CVE-2026-111793 in Openwave Messaging Webtop Media Transcoder, which allows an authenticated user to bypass file-type restrictions and access sensitive information. Barracuda confirmed active exploitation against a limited number of organizations, without establishing whether the two flaws had been chained, while 17 exploitation attempts targeting CVE-2026-116606 from 15 IP addresses were observed between 9 and 11 November. Furthermore, after identifying evidence of active exploitation, CISA added five vulnerabilities to its KEV catalog on 6 and 9 November: CVE-2026-19868 (CVSS 7.1) in SonicWall SonicOS, a Use of Single-factor Authentication vulnerability allowing an attacker possessing valid credentials for an alternative authentication method to bypass SAML controls and potentially the SSL-VPN service’s MFA; CVE-2026-102895 (CVSS 9.8) in GPUStack, an authentication flaw enabling unauthenticated remote acquisition of administrative privileges, exploited to create malicious backends and execute reverse shells; CVE-2026-116779 (CVSS 9.8) in SignalWire FreeSWITCH, a Code Injection vulnerability allowing command execution through malicious SIP MESSAGE messages, even without authentication in certain configurations; CVE-2026-123158 (CVSS 8.1) in OpenSSH, named SSHole, an Authentication Bypass affecting specific Linux configurations based on musl libc without PAM, including Alpine Linux, enabling unauthorized access to accounts normally inaccessible through password authentication; and CVE-2026-123218 (CVSS 9.8) in IBM Aspera Faspex, an Incorrect Authorization vulnerability allowing an authenticated user to obtain full administrative privileges. In particular, successful attacks exploiting SSHole have been documented since 7 November, some linked to the GT10 cluster, which exploited the flaw to execute commands, attempt to establish persistence and, in at least one case, obtain root privileges and deploy the Python TAC Agent C2. CISA instructed US Federal Civilian Executive Branch (FCEB) agencies to remediate CVE-2026-102895, CVE-2026-116779, CVE-2026-123158 and CVE-2026-123218 by 12 November 2026; CVE-2026-116606 and CVE-2026-111560 by 13 November; CVE-2026-19868 by 20 November; and CVE-2026-20320, CVE-2026-111793, CVE-2026-124194 and CVE-2026-125350 by 24 November 2026.
State-sponsored: cyberspionage, supply chain compromises and attribution of OT attacks in France
Between 3 and 4 November 2026, security researchers identified new activity associated with the PolinRider campaign, attributed to the North Korean Lazarus Group, involving 17 compromised npm packages collectively accounting for approximately 1,400 weekly downloads. The malicious JavaScript loaders, executed during module imports or application startup, query the Ethereum blockchain to dynamically retrieve C2 server addresses and download additional payloads, including a Node.js RAT capable of executing commands, transferring files and accessing the clipboard. The packages were removed, but neither the number of infections nor any stolen data has been confirmed. Also in connection with Lazarus Group, an investigation into TLS certificates and network fingerprints identified 13 IP endpoints associated with the infrastructure of the FLATROOF and ROOFDECK malware, used in campaigns targeting the cryptocurrency sector through fake job interviews, malicious repositories and trojanized Terraform providers. The evidence does not demonstrate that all endpoints operated as C2 servers, nor does it allow them to be directly linked to the recent late-October attack against Binance. Turning to Russia, Turla Group conducted a cyberspionage campaign against government organizations in Kazakhstan and Romania using Cereal, a toolkit consisting of eight .NET modules designed for compromised Microsoft Exchange servers. In the Romanian case, the malware was configured to identify communications with institutional NATO and European Union addresses. The intrusions were detected between November and December 2025, with activity continuing into January 2026, although the initial attack vector was not identified. On 11 November 2026, Romania’s intelligence service, SRI, confirmed that it had detected and blocked the attack against the national institution, stating that no sensitive data exfiltration had been identified and that the email service had been restored. On the Chinese front, three cyberspionage campaigns associated with the Sparrow framework were documented, named SilentDelivery, OceanGate and DarkWire, with activity observed across 21 countries. Technical overlaps suggest that the adversary CopperDragon may supply tools to China-aligned groups, including GhostEmperor and UAT-9244, without definitive attribution of individual intrusions. SilentDelivery exploited compromised legitimate websites and fake Chrome notifications to distribute the SquadC and SparrowDoor backdoors; OceanGate targeted Asian government organizations and critical infrastructure using AnnobinDoor, SparrowShell, trojanized SSH components and SparrowDoor variants, resulting in the exfiltration of sensitive operational information; DarkWire targeted Latin American telecommunications operators and government entities through CopperLoader, CopperDoor and CopperDNS, the latter characterized by C2 communications using DNS MX queries. Also in Asia, the Kazakh state-sponsored group Silent Lynx was linked to compromises of Tajikistan’s railway network and government systems, as well as Uzbekistan’s Smart Forestry platform, documented through an exposed directory on the adversary’s infrastructure. In Tajikistan, the attacker maintained persistent domain-privileged access to the railway network and, using a compromised account, reached the government EDO platform, collecting more than 2,000 documents processed through the Ministry of Defence. In Uzbekistan, malicious WAR files, web shells and privileged PostgreSQL access enabled command execution on the compromised GeoServer server. The activities involved spear phishing with LNK files, the use of Laplas and Chvost malware, and Hermes, an agentic framework based on DeepSeek and Gemini to automate reconnaissance, document collection and the removal of operational traces. Preparations for a possible campaign against Turkmenistan also emerged, without confirmed compromises. Remaining in the Asian threat landscape, a cyberspionage campaign based on GravityRAT malware primarily targeted Indian military personnel and defence industry professionals. The threat, detected on 14 devices in India over the previous twelve months, is distributed through fake recruitment portals that induce victims to install Android applications outside Google Play, enabling the collection of communications, location data, documents and encrypted WhatsApp backups. The investigation also identified DropDeckX, Windows malware developed in Electron with credential theft, persistence and additional payload deployment capabilities. Attribution remains unclear, although the malware has been associated with the Pakistan-aligned adversary Cosmic Leopard (SpaceCobra). Finally, on the Iranian front, on 9 November the French Government officially attributed the attacks of 11 and 12 October against refrigeration systems at approximately 700 French food facilities to the Islamic Revolutionary Guard Corps (IRGC), identifying the Shahid Kaveh cyber unit as the operational perpetrator, associated with the hacktivist identities CyberAv3ngers, Soldiers of Solomon, Mr. Soul and Cyber Isnaad Front. Manipulation of defrosting parameters caused food losses estimated at several tens of millions of euros and at least 15 incipient fires. Authorities also linked attacks against Schneider Electric equipment at small hydroelectric plants to the same operation. The attribution is based on infrastructure correlations, preparatory reconnaissance activity and additional operational indicators. The Paris Prosecutor’s Office opened an investigation and requested international arrest warrants, while France announced diplomatic and sanctions-related initiatives against Tehran. The attribution concerns exclusively the French incidents of October and does not extend to the subsequent European wave in November claimed by NoName057(16) and Z-Pentest.
Cybercrime: AI-based attacks, malicious campaigns and threats targeting Italy
During the week, three separate campaigns were documented involving the use of AI agents to automate various stages of cyber intrusions. Starting in October 2026, the Cambodia-based cybercriminal group Storm-3358 used the ARTEX framework against financial organizations, primarily in Southeast Asia, combining reconnaissance of exposed systems, exploitation of application weaknesses, including SSRF vulnerabilities and anonymous file upload functionality, and deployment of the WISP, VSHELL and AdaptixC2 RATs for persistence and lateral movement. In a campaign named Operation Snowball, a Chinese-speaking adversary used a custom framework based on DeepSeek Flash, modified to bypass its security restrictions and coordinate autonomous agents in reconnaissance, vulnerability exploitation and post-compromise activities. The attacks exploited CVE-2026-20320 in Cisco BroadWorks to steal private keys and SSL credentials, as well as CVE-2013-2165 in JBoss/RichFaces and CVE-2020-7961 in Liferay to obtain additional access. Web shells, credential harvesting, extraction of the NTDS.dit database and adaptation of offensive techniques to encountered security controls were also observed, without confirmed attribution to specific groups or state organizations. A third campaign, named BOSSAI, used an infrastructure of 12 AI agents, nine of which were operational, against hundreds of organizations in 11 countries, with unauthorized access or documented exfiltration at approximately ten targets. The activities, based on SQL Injection, default credentials, unprotected APIs and brute-force attacks, primarily affected Taiwanese emergency services, with the theft of 119 incident response records in Taipei, as well as financial organizations, Thai universities and Mexican telephone directories. The operation was attributed with high confidence to a single individual residing in Taiwan, without demonstrated links to state structures. Regarding the abuse of legitimate infrastructure, anomalous activity associated with Dixell/Copeland XWEB PRO industrial controllers was detected from 2 November: nine IP addresses generated SMTP traffic to more than one thousand destinations, three of which were identified as XWEB devices, while additional systems exhibited behavior consistent with proxy and tunneling services. Six exposed controllers running firmware vulnerable to CVE-2026-25085 were also identified, without evidence that the flaw had been exploited. Neither the existence of a coordinated botnet nor operational links to the recent attacks against European refrigeration systems have been confirmed. A separate case involving the abuse of legitimate access affected Qubole customers’ cloud environments: between 14 and 26 October, an unidentified adversary used IAM credentials associated with the provider to assume still-active AWS roles, collect secrets and credentials, conduct resource reconnaissance and exfiltrate objects from S3 buckets. Other reported threats included the Windows infostealer REVSTEALER, distributed through fake software, deceptive GitHub repositories and compromised YouTube channels used to spread AI-generated videos. The infrastructure includes more than 100 potentially related domains, not all confirmed as malware distributors. REVSTEALER steals credentials, cookies, browser data, password manager information and cryptocurrency wallets, using evasion techniques and smart contracts on the Polygon blockchain as an alternative C2 mechanism through the EtherHiding technique. Additional modules can introduce persistence, remote access and deploy the XMRig. miner. In Italy, on 13 November the pro-Russian hacktivist collective NoName057(16) claimed to have compromised a FERTOOL fertigation system, a brand belonging to the Sicilian company La Macchia Salvatore S.r.l., stating that it had modified parameters in the HMI interface and interrupted the water supply. The claim was accompanied by a video, but the effects on the facility have not been independently verified. On 8 November, the user weykofa announced on an underground forum the sale of an alleged archive stolen from the Anti-Mafia Investigation Directorate (DIA), comprising 302 files totaling 222.3 MB of purported investigative, operational and administrative documentation, without confirmation that any compromise actually occurred. The Municipality of Rimini, meanwhile, confirmed that it had repelled a cyberattack in the weeks preceding 10 November, with no system compromises or data losses; at the same time, phishing campaigns targeting municipal offices in the Rimini area, apparently originating from government authorities, were reported, without established links to the incident. On the smishing front, a fake INPS website distributed via SMS was identified, inviting Android users to download a purported INPS Mobile application from outside official app stores. At the time of analysis, the download was simulated and the APK file could not be installed, suggesting a possible campaign still in preparation. Finally, on 10 November, members of Anka Team, a group associated with the Turkish collective TurkHackTeam, claimed on an underground forum to have stolen more than 19.5 million records from the Academy of Digital Municipalities and VisionFund International, allegedly including personal and financial data, credentials and infrastructure information.
Weekly Threats Report is Telsy‘s weekly update covering the main developments in cyberattacks and threat actors worldwide, produced by our Threat Intelligence & Response team.
The team consists of security analysts and researchers with technical and investigative expertise and internationally recognized experience.
Through the continuous monitoring of cyber threats and geopolitical events, it produces and provides organizations with actionable intelligence to anticipate attacks and understand their impact, while relying on a trusted partner in the event of a cyber incident.
Learn more about our Cyber Threat Intelligence solution.