Threat briefs

This brief documents detection logic for the DSInternals PowerShell module, a toolkit frequently leveraged by threat actors to perform unauthorized offline manipulation of Active Directory databases and extraction of cryptographic material.

Adversaries often attempt to clear PowerShell command history to conceal malicious activities conducted during a security incident.

This brief documents patterns of PowerShell invocation commonly associated with malicious activities such as payload downloading, fileless execution, and persistence establishment.

The PowerUp tool is leveraged by attackers to perform DLL hijacking for privilege escalation by writing malicious batch files to the filesystem.

This brief outlines the monitoring of Windows Defender Antimalware events that indicate confirmed malware detections or suspicious system behavior.

Detection of credential dumping and system manipulation activity associated with the use of the Mimikatz post-exploitation tool by threat actors.

Hitachi Energy RTU500 devices are impacted by multiple vulnerabilities that allow attackers to induce Denial-of-Service, exfiltrate authentication credentials, and bypass security controls.

Two distinct activity clusters (CL-CRI-1131 and CL-CRI-1163) are leveraging LLMs via hosted NextChat instances to troubleshoot and refine post-exploitation scripts and exfiltration infrastructure against entities in the Latin American transportation, government, and financial sectors.

DPCalendar Free versions 10.11.2 and earlier contain a stored XSS vulnerability in the location title field, allowing an Author-role user to bypass content moderation and execute arbitrary JavaScript in the browsers of site visitors.

Cisco has issued security advisories for unpatched S/MIME vulnerabilities in Secure Email and critical RCE and authentication bypass flaws across its IOS XR, Nexus, and VoIP phone product lines.

LearnDash LMS versions prior to 4.10.3 are vulnerable to unauthenticated REST API access (CVE-2024-1208, CVE-2024-1210), allowing unauthorized remote actors to exfiltrate quiz and examination content.

An unidentified threat actor leveraged a 33-hour BGP hijack to intercept traffic and serve malicious updates for the Virtualizor web hosting platform via a spoofed update portal.

CVE-2025-58434 is a critical vulnerability in Flowise versions prior to 3.0.6 where the password reset API leaks a temporary token, enabling unauthenticated account takeover.

Adminer versions prior to 5.4.3 are vulnerable to unauthenticated remote code execution via DSN injection, allowing attackers to write arbitrary PHP files to the web root.

A vulnerability in the cups-browsed service allows a local attacker to achieve arbitrary code execution via malicious print queue discovery packets.

CVE-2024-2876 is an unauthenticated SQL injection vulnerability in the Email Subscribers by Icegram Express plugin for WordPress, allowing remote attackers to extract database content via improper input sanitization.

A critical unauthenticated stack buffer overflow in Ivanti Connect Secure, Policy Secure, and Neurons for Zero-trust Access (version 22.7) allows remote attackers to execute arbitrary code and create unauthorized administrative accounts.

Attackers are exploiting CVE-2023-22527, a critical remote code execution vulnerability in Atlassian Confluence Server and Data Center, by sending crafted POST requests to a specific endpoint to inject and execute arbitrary OGNL expressions, potentially leading to complete system compromise.

Exploitation of CVE-2022-26134, an unauthenticated remote code execution vulnerability in Atlassian Confluence, allows attackers to execute arbitrary code on vulnerable servers, potentially leading to complete system compromise.

Progress Software has patched two vulnerabilities, including path traversal (CVE-2026-18672) and input tampering (CVE-2026-19219), in Telerik UI for ASP.NET AJAX versions prior to 2026.3.812.

The fast-uri library incorrectly normalizes malformed IPv6 bracketed literals, allowing attackers to bypass host-based security checks via SSRF.

An improper access control vulnerability in Omnigent allows authenticated users to overwrite shared agent bundles, enabling arbitrary command execution on runner infrastructure via malicious MCP server configuration.

An attacker with administrative page-editing permissions can achieve remote code execution in Grav versions prior to 2.0.7 by injecting arbitrary callables into page frontmatter, which are subsequently triggered by visitor requests.

An unauthenticated arbitrary file read vulnerability (CVE-2026-63490) exists in handlebars-springmvc < 4.5.3 due to insufficient validation of user-influenced view names, allowing attackers to bypass file suffix restrictions using URL fragments.

The @platejs/docx-io library is vulnerable to Server-Side Request Forgery (SSRF) and response disclosure, allowing attackers to probe internal networks via malicious HTML image embeddings.

The Scrapy S3DownloadHandler defaults to sending signed AWS S3 requests over plaintext HTTP, potentially exposing AWS authorization headers and security tokens to network-based attackers.

SeaweedFS versions prior to 4.24 contain an authentication bypass in the IAM gRPC service, allowing unauthenticated network actors to mint administrative S3 credentials and gain full control over object storage via CVE-2026-72920.

A vulnerability in the MailPit application allows a remote, unauthenticated attacker to trigger a Denial of Service condition, resulting in service unavailability.

Authenticated users can trigger OS command injection in OpenChoreo workflow templates by supplying crafted parameters that are insecurely interpolated into shell execution scripts.

OpenChoreo cluster-gateway versions prior to 1.0.2, 1.1.2, and 1.2.0 are vulnerable to unauthenticated access of management APIs on externally exposed listeners, enabling remote execution and cluster-wide compromise.