"Because this access originates through an organization’s own VPN, malicious activity can resemble legitimate remote work and may go undetected until credential theft, lateral movement, data theft, or ransomware deployment is underway," ReliaQuest warned.
ReliaQuest on CVE-2026-0257: VPN access used as a disguise
Qilin and Settra ransomware groups are actively exploiting CVE-2026-0257, an authentication-bypass bug in PAN-OS GlobalProtect and Prisma Access that was disclosed in May 2026. ReliaQuest says attackers benefit from the fact that the intrusion "originates through an organization’s own VPN," making malicious activity harder to distinguish from legitimate remote work. The advisory in the source recommends immediate upgrades of affected deployments, disabling authentication override cookies where not required, terminating all active GlobalProtect sessions after patching, and investigating unexpected connections — including sessions using hostnames such as "kali." The bulletin stresses that "patching alone may not remove access established before remediation."
Infoblox: Noir uses DNS TXT and DoH to drain wallets without seed phrases
Infoblox analyzed a wallet-drainer kit called Noir that uses DNS TXT records, queried via public DNS-over-HTTPS services, to discover which attacker-controlled backend pool is active; the pool currently runs on Cloudflare Pages. Noir is delivered by a loader that "queries the TXT record through public DoH services to learn which backend pool is active." According to Infoblox, the drainer "does not need a seed phrase, password, or private key." Instead, it receives initial read permissions, tailors content to the victim, then obtains spending permissions that can seem less alarming than a direct transfer and completes the theft from attacker-controlled infrastructure. Infoblox also notes the malware is suspected to have been created and maintained with AI assistance.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildGroup-IB: KGB RAT blends theft with psychological harassment
Group-IB described a Windows remote access trojan called KGB RAT that has been marketed since late 2025 as "fully undetectable." The package includes a built-in crypter, HVNC, credential theft, ransomware and — unusually — a set of psychological harassment features. Group-IB highlighted screamer functions, jump scares, and forced blue screens of death as "fun settings" the developers advertise, allowing attackers to weaponize victim anxiety alongside data theft. Group-IB called KGB RAT "a full-featured malware package that gives attackers silent and persistent control over infected Windows machines." A public disclosure referencing a KGB RAT server at version 0.1 dates to late January 2022, indicating multi-year development prior to market release.
Wordfence: a must-use WordPress backdoor with self-healing and EtherHiding
Wordfence detailed a persistent WordPress backdoor installed as a must-use plugin that implements "several self-healing mechanisms" to survive removal. The backdoor also uses "EtherHiding," a technique that hides the location of attacker servers behind a smart contract on the Ethereum blockchain, making the command channel resilient to takedown. Capabilities include establishing and hiding administrator access, harvesting administrator passwords, remote site modification, data exfiltration, and lateral spread to other WordPress installations on the file system.
Ziyi Guo on NVIDIA Bad UVM (CVE-2026-47595): local privilege escalation and container escape
Researcher Ziyi Guo disclosed a critical Linux vulnerability in NVIDIA's GPU Display Driver for Linux (CVE-2026-47595, CVSS 7.5), dubbed "Bad UVM." The bug lets an unprivileged user write to read-only memory because permission bits are not preserved; that capability can be chained to achieve code execution, escalation of privileges, information disclosure, data tampering, denial-of-service, and even a container escape. Guo described injecting exploit code into nvidia-persistenced to force execution of a UVM-based local privilege escalation, and then using the elevated context to execute commands on the host with full root access.
What this means for technologists, enterprises, and end users
- Technologists and security teams: follow the concrete mitigations named by vendors and researchers — upgrade GlobalProtect/Prisma Access, disable authentication override cookies, terminate active VPN sessions, hunt for unexpected hostnames, and validate that remediation removed attacker footholds rather than just patched the vulnerability. For malware that installs persistence (BotHelper RAT, WordPress must-use plugins), inspect scheduled tasks, Antimalware Scan Interface modifications, and hidden administrator accounts described by Point Wild and Wordfence.
- Enterprises and procurement leaders: take credential hygiene seriously. Meta is notifying roughly 1,500 people after stolen employee credentials were used to access GitHub repositories, and multiple stealers — Aoki, Warden, CastleStealer — are explicitly targeting developer API keys, session tokens, and AI-tool configuration files that can enable misuse under legitimate identities.
- End users: platform-level defenses matter. Google reports Android protections — including Scam Detection and real-time call verification — have blocked over 3 million spoofed calls from two banks alone; at the same time, new stealers targeting AI assistants and browser app-bound encryption show typical endpoints are attractive and fragile.
Across these separate incidents the pattern is clear: attackers rely as often on stolen logins, default settings, and overlooked permissions as they do on novel exploit chains. As the source concludes, don't just patch what is broken — hunt for who got in, what they touched, and whether they can come back.
