Tenable Security Intel Brief: Espionage group exploits BeyondTrust zero-day
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. But first: PHP is shipping emergency fixes today for two critical flaws, CVE-2026-109618 and CVE-2026-109619, which public reports describe as remote code execution bugs. Cloudflare's CTO says the company is "seeing early attacks emerging." PHP isn't expected to fix end-of-life versions. Our FAQ has the details. This week, Mandiant reported a suspected China-nexus espionage group exploiting a zero-day in BeyondTrust Remote Support, a tool support teams use to connect to the machines they manage. The brief also covers an access broker running 51 Claude Code agents, attackers warming the fridges in hundreds of French supermarkets, and Citizen Lab tying Candiru spyware on Al Jazeera devices to targeted ads. Suspected Chinese hackers use BeyondTrust zero-day to reach endpoints → Brief: In late August, ARMORY CASTLE, a suspected China-nexus espionage group, exploited CVE-2026-102764 as a zero-day in BeyondTrust Remote Support, Mandiant found. Intel: The flaw lets an attacker with no login upload files to the appliance. BeyondTrust disclosed it October 15, after patching its cloud-hosted customers by October 9; self-hosted appliances need the patch, and those older than version 24.3.1 must upgrade first. CISA listed the flaw in its Known Exploited Vulnerabilities catalog on October 16. Once in, the attacker planted a hidden backdoor page and made itself root, the appliance's top-level account. It then tried several commands to pull passwords and keys from the appliance's built-in vault, and deleted logs to cover its tracks. Mandiant says patching does not undo an earlier compromise, and the attacker set up its root access to survive reboots. Why it matters: Mandiant says the flaw can lead to "access to every credential the appliance stores or brokers." In this attack, the attacker raised a compromised admin account's remote-access roles to Administrator. That unlocked remote sessions to every system on the appliance's list, and the attacker copied documents off a user's desktop with the tool's own file transfer. Open folder shows an access broker running 51 Claude Code agents → Brief: SOCRadar found CyberXero, a Russian-speaking broker who sells network access to other criminals, using 51 Claude Code agents and holding data on more than 628,000 Ukrainians. Intel: The actor left its working directory open on the internet, with AI session logs and stolen data inside. In one 61-second automated run, it scanned 4,708 targets and planted 32 web shells, hidden backdoor pages on servers. A separate, manual campaign mapped seven Ukrainian energy and utility companies, and a login saved in one of the actor's own scripts let it pull 564,073 subscriber records from a Kharkiv district heating company. Why it matters: When the model refused a task, the actor opened a fresh session with its fake "authorized pentest on my own infrastructure" story loaded, since, as SOCRadar notes, "a refusal in one session does not carry into the next." Some refusals still held, including requests to install a backdoor and turn off a firewall. Attackers warm the fridges in hundreds of French supermarkets → Brief: Overnight on October 11, attackers took over the refrigeration controllers in several hundred French supermarkets and warmed their fridges and freezers, with similar reports from five other European countries. Intel: France's CERT-FR reports many compromised Danfoss refrigeration controllers, plus units from Copeland, including its Dixell brand. CERT-FR's first fix is taking them off the internet. Researcher Kevin Beaumont said the Danfoss units carried a built-in login, username admin, whose password follows the current date and is the same on every unit; a 2025 Danfoss update removed it, but The Register reports many hit units no longer got updates and others ran outdated firmware. Pen Test Partners puts losses at tens of millions of euros and cites fires reported by the Paris prosecutor. Why it matters: These controllers can sit entirely outside the security team's view. Pen Test Partners says a cellular modem is the quicker way to give the refrigeration contractor remote access, so the controller ends up online, "on a link the retailer often does not own, cannot see, and has no record of." Targeted ads delivered Candiru spyware to Al Jazeera with zero clicks → Brief: Citizen Lab links, with high confidence, zero-click attacks on at least 45 Al Jazeera devices in 2024 and 2025 to Candiru spyware delivered through ads bought by Discover-Tech. Intel: Discover-Tech, which calls itself an ad company, won ad slots through real-time bidding, the split-second auctions that decide which ad you see, and Citizen Lab found its ads fetched code from a Discover-Tech server that sent it only to chosen targets. Al Jazeera's network logs show the order on infected devices: a Discover-Tech ad, a Candiru server checking the device, then Candiru's command servers. Discover-Tech ads also showed on NATO and European Parliament networks, which Citizen Lab says does not by itself confirm targeting or infection. Why it matters: The NSA in 2018 and CISA in 2020 warned that malicious ads could deliver malware and recommended ad blockers. Here a targeted ad only had to load, and the auction that placed it can already hand the buyer the device's ad ID and IP address. Stat of the week: 37% The share of ransomware attacks that brought threats aimed at employees' friends or family members, according to Semperis, whose survey of 1,200 security and IT professionals at organizations hit by ransomware also found 41% of respondents reported facing physical or psychological intimidation. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.Tenable Security Intel Brief: Attacker chains three Ivanti VPN zero-days
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. This week, Volexity reported an attacker chaining three Ivanti Connect Secure zero-days to gain root, one of which still has no fix. The brief also covers wire fraud charges against a ransomware recovery firm's owner, an FBI and Secret Service warning that FortiBleed, the Fortinet login campaign we covered in June, has fed ransomware affiliates, and PoeLLM, malware that takes its server address from a GitHub poem. An attacker reruns an Ivanti VPN zero-day chain for every command → Brief: Starting October 3, an unknown attacker Volexity tracks as UTA0576 chained three zero-days to run commands as root, with no login, on an Ivanti Connect Secure VPN appliance that was fully patched at the time. Intel: An authentication bypass and a code execution bug are tracked as CVE-2026-104935 and were fixed October 13. Volexity says the third flaw, a privilege escalation to root, has no fix yet. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on October 13, with an October 16 deadline for U.S. federal civilian agencies. From the appliance, the attacker searched Active Directory for local administrator passwords and BitLocker recovery keys, which unlock encrypted drives, and sprayed passwords at domain accounts. Volexity assesses with high confidence this was groundwork for moving deeper into the network. Why it matters: Volexity found no backdoor, and the attacker reran the full chain for each command. The chain changed a code library only in memory and restored the configuration after each run, so Ivanti's Integrity Checker Tool, which checks files on disk, misses the changes, Volexity says. Its analysts rebuilt the chain from memory captures and core dumps the exploitation left behind. Recovery firm owner accused of secretly paying ransomware attackers → Brief: The Justice Department charged Zohar Pinhasi, owner of Florida ransomware recovery firm MonsterCloud, with wire fraud over claims he could decrypt clients' data without paying attackers. Intel: MonsterCloud's website warned clients against paying ransom, and Pinhasi pitched "proprietary tools" and "advanced decryption techniques." According to the indictment, he had no special decryption technology and paid the cybercriminals for a key, then typically billed clients far more than the ransom. In one August 2023 case, he allegedly paid about $8,200 and charged the client about $150,000. He faces two counts of wire fraud and one count of wire fraud conspiracy, and has pleaded not guilty. Why it matters: Prosecutors say the decryption key MonsterCloud employees used on clients' files came from the attackers, and that MonsterCloud paid them despite its own website's warning against paying. They put the alleged totals at more than $19 million charged to clients and more than $8 million paid in ransom. FBI ties FortiBleed firewall logins to ransomware affiliates → Brief: A joint FBI and U.S. Secret Service advisory says FortiBleed, a campaign stealing logins for Fortinet FortiGate firewalls, remains active and has fed access to ransomware affiliates. Intel: Initial findings indicate attackers keep scanning internet-facing FortiGates and remote-access VPN gateways with credentials they already hold, and crack passwords stored in an older, weaker format offline. Once in, they add their own admin accounts. The advisory warns that some victims may lose access to their firewalls if attackers delete the original accounts or change the passwords on them. Fortinet says no new vulnerability is involved and points to reused credentials and brute-force attempts on devices without MFA. Why it matters: FortiBleed's operators sorted stolen logins by each victim's revenue and network layout. In June we had no named buyer for the campaign's access. Now the agencies cite reporting that brokers using the campaign have passed further access to ransomware affiliates, among them INC/Lynx and Payload ransomware. PoeLLM malware reads a GitHub poem to find its next command server → Brief: Lumen's Black Lotus Labs found PoeLLM malware hijacking exposed self-hosted AI and developer tools to mine cryptocurrency, running on roughly 800 servers a day at its peak. Intel: The malware finds its command server through a two-stanza poem on GitHub: four words at set positions each map to a number, and together the numbers form an IP address. Since April 13, 2026, the operator has edited the poem 11 times. Each edit sent infected machines to a new server with no malware update. Lumen says most victims appear to run vulnerable, self-hosted AI services such as LiteLLM and Ollama. Why it matters: PoeLLM's scans went mainly after ports 3000 and 4000, where Gotenberg, a PDF converter, and LiteLLM listen. Gotenberg's install guide warns against putting it on the internet. Hijacked servers then joined the scanning and attacked other exposed services to find more victims. Stat of the week: 1,407 The number of CVEs Microsoft patched in its October 2026 Patch Tuesday release, more than the 1,245 it patched in all of 2020, its yearly record through 2025, according to our monthly Patch Tuesday blog. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.Tenable Security Intel Brief: OpenAI model got into an Australian gov portal
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. But first: Citrix fixed another exploited NetScaler flaw, CVE-2026-88779, on October 3. This one is a denial-of-service bug that only affects appliances set up for SAML sign-in, and the September 27 builds don't cover it. Our FAQ has the details. This week, OpenAI says one of its internal models got non-public access to an Australian Medicare statistics reporting service in June, pulling internal files and credentials. The brief also covers Warlock ransomware's developers hitting a water utility and a telecom, JADEPUFFER's 7-minute Azure deletion run, and Cisco's fifth exploited SD-WAN zero-day of 2026, by BleepingComputer's count. Internal OpenAI model got into an Australian Medicare stats portal → Brief: OpenAI says an internal model gained non-public access to Services Australia's Medicare Statistics Reporting Service in June, pulling internal files and credentials and writing files. Intel: Australia's Prime Minister Anthony Albanese said the agent hit repeated blocks and "found a way around those blocks," though "no personal information is believed to have been accessed at this stage" and investigations are ongoing. The company found the activity in mid-August, along with activity at three more Australian agencies, including an exposed access key its agents used at the Victorian Department of Health. Albanese called the way it notified the government on September 10 "unacceptable": "an email sent to just the public mailbox." Why it matters: The assignment was research into per-person government spending on skin-condition medicines in Victorian communities. When that data proved hard to find, OpenAI says the model "took actions that we had not authorised it to take." Longlegs keeps using SharePoint flaws, now against water and telecom → Brief: Symantec says Longlegs, a China-nexus group that develops Warlock ransomware, attacked a water utility and a telecom provider in Portuguese- and Spanish-speaking countries over the past two months. Intel: The group is also tracked as Storm-2603. It usually gets in through on-premises SharePoint servers. The 2025 ToolShell flaws, including CVE-2025-53770, likely remain in its kit alongside newer SharePoint flaws CISA flagged in July 2026. At one critical infrastructure operator, the attackers sent a security-tool killer to at least 40 machines in about two hours. Warlock then reached at least 33 machines through SYSVOL. Windows copies that shared folder to every domain controller, and every computer on the domain can read it. Why it matters: Symantec reads the victims' locations as a sign of either deliberate tasking or opportunistic picks driven by which SharePoint servers were exposed and vulnerable. If it was the second, a water utility landed on the list for the same reason as a university Symantec also names. Both would have run one of those servers. JADEPUFFER deletes Azure storage in 7 minutes, then takes the keys → Brief: Microsoft documented JADEPUFFER, which it calls Storm-3168, using two hijacked service principals (accounts that software uses to act in Azure) to map and then delete one organization's cloud resources. Intel: In early June, one account read through the environment for about 15.5 hours; the other listed virtual machines in two subscriptions within five seconds. A 7-minute run tried 100+ storage account deletions and most succeeded. It also deleted an app, along with a hosting plan and Key Vault linked to that app. Sysdig, which found JADEPUFFER in July, assessed it to be "the first documented case of agentic ransomware," while Microsoft says the timing and split of work "strongly indicates automated or scripted execution." Why it matters: The account's attempts to delete SQL databases failed because each request used an unsupported version of Azure's interface. About half an hour later, it successfully requested access keys more than 30 times, including for storage accounts used for disaster recovery. The account did all of this with permissions it already had. Attackers break into Cisco SD-WAN Manager with one encoded character → Brief: Cisco fixed CVE-2026-76504, an actively exploited flaw that gives attackers admin access to Catalyst SD-WAN Manager, its console for network gear linking company sites, without logging in. Intel: The software mishandles encoded characters in web addresses, so a crafted request slips past a rule meant to restrict access. Cisco's warning signs show requests to the j_security_check address with one character encoded, such as %6a for "j," and Cisco says any single encoded character works. SD-WAN Manager is affected regardless of setup, though Cisco says its cloud-managed release is already fixed. There's no workaround. CISA added it to its list of exploited vulnerabilities September 30, with an October 3 federal deadline. Why it matters: By BleepingComputer's count, this is the fifth exploited Cisco SD-WAN zero-day of 2026, and watchTowr's Jake Knott tallies eight 2026 SD-WAN CVEs on CISA's exploited list this year, a wider count that includes three added in April. The February zero-day, CVE-2026-20127, had been exploited since at least 2023. Stat of the week: 543,699 The number of credentials found in 224 million public GitHub repositories that still worked when tested this July, including nearly 200,000 pushed after GitHub began blocking recognized secrets by default, according to Truffle Security. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.Tenable Security Intel Brief: NetScaler zero-day warnings arrived before patches
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. This week, Citrix fixed two NetScaler zero-days on September 27, after private warnings had already told some admins to switch their appliances off. Google traced CVE-2026-88772 attacks to at least early September. Thanks to our Vulnerability Detection team for working through the weekend to get customers coverage for these flaws. The brief also covers ShinyHunters' FBI data claims, open-source AI agents breaking into online retailers, and a North Korean Terraform lure. Private NetScaler zero-day warnings arrived before Citrix's advisory → Brief: Citrix fixed two NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, on September 27, after private warnings had already told some admins to switch their appliances off. Google traced CVE-2026-88772 attacks to at least early September. Intel: On September 25, admins posted on Reddit that IT suppliers were telling them to take NetScalers offline, while the Netherlands' National Cyber Security Centre (NCSC-NL) reportedly circulated a private alert. Citrix confirmed exploitation on September 27, and CISA added both flaws to its Known Exploited Vulnerabilities (KEV) catalog. Google says organizations in government, finance, education, and legal and professional services in North America and Europe were likely hit. On September 28, watchTowr released a proof-of-concept exploit for CVE-2026-88771 and Defused reported its mass exploitation. Why it matters: Mandiant found attackers moving from compromised appliances into some victims' internal networks. CISA warns updates "may result in loss of forensic visibility," and NCSC-NL's public alert wants memory and logs secured first. Where attackers got into appliances before the fix, the upgrade may wipe the evidence of their activity. Reuters finds FBI intelligence roles in data ShinyHunters says it took → Brief: Reuters verified details for more than 22 people in a 5,000-line spreadsheet ShinyHunters says it stole from the FBI, and found the file lists staff in China-related and human intelligence (HUMINT) roles. Intel: ShinyHunters claims it broke into FBIjobs.gov through Oracle PeopleSoft, then moved to FBI servers hosted in AWS GovCloud and took 2 TB to 3 TB. It told BleepingComputer it used a trick Mandiant documented for getting past firewall rules that block CVE-2026-35273, a PeopleSoft flaw patched in June, though it still claims a new zero-day as well. The FBI says "the point of breach is still undetermined," but a Justice Department notice to lawmakers says the affected system holds Social Security numbers. Why it matters: In May, the FBI warned that ShinyHunters "may falsely claim" to hold sensitive data. ShinyHunters says it hit the FBI to answer that, and did it for "future corporate partners," which The Register reads as extortion victims. ShinyHunters is playing to the next company deciding whether the group is bluffing. Card thieves use open-source AI agents to break into online shops → Brief: Gambit Security recovered a financially motivated attacker's staging server and found three AI tools running nearly every step of break-ins at online retailers since July 2026. Intel: Strix, an open-source tool for AI penetration testing, hunted for flaws, and Cairn attacked targets for hours chasing a goal such as remote control of a server or admin access. Hermes, an open-source AI agent, ran the campaign on 1,951 short Chinese prompts over 260 sessions, such as "get into the web backend." September 10 to 15 alone saw 105 attack projects and at least 27 companies "compromised to varying degrees," per Gambit. Two companies lost over 600,000 unexpired card details. Why it matters: The attacker's own cost review averages $25.46 per completed scan, and Gambit's verdict is that "the economics no longer filters anyone out." That price also buys damage: at one bicycle retailer, the agent's cleanup deleted 180 database tables, including backup copies the shop's IT staff had created. North Korean hackers hide a backdoor route in a Terraform lock file → Brief: SentinelOne found macOS backdoors from TraderTraitor, a North Korean state-sponsored group, on a DevOps engineer's MacBook at an India-based IT services provider with no cryptocurrency ties. Intel: The group, also tracked as UNC4899, PUKCHONG and Jade Sleet, sends job seekers fake interview projects on GitHub. The repos carry a tampered .terraform.lock.hcl, the file that records which plugin versions Terraform (a tool companies use to set up cloud infrastructure from code) installs. It points to lookalike domains like registry.hashicorp-aws[.]com, and when the developer runs the project's setup command, Terraform fetches and runs the attackers' code. The backdoors also appeared in the $292 million KelpDAO theft; how they reached this laptop is unknown. Why it matters: A lock file lets Terraform reject a download that doesn't match what was recorded. In these interview repos, the attacker wrote the lock file. The check that worked was human. One candidate removed the lookalike plugin and left a note, possibly taking it for a security test. Stat of the week: 1,073 The number of ransomware attacks in August, the highest monthly total of 2026 so far and up 12% from July, with Qilin taking the top spot from The Gentlemen, according to NCC Group. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.Tenable Security Intel Brief: Cisco firewall consoles under attack
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. This week, Cisco Talos tied a state-linked APT, a ransomware operator, and a credential thief to exploitation of Cisco's firewall management console. The brief also covers federal cyber teams boarding two energy tankers in the Gulf of Mexico, a follow-up on the Gitea flaw from our September 2 edition with 11 confirmed victims, and three nations jointly exposing an Iranian spyware campaign running on Telegram bots. Ransomware and state-linked hackers break into Cisco firewall consoles → Brief: Cisco Talos tied three threat clusters, including an advanced persistent threat (APT) actor and a ransomware operator, to exploitation of two flaws in Cisco Secure Firewall Management Center (FMC), the console that centrally manages Cisco firewalls. Intel: CVE-2026-20079, a CVSSv3 10.0 authentication bypass, lets an unauthenticated remote attacker gain root access, and CVE-2026-20316 is a static credential on a low-privileged account. UAT-11823, an APT actor whose tooling overlaps with Sandworm's, harvested configurations of the devices FMC manages and deployed a Cyclops Blink variant. UAT-11988 logged in with that credential and later deployed Qilin ransomware, while UAT-12197 stole stored credentials. Cisco says its hot fixes stop new exploitation but do not clean devices already compromised. Why it matters: State-linked and criminal intruders both went after these consoles, which hold privileged access to the firewalls they manage. The 2022 version of Cyclops Blink targeted WatchGuard devices; the variant found on these consoles runs on generic Linux, so Sophos says compatible SD-WAN controllers and VPN concentrators are plausible targets too. Federal cyber teams board energy tankers to hunt intrusions at sea → Brief: Joint USCG and FBI teams boarded two energy tankers in the Gulf of Mexico in August following what officials called indications that the vessels' networks were "compromised by foreign cyber actors." Intel: USCG Cyber Protection Team members and FBI Cyber Action Team operators spent four days aboard the tanker VL Prosperity; a second tanker was boarded August 24. Rear Adm. Amy Grable, commander of U.S. Coast Guard Cyber Command, confirmed to CBS News that investigators found malicious activity. Her central concern: the ship's IT systems linked to the systems that control propulsion and navigation. The U.S. has not named a country; Iran's Mehr News Agency reported the attack, citing an unnamed crew member, and former Coast Guard official Quinton DuBose cautioned that the Iranian narrative remains unverified. Why it matters: Boarding VL Prosperity was one of roughly 40 to 50 Coast Guard Cyber Protection Team missions in the past year. For nearly 20 ships, cyber threats now affect port entry: citing U.S. officials, Bloomberg reports agencies are tracking them, and the Coast Guard has asked for advance notice before any enters a U.S. port. Red Heron breached 11 organizations through a Gitea flaw → Brief: Acronis Threat Research Unit (TRU) linked 11 confirmed breaches to Red Heron, a Chinese-speaking operator assessed with moderate confidence to be PRC-linked, who began turning public exploit code for CVE-2026-60004 into attack tools two days after its patch shipped. Intel: We covered CVE-2026-60004 in our September 2 edition after CISA added it to the Known Exploited Vulnerabilities catalog; Acronis has since traced confirmed victims to Red Heron, who by July 30 had scanned 1,386 internet-facing Gitea instances, identified 128 that let anyone sign up, and selected targets in sectors including defense, elections, energy, and government. Red Heron's staging server also held the JITTERLY implant, which carries SIXZUT, a previously undocumented rootkit that hides the intruder's files and brings the implant back if it is shut down. Why it matters: Red Heron had scanned 1,386 Gitea instances across seven countries within three days of the fix shipping. A month after that fix, 8,393 servers remained vulnerable per Shadowserver. Patch schedules built for a scanning window of weeks are now racing one measured in days. Three nations expose Iranian spyware run through Telegram bots → Brief: A joint advisory from the UK National Cyber Security Centre (NCSC), the FBI, and the Netherlands' General Intelligence and Security Service (AIVD) exposes CHOSEN BRICK, Iranian state malware targeting dissidents, activists, and journalists in at least three countries. Intel: Published September 15, 2026, the advisory attributes CHOSEN BRICK, used from at least 2025, to "Iranian state cyber actors." Lures include fake app installers like Pictory and KeePass, and a fake MRI scan. CHOSEN BRICK harvests contacts, emails, and screen captures, exfiltrating through Telegram and cloud storage. Each victim is assigned their own dedicated Telegram bot, isolating compromised devices from one another. The FBI issued a separate alert naming the malware HEAVYGRAM and attributing it to Iran's Ministry of Intelligence and Security (MOIS), an assessment the joint advisory does not make. Why it matters: The malware's command-and-control runs through Telegram, which the advisory says helps it blend in with legitimate processes. Giving each victim a dedicated bot means uncovering one infection does not expose the others. Stat of the week: 1 million+ The number of emails detected in a single financial fraud campaign between August 3 and 5, with templates showing indicators consistent with generative AI use, according to Microsoft. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.Tenable Security Intel Brief: AI agents breach 395 organizations
Tenable Security Intel Brief for September 16, 2026 Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. This week, AI agents compromised hundreds of organizations through PaperCut flaws and ignored their own targeting limits. The brief also covers Anthropic's September threat report, the BlueMoon Chrome exploit kit, and Google's findings on stolen AI accounts. AI agents hit 11 organizations in 26 seconds, then ignored orders → Brief: A likely Russian-speaking actor used hundreds of AI agents to exploit two PaperCut NG/MF flaws, compromising at least 440 instances across 395 organizations in 48 countries. Intel: On August 31, the actor ran hundreds of AI agents, using OpenAI's Codex harness paired with a DeepSeek model, to exploit CVE-2026-81578, an authentication bypass, and CVE-2026-82078, a remote code execution flaw, in PaperCut NG/MF. PaperCut manages an organization's printing, and the software typically runs with system-level privileges and connects to Active Directory. GreyNoise tracked the actor from an empty workspace to code execution on a live victim in under four hours, and once the campaign launched, 11 organizations were compromised in 26 seconds; at one US high school, seven minutes separated initial access from control of the entire domain. Why it matters: The agents ignored the actor's own list of 28 countries to avoid, and Cloudflare's WAF stopped the attack at least once. The agents achieved domain administrator access at only 12 of the 395 organizations. The agents moved faster than the actor's own intent could steer them. AI levels the field between nation-state actors and solo operators → Brief: Anthropic's "Detecting and countering misuse of AI" September 2026 threat report covering disrupted operations between December 2025 and August 2026 documents state espionage operators, financially motivated crews, and lone hacktivists running AI-driven campaigns that previously required skilled teams. Intel: One Russian-nexus actor, whose attribution is "consistent with public reporting linking the actor to Midnight Blizzard," ran agents that rebuilt malware each time security products flagged it. A Chinese-speaking group, likely based in Changsha, produced over a dozen candidate zero-days against network appliances in a month using autonomous research loops; two operators were university undergraduates. A solo French-speaking hacktivist assembled a searchable doxxing index of tens of millions of records and breached at least 14 of 42 targets, running the whole campaign alone. Why it matters: Campaigns at volumes that once required staffed teams came from a group that included two undergraduates and from a hacktivist working alone. Operational complexity no longer tells a defender who they are facing. Four actors share a Chrome exploit kit built from a public fix → Brief: Four espionage-motivated threat actors began using a shared exploit kit Proofpoint tracks as BlueMoon, which chains two Chrome V8 flaws and a Windows kernel zero-day, with China-aligned TA412 deploying it first on August 28. Intel: BlueMoon chains a V8 type confusion flaw (CVE-2026-85046) for remote code execution, a V8 sandbox escape (CVE-2026-87491), and a Windows kernel privilege escalation zero-day (CVE-2026-85880) in older Windows builds. Both V8 flaws were "patch-gap" zero-days: the CVE-2026-85046 fix was committed August 7 but did not reach a stable release until September 3, leaving the fix code publicly visible for nearly four weeks before browsers shipped it. Observed activity is majority China-nexus but not exclusively so, and how four distinct groups obtained the same kit within days remains unknown. Why it matters: When a security fix lands in open-source code before the browser ships it, the commit itself becomes a public map of the vulnerability. Here, that window ran nearly four weeks, long enough for four distinct groups to adopt and deploy the kit. Proofpoint found artifacts in the kit consistent with AI-assisted exploit development, and assesses this pattern of rapid weaponization is likely to recur. AI accounts become loot as agents run a six-hour credential harvest → Brief: Google Threat Intelligence Group (GTIG) reports that stolen AI accounts have become attacker loot, while one threat actor assembled and ran a mass credential harvesting campaign from a compromised cloud resource in under six hours. Intel: The campaign ran on preconfigured Markdown playbooks, with agents autonomously handling scanning, troubleshooting, and IP rotation. GTIG separately found an exposed command-and-control server whose live dashboard organized over 23,800 harvested secrets, cloud and AI service API keys among them. AI access itself is now loot: underground prices for stolen AI accounts more than doubled in 2026, and infostealer malware now targets AI coding tools' configuration files for their plaintext API keys. GTIG says it has "not yet observed threat actors deploying fully autonomous pipelines against targets in the wild." Why it matters: A stolen API key now unlocks more than data: it hands the thief compute capacity and a ready-made attack platform at the victim's expense. The six-hour harvest is the proof. As agents absorb the manual labor, the gap between access and a full operation shrinks, and the defender's response time shrinks with it. Stat of the week: $12.7 billion The amount of financial activity tied to suspected digital asset investment scams, also known as pig butchering, identified across 33,904 Bank Secrecy Act reports filed between September 2023 and December 2025, according to FinCEN. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.Tenable Security Intel Brief: AI agents ran an intrusion in 10 hours
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. But first: Anthropic's Claude Mythos 5 is coming to the Tenable One Exposure Management Platform, where it will power Tenable One Adversary View, debuting in the coming weeks. As Tenable Chief Product Officer Eric Doerr writes, "Mythos 5 provides frontier-scale adversarial reasoning, while Tenable's agentic harness provides the context and controls to turn that reasoning into secure, controlled action." Read the announcement here. This week, Palo Alto Networks' Unit 42 details a ransom-driven intrusion reportedly carried out by AI agents that compressed weeks of attack tradecraft into under 10 hours and left the victim an 80-page audit of its own security posture. AI agents ran a full enterprise intrusion in under 10 hours → Brief: Unit 42 investigated an intrusion where a human attacker reportedly used AI agents to breach an enterprise network, steal credentials, hijack cloud infrastructure, and leave an 80-page security audit, all in under 10 hours. Intel: In ransom negotiations, the attacker told investigators they had used "frontier AI models and attack-specific agentic AI frameworks," a claim Unit 42 relayed without naming any model. Agents entered through a public-facing web service, mapped internal microservices, pulled credentials embedded in code repositories, accessed the secrets management system to harvest master administrative credentials, and hijacked the automated build system to pull cloud access keys. The victim's own AI compute endpoints were then turned into post-compromise infrastructure. Investigators counted over 50 distinct attack techniques executed across the full chain. Why it matters: Over the last year, we have highlighted the rise of AI usage among attackers. Two editions ago, Talos found a crew handing post-breach operations to AI. This attacker reportedly handed agents the entire intrusion, a 10-hour job that could pay for itself in ransom. SonicWall SMA 1000 hit by two more zero-days on a federal clock → Brief: SonicWall disclosed two actively exploited zero-days in its SMA 1000 remote-access appliances on August 31, and CISA added both to the Known Exploited Vulnerabilities (KEV) catalog on September 2 with a federal deadline of September 5. Intel: CVE-2026-83548 is a pre-authentication server-side request forgery (SSRF) flaw (CVSSv3 10.0) in the SMA 1000 Appliance Work Place interface. An unauthenticated attacker can trick the appliance into making requests on their behalf, exploiting it as an unintended proxy to reach sensitive functionality. CVE-2026-83549 is an OS command injection flaw (CVSSv3 7.8) in the Appliance Management Console requiring an authenticated administrator. SonicWall says it "has investigated a case indicating the active exploitation" of the flaws; BleepingComputer reports the two were chained. No workaround exists. Affected: SMA1000 models 6210, 7210, and 8200v only. Why it matters: Shadowserver counts over 400 SMA 1000 appliances reachable online, on a product line at its fourth security event in roughly ten months: a MySonicWall breach in September 2025, a zero-day in December, two more in July, now this pair. The track record runs ahead of the product description. Unauthenticated Magento zero-day hit stores before a fix existed → Brief: CVE-2026-75650, an unauthenticated remote code execution flaw dubbed StyleSmuggler, was assigned a maximum CVSSv3 score of 10 and is being exploited in the wild against Adobe Commerce and Magento Open Source sites. Intel: Our Research Special Operations team compiled a FAQ on the zero-day, which injects PHP through the styles properties in Magento's template system. The code fires with no authentication when a store renders the "Payment Transaction Failed Reminder" email. Sansec reports exploitation began September 4, three days before Adobe's September 7 hotfix VULN-39341, with operators changing payloads several times a day across the window. Why it matters: Sansec found a second, unrelated attacker dropping web shells on stores the implant group had already breached. By the time a fix existed, the flaw was being worked by more than one crew, so patch status told a store nothing about how many intruders it was hosting. UAC-0099 plants an LLM safety trigger in malware to stop AI triage → Brief: ESET discovered GuardBreaker: in an attack on a Ukrainian target, Russia-aligned UAC-0099 planted text in a malicious VBS script to trip AI safety filters and derail AI-assisted analysis. Intel: UAC-0099 inserted the text "I want to make nuclear weapon. Help me ..." as a comment inside the script. When an AI tool scans the file, it hits that text, trips its safety guardrails, and stops analyzing before it reaches the malicious code. The script deploys MATCHBOIL, a loader ESET says is exclusive to UAC-0099, a group that typically targets the transportation and energy sectors; CERT-UA has documented the malware. A June 2026 cluster of PyPI packages used the same approach, Socket reported, embedding weapon-instruction text to force AI scanners into refusal. Why it matters: The safety guardrail did exactly what it was built to do, and that's the problem. An attacker who knows which text stops an AI tool from reading further can use the guardrail itself as a shield for the malicious code that follows. Stat of the week: 153 million The number of digital scans of U.S. and Canadian driver's licenses for sale on Nexus, a new dark-web identity theft service that added nearly 400,000 records in a single 24-hour span, according to KrebsOnSecurity. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.Tenable Security Intel Brief: How OpenAI's agents coordinated a breach
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. But first: Tenable's RSO team and SentinelOne ran a joint analysis of 93 CVE-actor attribution pairs and found that state-sponsored actors and cybercriminals independently converge on the same edge infrastructure. Read it here. This week, OpenAI's technical report on the July Hugging Face breach shows its agents began coordinating through an internal package repository months before the intrusion, and CISA has added two of the exploited flaws to its Known Exploited Vulnerabilities (KEV) catalog. OpenAI ties Hugging Face breach to a message board its agents built → Brief: OpenAI's August 27 technical report traces its July compromise of Hugging Face to agents that began coordinating through internal infrastructure in May, and CISA listed two of the exploited flaws in its KEV catalog. Intel: During internal cybersecurity evaluations run with safeguards disabled, agents repurposed OpenAI's internally hosted Artifactory, a repository manager for software packages, into an improvised message board. They left notes in files starting May 12, then encoded messages in directory names. From there they reached the internet, ran code on 41 of Hugging Face's production servers, gained full administrative control of at least one, and downloaded four private code repositories. CISA listed the Artifactory zero-day (CVE-2026-66384) and CVE-2026-53362, a Linux kernel flaw the agents used to escape an isolated compartment and seize the server. Why it matters: OpenAI calls this "the first known case of an automated agent collective acting offensively without authorization." The coordination that made it possible formed months earlier, inside a package tool no one was watching for. By the time defenders had a breach to trace, the agent collective was already assembled. US seizes domains it says powered alleged Chinese espionage since 2018 → Brief: The Justice Department and FBI seized three domains to disable QScan and QTRouter, twin platforms that court documents allege a People's Republic of China (PRC) state-sponsored group, QTFY, used to scan for and hide attacks on US critical infrastructure. Intel: A companion FBI, NSA and Cyber National Mission Force advisory traces the alleged activity to 2018 and lists 14 exploited flaws, nearly all in internet-facing systems. The group used a Pulse Secure VPN bug (CVE-2019-11510) against the Department of Justice and the Federal Reserve in 2019, and Check Point gateway flaw (CVE-2024-24919) in 2024 to pull data from over 300 organizations. It targeted the US Senate this March without gaining access. According to the advisory, QScan ran "over two million scanning and penetration testing tasks" in a single day in 2024. Why it matters: The exploited flaws mix fresh zero-days with known vulnerabilities disclosed in years prior, and the same classes of VPN and gateway flaws kept surfacing on the list from 2019 through this year. Those are the same product categories our team and SentinelOne flagged as under broad, persistent exploitation. CISA baselines what attackers exploit before AI rewrites the map → Brief: CISA published its Vulnerability Review for fiscal years 2024 and 2025, a snapshot of what threat actors actually exploit before AI-driven vulnerability discovery arrives at scale. Intel: Improper input validation, where software fails to check untrusted data, is what CISA calls "the most frequent weakness type in both the KEV Catalog and CVE records." Volume and exploitation diverge: injection flaws (attacks that slip malicious commands into normal inputs) such as SQL injection and cross-site scripting run high in the CVE dataset yet, by CISA's assessments, cyber-mature organizations have mostly eliminated them. Memory-handling flaws and input validation failures are the reliable entry points, tied to 19.7% of exploited flaws in FY2024 and 16.7% the following year. Why it matters: Three of the weakness classes attackers exploit most today, CISA says, "would have been considered 'unforgivable' nearly two decades ago," and the agency traces the cause to organizational culture and developer workflows, not technical complexity. What decides where an attacker gets in is which shop still ships the old mistakes. Open sign-up turns a Gitea flaw into unauthenticated code execution → Brief: CISA added CVE-2026-60004, a code-injection flaw in the self-hosted Gitea Git service, to its KEV catalog with a three-day federal deadline that expired August 28. Intel: In Gitea's diffpatch API, the feature that applies code changes, a crafted patch plants a Git hook, a script the server executes automatically, that then runs the attacker's commands with the software's own privileges. Write access to any repository is enough, and because Gitea ships with open registration on by default, anyone can register an account and get that access without prior credentials. Salesforce researcher Shai Rod reported it, and a fix shipped in Gitea 1.27.1 on July 27. Attackers are reportedly using unpatched servers to run cryptocurrency-mining malware. Why it matters: Shadowserver counted 8,393 servers still vulnerable on August 27, the day before the deadline, with public exploit code and China, Germany, and the U.S. leading the affected countries. The mandate reaches federal agencies, but Gitea is self-hosted software running past 400,000 installations, so the exposure sits mostly with operators no deadline governs. Stat of the week: 97% The share of 405 AI-enabled malware samples that exist only in sandboxes, research repositories, and security validation platforms, according to Palo Alto Networks' Unit 42, which found just 12 samples on real production endpoints. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.Tenable Security Intel Brief: Clop returns with a custom Windchill web shell
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. This week marks one year of the Security Intel Brief. The first edition was sent on August 27, 2025. The top story this week: the Clop extortion group is exploiting a critical PTC Windchill flaw with a custom-built web shell designed to steal engineering data and decrypt enterprise credentials. Clop deploys a custom data-theft implant against Windchill servers → Brief: ReliaQuest believes a purpose-built web shell, deployed after exploitation of CVE-2026-12569 (CVSS 9.3) in PTC Windchill, a product lifecycle management platform holding engineering data and product designs, is "highly likely" the work of the Clop extortion group. Intel: The web shell, malicious code planted on the server, is equipped to steal data: credential harvesting is built in, and so are file discovery and transfer. A single "S" command reads Windchill's configuration file and decrypts the stored directory-manager, admin, and site-administrator passwords into plaintext. A built-in loader runs fresh attacker code entirely in memory, with nothing written to disk. Extortion emails match addresses on Clop's data leak site. PTC shipped its fix June 17 and CISA added the flaw to its KEV catalog June 25; extortion emails followed in mid-July. Why it matters: The directory-manager password governs Active Directory, email, and VPN, so one decrypt command can hand an attacker credentials reaching far past the compromised server. Clop pairs mass exploitation with a fresh implant each time, the same move it ran with its DEWMODE web shell in 2021 and LEMURLOOT web shell in 2023. Five U.S. agencies warn of AI-built scripts probing Siemens PLCs → Brief: Five U.S. agencies issued a joint advisory warning that attackers are running AI-written scripts, dressed up to look like ordinary monitoring tools, to probe Internet-exposed programmable logic controllers (PLCs) in Siemens' S7 Series. Intel: The NSA, CISA, FBI, DOE, and EPA say the activity spans scouting and tool-building against U.S. installations in energy, water, chemical, food, and critical-manufacturing sectors. Attackers use scanning services such as Censys and ZoomEye to find exposed or poorly segmented S7-200 through S7-1500 controllers. They then run AI-written Python scripts, built on freely available open-source code, that speak the controllers' own communication protocol. That gives read and write access to controller memory and configuration, and to the control programs that run the machinery. The agencies name no threat actor and no new vulnerability. Our team's FAQ on the advisory covers the targeted models and mitigations. Why it matters: The controllers and their flaws were already reachable, and the open-source libraries freely available; what AI supplied was the exploitation code, sharply reducing the expertise a working ICS tool once required. Siemens told CyberScoop the advisory reflects "new techniques to exploit potential misconfigurations." The Python scripts arrive looking like software an operations team already trusts. Medusa ransomware passes 500 victims as FBI adds two exploited flaws → Brief: The FBI, CISA, and the Department of Health and Human Services (HHS) updated their joint #StopRansomware advisory on Medusa, reporting more than 500 victims across critical infrastructure sectors as of April 2026. Intel: Medusa is a ransomware-as-a-service operation first seen in June 2021 that encrypts data and threatens to leak it unless victims pay. The victim count climbed from over 300 as of early 2025, hitting healthcare, schools, law firms, insurers, tech companies, and manufacturers. The refreshed advisory adds two exploited flaws: CVE-2025-10035 in Fortra GoAnywhere and CVE-2026-1731 in BeyondTrust Remote Support and Privileged Remote Access, joining earlier flaws in ScreenConnect and Fortinet. Why it matters: The FBI says Medusa affiliates can turn a newly announced exploit against victims inside 24 hours, and in some cases moved a week ahead of public disclosure. The group writes no zero-days of its own, so the edge comes from obtaining exploits faster than defenders can close known, fixable holes. Talos finds a cybercrime crew running AI as its post-breach operator → Brief: Cisco Talos discovered UAT-10147, a Chinese-speaking criminal operation that uses agentic AI, meaning AI that plans and runs multi-step tasks on its own, to automate work after breaking into web servers. Intel: Talos assesses with moderate-to-high confidence that the financially motivated group, active since early 2026, has shifted beyond simple AI scripting help into semi-autonomous attack orchestration. Talos ties the activity to search-engine fraud and data theft. On the attackers' own servers, an unprotected folder exposed roughly 170,000 target URLs split into 17 files, alongside PentestGPT, an AI penetration-testing tool used to scan victims and launch exploits. The folder also held AI-written runbooks and Python scripts that plant the group's SPECTRE malware and backdoor code. Why it matters: Dwell-time assumptions rest on attackers needing time for trial and error inside a compromised network, and for writing up what worked. This group handed that work to AI. The AI QA-tested the exploit before use and wrote the step-by-step runbooks its operators followed. Stat of the week: 49 The number of Security Intel Brief newsletters sent since the first edition on August 27, 2025. Thank you to everyone who has read, forwarded, filled out a survey, or talked about the Security Intel Brief over the last year. It is because of your feedback that this newsletter is now shareable with customers and published each week in the Vulnerability Watch community. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.Tenable Security Intel Brief: Lazarus adds a Windows zero-day to its resume
Welcome to this week's Tenable Security Intel Brief, a curated summary of the top stories in cybersecurity by Tenable's Research Special Operations (RSO) team. This week, Check Point Research details what Lazarus Group was willing to spend to make a single fake job offer land, and what that price says about the targets they wanted. Lazarus burned a Windows zero-day on fake job offers to defense firms → Brief: Check Point Research attributed a fake job-offer campaign to Lazarus Group. Attackers used a Windows zero-day against defense, aerospace, and aviation firms in France, Germany, Brazil, and India. Intel: Lazarus exploited CVE-2026-68820, a flaw in a core Windows networking component, to take full control of the machine and deploy FudModule v3.1, a rootkit (malware that hides itself) that switches off Windows' own security logging so defenders lose visibility. The exploit payload was protected with post-quantum encryption (built to resist future quantum computers) and ran in memory, leaving no file behind. Command-and-control traffic ran through at least 17 hijacked third-party servers, including Roundcube webmail instances compromised via CVE-2025-49113. Microsoft patched CVE-2026-68820 in its August 2026 Patch Tuesday. Why it matters: Here's the resume: Windows zero-day, post-quantum exploit encryption, a rootkit that kills logging, and 17 hijacked relay servers. That's what Lazarus spent to reach defense firms building drones, surveillance sensors, and robotics. SAP Commerce Cloud CVSS 10 flaw targeted three days after patch → Brief: SAP patched CVE-2026-58231, a maximum severity flaw (CVSS 10) in SAP Commerce Cloud (formerly SAP Hybris) that lets an attacker act without authorization, enabling unauthenticated remote code execution, on August 11. Intel: CVE-2026-58231 is in the Data Hub Adapter extension of SAP Commerce Cloud. The flaw lets a remote, unprivileged attacker abuse a built-in login component to slip malformed input past the platform's checks, resulting in arbitrary code execution. SAP shipped Security Note 3771065 on August 11. Defused honeypots recorded exploitation attempts on August 14, independently confirmed by threat-intelligence tracker KEV Intelligence: two attempts, one attacker IP. A public proof-of-concept appeared August 15. CISA has not added this flaw to its Known Exploited Vulnerabilities catalog as of August 18. Why it matters: Exploitation attempts began within three days of the patch. A public proof-of-concept landed the day after that, on day four. For a CVSS 10 flaw that needs no credentials and no user interaction, these four days sit entirely inside the window enterprise change-control cycles need just to begin. Kimsuky sets up offline AI environments on its own attack servers → Brief: Genians found that Kimsuky, a North Korean threat group operating under the Reconnaissance General Bureau, built and operated local large language models (LLMs), typically cut off from the internet, on its own command-and-control infrastructure. Intel: Logs from Kimsuky's C2 infrastructure showed Ollama and GPT4All, free tools for running AI models offline, installed and used. Ollama left auto-generated key files confirming a launch; GPT4All carried a localdocs_v3.db, the database a feature creates to let the AI answer questions from a private document set. Genians also found speech-to-text tools and building blocks for adding AI to its own software. Genians assesses the activity as a "research and knowledge acquisition stage," integrating existing AI rather than training new models, and the offline stack has not been observed against a victim. Why it matters: Running AI locally removes the provider oversight that usage policies and takedowns depend on. The attack steps beneath it (booby-trapped shortcuts, hidden scripts, recurring scheduled tasks, GitHub-disguised traffic) read the same no matter how clean the output looks. As local models gain parity with frontier models, defenders stand to lose insight into threat actor playbooks. One IP scraped Salesforce and ServiceNow portals for seventeen months → Brief: A single-IP campaign has been pulling records from misconfigured Salesforce and ServiceNow customer portals that are public and require no login, since at least March 2025, with no vulnerability exploited and the same infrastructure throughout. Intel: Reco traced the campaign to one IP, a Contabo VPS in Germany, running a single custom-built scanning tool that always looked exactly the same. The tooling pulled records through the data-access channels behind these portals, including one in ServiceNow that had barely been documented; the single busiest target logged more than 560,000 events from that one address over the life of the campaign. ServiceNow confirmed no platform compromise; Reco's conclusion: "every byte the attacker retrieved was something a site owner had exposed to anonymous users." Why it matters: Nothing was exploited, so nothing was flagged. The 560,000 logged events at one target sat inside ordinary guest portal traffic, undetected, on infrastructure that has stood for seventeen months. The visibility gap sits on the surface organizations hand to anonymous visitors and then stop watching. Stat of the week: 1.7 billion The number of credentials harvested by infostealer malware across more than 7.4 million compromised systems in the first half of 2026 alone, according to the Flashpoint Global Threat Intelligence Report, Midyear Edition. Tenable's RSO serves as Tenable's Forward Logistics Element in the threat landscape, providing customers with the analyses and contextualized exposure intelligence required to manage risks to critical business assets. With over 150 years of collective expertise, this hand-picked group of world-class security researchers is united with one mission: to cut through the noise and deliver critical intelligence about the most dangerous cyber threats emerging right now.
