This week’s intelligence highlights an aggressive pivot by threat actors targeting developer environments, cloud ecosystems, and endpoint security boundaries. Adversaries are achieving zero-click execution inside AI-assisted IDEs, hosting entire C2 operations within trusted Microsoft 365 services, and aggressively forcing systems into Safe Mode to blind EDR platforms before detonating ransomware.

SISA Weekly Threat Watch – our weekly feature brings to you a quick snapshot of all the major security vulnerabilities that posed a threat to organizations worldwide. These recurring actionable threat advisories will also provide information and recommendations that will help security teams take appropriate actions to defend against the latest and critical threats.

1. Critical Zero-Days & Infrastructure Vulnerabilities

Core operating systems and enterprise edge devices require immediate patching to prevent unauthenticated remote code execution and kernel-level privilege escalation.

• macOS Screen Sharing Pre-Auth RCE (CVE-2026-65400) — A critical state-management flaw in the macOS Screen Sharing daemon (screensharingd) allows remote, unauthenticated attackers to bypass Secure Remote Password (SRP) authentication. By leveraging helper binaries like SSFileCopySender, attackers completely bypass TCC controls to achieve root-level RCE and deploy persistence payloads.
• Thursday Threat Matrix (Enterprise Edge & EPM) — Multiple high-severity disclosures require immediate remediation:
  • Citrix NetScaler: An authentication bypass (CVE-2026-19490) and SIP ALG memory overflow (CVE-2026-19489) allow unauthenticated remote access.
  • BeyondTrust Endpoint Privilege Management: A local kernel-mode memory corruption (CVE-2026-40144) grants standard users NT AUTHORITY\SYSTEM privileges.
  • Splunk & Red Hat ACM: Critical untrusted deserialization RCE in Splunk apps and high-severity SSRF flaws in Red Hat Multicluster Engine.

2. AI Exploitation & Developer Supply Chain Attacks

Adversaries are specifically targeting developers, leveraging AI assistants and compromised open-source registries to deploy stealthy payloads that execute without user interaction.

• Cursor & Trae IDE Zero-Clicks (CVE-2026-63093) — A critical vulnerability allows arbitrary code execution via untrusted binary path resolution (git.exe, hatch.exe) when opening repositories in AI-assisted IDEs. Because Cursor disables Workspace Trust by default, malicious binaries placed in a cloned repository execute automatically.
• CoSnitch (CVE-2026-24301) & RovoBlast — Single-click Parameter-to-Prompt (P2P) injections force Microsoft Copilot and Atlassian Rovo to execute unauthorized instructions via undocumented URL parameters (e.g., ?autorun=1). This allows attackers to silently exfiltrate connected OAuth data and write malicious instructions to the AI's long-term memory (Context Collapse).
• RedC2 4.0 AI-Powered Linux Implant — Delivered via 14 trojanized npm packages disguised as math utilities, this supply chain attack bypasses --ignore-scripts by executing instantly upon import. It drops the RedShell ELF backdoor, connecting to an LLM-driven "Red Agent" operator layer that translates natural language prompts into autonomous command chains.
• Rust arrayref Supply Chain Attack (RUSTSEC-2026-0260) — A compromised crates.io maintainer account deployed malicious updates to widely used crates (arrayref, internment). Poisoned build.rs dependencies fetch remote payloads to drop persistent C2 services (MonoService) on developer endpoints and CI/CD pipelines.

3. Advanced Cyberespionage & Cloud C2 Implants

State-sponsored and advanced financial threat groups are hiding their communications inside highly trusted cloud services and kernel-mode drivers.

• TWINLOOT Python Implant — Delivered via MS Teams phishing, this highly modular implant runs its entire C2 within Microsoft's cloud (SharePoint Graph API, Teams WebRTC DataChannels). It persists via an offline mandatory profile hive (NTUSER.MAN) and employs a native Windows 11 fake lock screen (PhishLocker) to capture local credentials.
• HoneyMyte Rootkit (Mustang Panda) — This China-nexus APT integrated a signed Windows kernel-mode driver (msagent.sys) into its CoolClient backdoor. The rootkit hooks nsiproxy.sys to hide network traffic and uses DKOM to blind EDR agents, unhook processes, and protect registry keys.
• SilkParasite Campaign — A Central Asian-focused espionage campaign utilizing 7 distinct RATs written across 4 languages. The group utilizes AI-assisted development, cloud C2 channels (Google Drive), and macro-laden RAR archives that specifically check for Kaspersky antivirus before executing DLL sideloading chains.

4. Ransomware, Phishing & Post-Exploitation

Extortion groups are bypassing traditional EDR monitoring using native OS diagnostic modes, while other actors automate data exfiltration from misconfigured portals.

• Akira Ransomware Safe Mode Evasion (MITRE T1688) — After exploiting exposed SonicWall VPNs, threat actors are actively forcing compromised Windows systems into Safe Mode with Networking (using msconfig.exe or bcdedit.exe). Because EDR agents and Windows Defender fail to load in Safe Mode, attackers retain access via AnyDesk and detonate ransomware unhindered.
• SynkLoader Teams Phishing — A multi-language malware suite initiated via Teams IT Helpdesk impersonation phishing. It relies on in-memory execution and drops modules for system profiling, VNC (StreamMaster), network proxying, and credential harvesting.
• RAVEN Elasticsearch Framework — A post-exploitation framework executing automated bulk data exfiltration against Elastic Stack clusters. It establishes credential-independent persistence via API key generation and self-healing Elasticsearch Watchers, circumventing standard password-reset remediation.
• "City-Forum" Scraping Campaign — Threat actors are systematically scraping unauthenticated public APIs in Salesforce Experience Cloud (LWR/Aura) and ServiceNow Service Portals using custom Go-based tooling to exfiltrate massive volumes of guest-accessible enterprise data.

Proactive Steps for the Week

• Secure AI and Developer Environments: Explicitly enable Workspace Trust across all developer workstations for AI IDEs like Cursor (security.workspace.trust.enabled: true) to prevent automatic binary execution. Restrict unvetted build script execution using cargo-vet and purge all identified malicious npm/crates.io dependencies.
• Restrict Safe Mode Transitions: Monitor and restrict write operations to HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network to prevent Akira threat actors from registering persistent tools (e.g., AnyDesk) for execution during Safe Mode. Alert on msconfig.exe or bcdedit.exe execution modifying boot flags.
• Harden Cloud Collaboration & Identity: Restrict external domain federation in MS Teams to block the TWINLOOT and SynkLoader external phishing vectors. Audit OAuth integrations connected to enterprise AI assistants and disable unconstrained web-fetch capabilities to prevent CoSnitch one-click exfiltration.
• Apply Edge & OS Patches: Deploy patches for macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9 immediately, or block TCP port 5900 at the perimeter to stop the Screen Sharing RCE. Immediately upgrade Citrix NetScaler, BeyondTrust EPM, and Splunk applications to their respective patched versions.
• Remediate Post-Exploitation Persistence: When performing incident response on Elastic Stack clusters, do not rely solely on password resets. Actively enumerate and revoke all active API keys and audit Elasticsearch Watchers for self-healing backdoors deployed by RAVEN.
• Restrict Guest API Access: Within Salesforce Experience Builder, disable "Allow guest users to access public APIs" to block the City-Forum GraphQL scraping vector. Ensure ServiceNow scripted search sources enforce gs.isLoggedIn() checks.

Explore our DFIR Solutions to discover how our advanced incident response support, compromise assessments, and threat hunting frameworks can insulate your enterprise infrastructure against these campaigns.