Reporting Period	Classification	Generated
2026-06-04 (24h)	TLP:CLEAR	2026-06-05

1. Executive Summary

The pipeline ingested 58 reports across 13 sources in the last 24 hours, with one critical and 40 high-severity items. Edge-device exploitation dominates: Unit 42 confirmed active in-the-wild exploitation of PAN-OS CVE-2026-0257, an authentication bypass in GlobalProtect that was added to the CISA KEV catalogue on 29 May; Cisco disclosed unpatched SD-WAN Manager zero-day CVE-2026-20245 enabling root privilege escalation; and CISA added SolarWinds Serv-U CVE-2026-28318 to the Known Exploited Vulnerabilities catalogue today. Volexity exposed Chinese espionage group UNC5221 / VerdantBamboo maintaining persistent access for 18+ months across MSP and victim environments using the Brickstorm backdoor (Go/Rust/BSD variants) plus newly documented Plenet and AgentPSD implants, pivoting into Microsoft 365 via SSL VPN. Ransomware throughput remained heavy with Qilin, Akira, WorldLeaks (the rebranded Hunters International/Hive successor), Nightspire, Play, and DragonForce posting fresh victims. Critical golang crypto/ssh flaw CVE-2026-39835 (server panic on host-key verification) headlines a six-CVE Go ecosystem batch from Microsoft.

2. Severity Distribution

Severity	Count	Key Drivers
🔴 CRITICAL	1	golang.org/x/crypto/ssh CheckHostKey panic (CVE-2026-39835)
🟠 HIGH	40	PAN-OS CVE-2026-0257 in-the-wild; Cisco SD-WAN zero-day CVE-2026-20245; CISA KEV SolarWinds Serv-U CVE-2026-28318; UNC5221/Brickstorm; Qilin/Akira/WorldLeaks/Nightspire/Play victim postings; Operation TaxShadow; Pink vishing; Evil MSI phishing; CISA ATG advisory
🟡 MEDIUM	7	Go x/net/html DOCTYPE parsing flaw; SSH agent client panic CVE-2026-46598; SSH channel reject memory leak CVE-2026-39827; BCD Travel breach (ShinyHunters); Hola Browser cryptominer supply-chain; Magecart Stripe abuse
🟢 LOW	1	Telegram proxy OSINT (TLP:AMBER+STRICT)
🔵 INFO	9	CVE-2026-33841 Windows Kernel EoP; EU tech sovereignty package; Brave Origin paid browser; Trump CISA director consideration; Apple removes Russia Max app

3. Priority Intelligence Items

3.1 Active Exploitation of PAN-OS GlobalProtect (CVE-2026-0257)

Source: Unit42

Palo Alto Networks Unit 42 confirmed in-the-wild exploitation of CVE-2026-0257, an authentication-bypass flaw in the portal and gateway components of vulnerable PAN-OS versions that allows unauthorised actors to initiate VPN connections against GlobalProtect. The CVE was added to the CISA KEV catalogue on 29 May. Unit 42 observes probing across many devices but only a small subset establishing connected gateway sessions; no post-access lateral movement has been attributed yet. Hard-coded host IDs and device names in the public PoC make telemetry hunting tractable.

Indicators of Compromise

Pre-PoC source IPs (search GlobalProtect logs):
23.128.228[.]6
104.207.144[.]154
146.19.216[.]119
146.19.216[.]120
146.19.216[.]125
179.43.172[.]213
185.195.232[.]139
198.12.106[.]60
202.144.192[.]47

PoC client fingerprints:
host_id: aa:bb:cc:dd:ee:ff
host_id: 00:11:22:33:44:55
device_name: WINDOWS-LAPTOP-001
device_name: DESKTOP-GP01
device_name: GP-CLIENT
endpoint_os_version: "Microsoft Windows 10 Pro 64-bit"
source_user_info.domain: <empty>

MITRE ATT&CK: T1190 (Exploit Public-Facing Application), T1071.001 (Web Protocols)

SOC Action: Pull GlobalProtect gateway-connected logs for the past 7 days; flag any session whose source IP matches the pre-PoC list above OR whose host_id/device_name matches the PoC fingerprints. For successful gateway connections, isolate the user account, force credential rotation, and review downstream session activity for VPN tunnel pivoting. Apply Palo Alto’s advisory patches or workarounds; if unable to patch, restrict GlobalProtect portal access to known source ranges.

3.2 CISA KEV Adds SolarWinds Serv-U CVE-2026-28318

Source: CISA

CISA added CVE-2026-28318, a SolarWinds Serv-U uncontrolled resource consumption vulnerability, to the KEV catalogue based on evidence of active exploitation. BOD 22-01 obligates FCEB agencies to remediate within the catalogue’s specified due date; CISA strongly recommends all organisations prioritise remediation.

MITRE ATT&CK: T1499 (Endpoint Denial of Service)

SOC Action: Inventory Serv-U FTP/file-transfer instances across the estate; apply the vendor patch within the CISA KEV due date. For any internet-exposed Serv-U deployment, place it behind WAF/reverse proxy with rate limiting and review the last 30 days of access logs for sustained connection patterns indicative of resource-consumption probing.

3.3 Cisco SD-WAN Manager Zero-Day CVE-2026-20245 (Unpatched)

Source: BleepingComputer

Cisco disclosed CVE-2026-20245, a high-severity flaw in Catalyst SD-WAN Manager (formerly vManage) that lets local attackers with netadmin privileges execute arbitrary commands as root via a crafted file upload. Affects all deployment types (On-Prem, Cloud-Pro, Cisco Managed, FedRAMP). PSIRT confirms limited exploitation in the wild; Mandiant supplied initial telemetry. No patch is available yet — Cisco advises customers running pre-May code to upgrade to the fix for CVE-2026-20182 (a related, separately-patched zero-day) as a hardening step. Exploitation requires valid credentials or chaining with CVE-2026-20182 / CVE-2026-20127.

Indicators of Compromise

Log artifact (/var/log/scripts.log):
vScript: Tenant list upload per vsmart serial number:
  /usr/bin/vconfd_script_upload_tenant_list.sh -cli path /home/admin/malicious.csv vpn 0

MITRE ATT&CK: T1059.001 (Command Shell), T1078 (Valid Accounts), T1190 (Exploit Public-Facing Application)

SOC Action: Audit /var/log/scripts.log on every SD-WAN Manager appliance for vconfd_script_upload_tenant_list.sh invocations referencing unfamiliar .csv paths under /home/admin/. Generate an admin-tech file and open a TAC case for any match. Until patch availability, restrict netadmin role assignments, enforce MFA on management plane, and isolate SD-WAN Manager from general user-segment reachability.

3.4 Chinese APT UNC5221 (VerdantBamboo) Brickstorm Campaign

Source: BleepingComputer

Volexity attributes a long-running intrusion to UNC5221 / VerdantBamboo (Chinese espionage), who maintained access to victim networks for at least 18 months by pivoting through a compromised managed-services provider (MSP) and dropping the Brickstorm backdoor (Golang, Rust, and BSD variants) on Egnyte Storage Sync, Synology NAS, pfSense firewall, and a Linux GroupWise archive server. From there, the actor used Brickstorm’s SOCKS proxying and stolen credentials to reach the victim’s Microsoft 365 tenant, blending with legitimate traffic to evade Conditional Access. Two new implants were observed: Plenet (a .NET cross-platform backdoor, aka Grimbolt, using WebSocket C2 with multiplexing) and AgentPSD (a Python reverse-shell fallback). Victim was re-compromised after initial remediation via the same MSP vector. CISA previously warned of Brickstorm on VMware vSphere; Google attributed parallel UNC6201 deployment against Dell RecoverPoint.

MITRE ATT&CK: T1078.004 (Cloud Accounts), T1090 (Proxy), T1059.003 (PowerShell), T1027 (Obfuscation), T1133 (External Remote Services)

SOC Action: Treat MSP-managed appliances (NAS, firewall, sync gateways) as in-scope for EDR coverage; do not assume MSP-perimeter trust. Hunt for Microsoft 365 logins originating from IPs associated with on-prem network appliances (NAS, firewall, sync devices) — this is the Brickstorm proxy fingerprint. Audit Conditional Access bypasses, service-principal grants, and OAuth app consents created in the last 18 months. If Synology, pfSense, or Egnyte appliances are present, scan for unsigned binaries with embedded Go/Rust runtimes and WebSocket outbound to non-business endpoints.

3.5 Critical Go SSH and HTML Library CVE Batch

Source: Microsoft MSRC (multiple advisories)

Microsoft published six advisories covering the Go cryptography and net/html packages. The single critical item, CVE-2026-39835, allows an attacker to trigger a server panic during CheckHostKey / Authenticate in golang.org/x/crypto/ssh, producing a denial-of-service against any Go-built SSH server. Companion mediums: CVE-2026-46598 (crypto/ssh/agent client panic on pathological inputs), CVE-2026-39827 (crypto/ssh memory leak via rejected channels — DoS over time), CVE-2026-25680 / CVE-2026-42502 / CVE-2026-25681 (x/net/html DoS and incorrect element handling in DOCTYPE / foreign content). Wide-blast-radius dependencies; expect downstream re-releases across Go-based agents, brokers, and CI runners.

MITRE ATT&CK: T1499 (Endpoint DoS), T1071.001 (Web Protocols / SSH)

SOC Action: Run go list -m -u all (or SCA equivalent) across all internally maintained Go services to identify golang.org/x/crypto and golang.org/x/net versions below the patched releases. Prioritise internet-facing SSH services (Gerrit, Drone, SFTP gateways, network admin gateways) for emergency redeploy. For golang.org/x/net/html, flag any service that parses untrusted HTML server-side.

3.6 Pink (UNC6671) Vishing-Driven Extortion — BlackFile Rebrand

Source: AlienVault / The Register

Unit 42 (tracking the cluster as CL-CRI-1147) and Google Threat Intelligence (assessing as UNC6671) reported a new extortion brand called Pink, which Google believes is the second rebrand of BlackFile after a brief “Redact” interim. Pink uses voice-phishing (vishing) and IT-helpdesk impersonation to phish credentials and MFA, then exfiltrates SharePoint and OneDrive content for “pay-or-leak” extortion with a 72-hour deadline. The activity is assessed as Com-affiliated and shares infrastructure and “we’ll improve your security” messaging with UNC6671. Pink’s data leak site went live on 31 May.

Indicators of Compromise

Credential phishing domains:
deploypasskey[.]com
passkeyadd[.]com
passkeydeploy[.]com

Source IPs:
185.178.208[.]153
96.232.20[.]66

MITRE ATT&CK: T1566 (Phishing), T1078.004 (Cloud Accounts), T1199 (Trusted Relationship), T1567 (Exfiltration over Web Service)

SOC Action: Block the three passkey-themed domains at egress and DNS. Brief helpdesk and IT staff on the rebrand; require call-back verification for any password/MFA reset request originating from a phone call. Audit SharePoint/OneDrive bulk-download events from new device sign-ins over the past 14 days. Add Conditional Access policy blocking session token use from impossible-travel and TOR-egress IPs.

3.7 Operation TaxShadow — In-Memory Multi-Stage Tax Phishing

Source: AlienVault / CYFIRMA

A tax-themed phishing campaign impersonating the Indian tax authority delivers a ZIP containing कर विवरण.exe, SbieDll.dll, and SbieDll.bin. The chain uses DLL search-order hijacking against a Sandboxie binary, API hooking, token manipulation, COM-callback execution, mutated RC4 payload encryption, reflective PE loading, and LLVM control-flow flattening. C2 runs over persistent WebSockets to blend with legitimate browser traffic. Multiple Chinese-language artefacts present but attribution remains moderate-confidence.

Indicators of Compromise

SHA-256:
185b7a487316454da04e9cc0fe6eb370bb2955cf6096fe3e8c02c46f8989ba37
4c9061a07d667bf7dd6f597a43a8552af2f4277b7be06d6ea138abdb668d6a49
7d87a86dbd2379ef2516c99258137cd9c25ca19c48aeb096c5332c02fcbf16d0
949acbe543fc244ffbc981ea169067da7c5792af3c3d19b2c31b3d7e19106880
be31a63cad112723178289968ad6f93a576c5a7984099c42eec3521cdf6e5fc0

C2 / phishing domains:
appradarr[.]cc
asdqxcdsa[.]icu
guhxmg[.]com
mnb-ny[.]com
naiqja[.]icu
ws4962[.]com
zh-welcome-1xbet[.]com
zhengfu666[.]com
d.pc-weide[.]com
taxations.cn-web-okooo[.]com

MITRE ATT&CK: T1566.002 (Spearphishing Link), T1574.001 (DLL Search Order Hijacking), T1055 (Process Injection), T1134 (Access Token Manipulation), T1071.001 (Web Protocols), T1027.002 (Software Packing)

SOC Action: Block the listed domains at DNS/proxy and add the SHA-256 hashes to EDR deny-lists. Hunt for SbieDll.dll or SbieDll.bin outside legitimate Sandboxie install paths; alert on PE files dropping into %TEMP% with Devanagari filenames. Inspect WebSocket egress to non-business endpoints from user endpoints over the past 14 days.

3.8 CISA/FBI/NSA Joint Advisory — 900+ ATG Systems Exposed

Source: BleepingComputer

CISA, FBI, NSA, and DOE issued a joint advisory warning of ongoing attacks on internet-exposed automatic tank gauge (ATG) systems used to monitor fuel and chemical storage tanks. Shadowserver counted 1,061 ATG systems on TCP/10001, with 909 in the United States after honeypot exclusion. Attackers exploit hardcoded credentials, authentication bypasses, SQL injection, OS command injection, and privilege escalation to alter device settings — potentially disabling leak detection alerts. The advisory is unattributed but follows prior CNN reporting that Iranian operators previously compromised US ATG devices.

MITRE ATT&CK: T1190 (Exploit Public-Facing Application), T1078 (Valid Accounts), T1059.001 (Command Shell), T1078.001 (Default Accounts)

SOC Action: Inventory any ATG devices using Shodan/Censys queries for port:10001 against owned IP space. Front any internet-required ATG with a VPN or jump-host gateway; remove direct TCP/10001 exposure. Rotate hardcoded/default credentials; apply vendor security updates; enable MFA on management interfaces; subscribe to Shadowserver Accessible ICS feed for ongoing visibility.

3.9 The Evil MSI Background — WeTransfer JavaScript Phishing

Source: SANS ISC

SANS handler Xavier Mertens documented a resurgence of MSI-background-image payload smuggling. Phishing email delivers a WeTransfer link to Remittance Advice.js. The 2MB-plus JavaScript hides its real logic among junk loops; the active branch decodes a ROT13-obfuscated PowerShell command (-ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden) into the INTERNAL_DB_CACHE env variable and invokes it via WMI Win32_Process.Create. PowerShell pulls an MSI-branded JPEG (steganographic loader) from a Cloudflare Workers subdomain and a .NET DLL (modified Microsoft.Win32.TaskScheduler) plus a snake.png payload from a Cloudflare R2 bucket.

Indicators of Compromise

JS dropper: SHA256 8a83de81fbac4eb0961f3d58982f299664a5fa4c874c7469e69f85f3fc5bd33f
.NET loader: SHA256 184a3008adff54cb345a599b4f3ca0c7bde29d8ac8379783ff40cd4e7ecc931b

URLs:
hxxps://we[.]tl/t-R4Wv1JkvFfC4Awus
hxxp://icy-lab-0431[.]guilherme-telecomunicacoes2024[.]workers[.]dev/mCSlB
hxxps://pub-a06eb79f0ebe4a6999bcc71a2227d8e3[.]r2[.]dev/snake.png

MITRE ATT&CK: T1566.002 (Spearphishing Link), T1059.001 (PowerShell), T1027.003 (Steganography), T1218 (System Binary Proxy Execution)

SOC Action: Query EDR for wscript.exe or cscript.exe spawning powershell.exe with -ExecutionPolicy Bypass -WindowStyle Hidden from user %Downloads% or %TEMP% directories. Block *.workers.dev and *.r2.dev egress for endpoint users unless business-justified (developer exceptions only). Alert on WMI Win32_Process.Create calls from non-admin user contexts.

3.10 Ransomware Throughput — Qilin Leads, WorldLeaks Rebrand Confirmed

Source: BleepingComputer / RansomLook (26 RansomLook leak-site postings in the period)

The pipeline observed 26 ransomware victim postings concentrated across Qilin (9 victims, including Central Florida Cosmetic & Family Dentistry, Ontario Home Builders’ Association, Jay’s Catering, Swim-Mor Pools, Trican), Akira (Kennon Worldwide, Oaks Park, T/CCI Manufacturing), WorldLeaks (Access Dental, CH Karnchang Public, United Auto Supply — confirmed as the Hunters International / Hive lineage operating as data-theft-only extortion-as-a-service), Nightspire (First Mutual Holdings, Krum Public Library), Play (Urschel Laboratories, Dallis Law Firm, The Chapel, Corley MFG), Genesis (Family Medical Associates of Raleigh), DragonForce (REHA-ACTIV), AiLock (Groupe Sécurité CLB), and Inc Ransom (Stuga Machinery). Sectors hit: dental and primary healthcare, manufacturing, legal services, public libraries, and SMB construction trades.

MITRE ATT&CK: T1486 (Data Encrypted for Impact), T1078 (Valid Accounts), T1133 (External Remote Services), T1566 (Phishing), T1567 (Exfiltration over Web Service)

SOC Action: Treat SMB-segment dentistry, libraries, and trade-association environments as a current Qilin/Akira focus; if you provide MSSP coverage for any such customer, run a 7-day VPN/RDP brute-force review and confirm offline-immutable backups. WorldLeaks now operates exfil-only — encryption-watch alone misses them; tune DLP and large-volume cloud-storage egress alerts.

4. AI-Identified Correlation Trends

Risk	Trend	Supporting Evidence
🔴 CRITICAL	Exploitation of vulnerabilities in widely used software and infrastructure components	CISA KEV add (SolarWinds Serv-U); Unit 42 active exploitation of PAN-OS CVE-2026-0257
🔴 CRITICAL	Exploitation of cloud services and edge-device vulnerabilities by threat actors	Pink/UNC6671 vishing into Microsoft 365; Cisco SD-WAN Manager CVE-2026-20245; Azure HorizonDB EoP (CVE-2026-48567, batch 156)
🔴 CRITICAL	Exploitation of vulnerabilities in widely used software packages	libsolv heap overflow CVE-2026-9149 (batch 155); golang.org/x/crypto/ssh CVE-2026-39835
🔴 CRITICAL	Rising ransomware activity across diverse sectors with sophisticated TTPs	Akira (3 victims today), WorldLeaks rebrand-and-shift, Qilin (9 victims today)
🟠 HIGH	Phishing remains the prevalent initial-access vector, frequently combined with other TTPs	2026 DBIR confirms browser as primary attack surface; Evil MSI WeTransfer chain; Operation TaxShadow government impersonation
🟠 HIGH	Phishing campaigns leveraging social engineering and impersonation tactics	Pink vishing/IT-helpdesk impersonation; Operation TaxShadow tax-authority impersonation
🟠 HIGH	Supply-chain attacks targeting software development and cloud services	Hola Browser Monero cryptominer (supply-chain); persistent npm worm activity (Miasma, IronWorm — prior batch)

5. Trending Entities (Pipeline-Wide)

Threat Actors

• Akira (82 reports, 30-day) — Double-extortion ransomware; 3 fresh victims today targeting Windows and ESXi
• Qilin (81 reports, 30-day) — RaaS dominating today’s leak-site throughput with 9 postings in healthcare and SMB sectors
• The Gentlemen (49 reports, 30-day) — Continues to feature among top RaaS brands
• DragonForce (35 reports, 30-day) — RaaS with flexible affiliate-portal branding; one fresh victim today
• TeamPCP (32 reports, 30-day) — Active leak-site operator
• ShinyHunters (29 reports, 30-day) — Today linked to the BCD Travel 396k-record breach
• UNC5221 / VerdantBamboo (Chinese APT) — Newly elevated by Volexity disclosure of 18-month Brickstorm persistence
• Pink / UNC6671 — Vishing-led extortion debut; Com-affiliated; assessed BlackFile rebrand

Malware Families

• RansomLook (117 reports, 30-day) — Pipeline tag covering aggregated RaaS leak-site activity
• Akira ransomware (44 reports) — Continued .akira encryption with CryptoAPI on Windows, ESXi targeting
• Tox / Tox1 (43 reports combined) — Encrypted-messaging channel used across multiple RaaS for victim negotiations
• Brickstorm — UNC5221’s advanced multi-platform backdoor (Go/Rust/BSD); newly elevated
• Plenet (Grimbolt) — Newly documented .NET cross-platform backdoor with WebSocket C2
• AgentPSD — Python reverse-shell fallback used by UNC5221
• Operation TaxShadow — In-memory multi-stage malware framework

6. Source Distribution

Source	Reports	URL	Notes
RansomLook	26	link	Ransomware leak-site aggregation (Qilin, Akira, WorldLeaks, Nightspire, Play, DragonForce, Genesis, AiLock, Inc Ransom)
BleepingComputer	8	link	UNC5221/Brickstorm, Cisco SD-WAN 0day, ATG advisory, Hola Browser, Magecart Stripe, DBIR, Nemesis sentencing, Brave Origin
Microsoft	7	link	Go crypto/ssh and x/net/html CVE batch; Windows Kernel EoP
RecordedFutures	3	link	EU tech sovereignty package; Apple removes Russia Max app; Palantir-CISA director speculation
AlienVault	3	link	Operation TaxShadow; ClickFix RAT job-platform impersonation; Pink/UNC6671
Unknown	3	—	Telegram OSINT (channel name redacted)
SANS	2	link	Evil MSI WeTransfer phishing; Stormcast
Unit42	1	link	PAN-OS CVE-2026-0257 active exploitation
CISA	1	link	KEV add: SolarWinds Serv-U CVE-2026-28318
Schneier	1	link	AI-powered worm prototype with embedded LLM
HaveIBeenPwned	1	link	BCD Travel 396,313 accounts (ShinyHunters)
Crowdstrike	1	link	Agentic AI scaling principles
Upwind	1	link	Quantum-ready cloud cryptography framework

7. Consolidated Recommendations

• 🔴 IMMEDIATE: Hunt and patch for PAN-OS CVE-2026-0257 — query GlobalProtect logs against the Unit 42 IP and host-fingerprint IOCs in §3.1 and isolate any successful connections; apply the vendor advisory or restrict portal access by source IP.
• 🔴 IMMEDIATE: Inventory SolarWinds Serv-U installs and remediate CVE-2026-28318 (CISA KEV today); for Cisco Catalyst SD-WAN Manager, hunt /var/log/scripts.log for the CVE-2026-20245 upload artefact in §3.3 — patch is not yet available, so harden management-plane access.
• 🟠 SHORT-TERM: If you operate or rely on an MSP that manages edge appliances (firewalls, NAS, sync gateways), run a Brickstorm/Plenet hunt: any Microsoft 365 sign-in originating from an on-prem appliance IP, plus 18-month look-back on Conditional Access exceptions and OAuth grants (§3.4).
• 🟠 SHORT-TERM: Run an SCA pass on all Go-based services for golang.org/x/crypto and golang.org/x/net/html versions and queue emergency redeploys for internet-facing SSH services (§3.5).
• 🟡 AWARENESS: Brief helpdesk and identity-recovery teams on the Pink/UNC6671 vishing rebrand and the Com lineage (§3.6); enforce call-back verification for any phone-initiated MFA or password reset.
• 🟡 AWARENESS: Tune DLP and large-volume cloud-storage egress alerts — WorldLeaks is now exfil-only (no encryption), and conventional ransomware detection misses this lineage (§3.10).
• 🟢 STRATEGIC: Begin Go-ecosystem and post-quantum cryptography readiness reviews informed by the Microsoft Go CVE batch and Upwind’s quantum-ready framework; treat browser-as-attack-surface findings from the 2026 DBIR as input to your endpoint browser hardening roadmap.

---

This brief was generated entirely by AI from automated threat intelligence collection and correlation pipelines, made up of 58 reports processed across 2 correlation batches. A human analyst reviewed and approved this report before publication, but AI-generated analysis may contain errors in attribution, severity assessment, or indicator extraction. Always verify IOCs, CVE details, and threat actor attribution against primary sources before taking operational action.