Weekly Threat Intel Report — 2026-W42: 12-18 October 2026

TL;DR

Edge devices and vendor supply chains carried most of the week's incident volume. BeyondTrust disclosed a Remote Support zero-day that attackers had been exploiting since August, with reporting pointing to suspected Chinese espionage activity. Ivanti patched CVE-2026-104935, an authentication bypass and RCE chain whose July fix proved incomplete. ConnectWise suspended its Cloud Backup service after application identities tied to the product were used to access customer Microsoft 365 tenants. A cyberattack against BAE Systems knocked out the US federal bankruptcy court notice system. On the defensive side, the FBI with CrowdStrike support disrupted parts of the DPRK Famous Chollima IT worker fraud operation, and Microsoft's Digital Crimes Unit took action against the Yam Store phishing ecosystem (Storm-2990 and Storm-3119) tied to more than one billion phishing messages. Microsoft Patch Tuesday shipped roughly 1,413 CVEs including three zero-days.

Notable Activity by Actor

Famous Chollima (DPRK). CrowdStrike published details of a joint operation with the FBI that disrupted infrastructure supporting the North Korean IT worker fraud scheme. Operators used fabricated identities to gain remote employment at Western companies, with wages and insider access serving both revenue generation and intrusion staging. The disruption targeted laptop farms and identity pipelines. The scheme itself has not stopped; defenders should continue to treat it as an active hiring and insider risk.

Suspected PRC activity against BeyondTrust Remote Support. The Record reported that an alleged Chinese state-backed group has been exploiting a BeyondTrust Remote Support zero-day since late August. BeyondTrust released patches this week. The targeting pattern (IT support software used by downstream enterprises) is consistent with espionage-driven supply chain focus.

DPRK phishing of Ukrainian government. DarkReading reported a reply-bait phishing campaign aimed at Ukrainian government personnel. The DPRK interest is tied to Pyongyang's own deployment of forces alongside Russian operations and the resulting intelligence requirements.

Storm-2990 and Storm-3119 (newly tracked). Microsoft's Digital Crimes Unit disrupted a Chinese-language cybercriminal ecosystem comprising phishing kit operators (Storm-2990) and an illicit marketplace selling kits and infrastructure (Storm-3119). DarkReading tied the activity to the Yam Store brand and estimated more than one billion phishing messages supported by the ecosystem.

UAT-6275 (Kazakhstan nexus, newly tracked by Talos). Talos and Recorded Future documented UAT-6275 activity against government targets across the Commonwealth of Independent States, with recovered artifacts showing additional interest in water and energy.

TAG-217 and TAG-193 (newly tracked by Recorded Future). TAG-217 targeted South Korean financial institutions with an AI-assisted offensive framework named ARTEX. TAG-193 was tied to espionage operations across Central Asia and the broader CIS.

DataSuckers (Russia). Moscow police detained three suspected members following a cyberattack on a Russian restaurant chain. The group has also been linked to data theft intrusions in Ukraine.

Emerging Threats

Edge devices remain the preferred initial access path. Four separate stories this week reinforced the pattern. BeyondTrust Remote Support, Ivanti Connect Secure (CVE-2026-104935), and ongoing exploitation of FortiManager (CVE-2024-47575 via the PEERSTITCH ARM64 implant on 500+ firewalls documented by Unit 42) all represent edge or privileged access products exploited at scale. Unit 42's September initial access review placed edge exploits at the top of observed vectors, ahead of credential abuse and phishing.

Incomplete patches are becoming their own vulnerability class. Ivanti CVE-2026-104935 was described as only partially discovered and patched in July, leaving attackers an opening they used through the fall. Defenders should assume that patches for complex authentication logic may require follow-up releases and should instrument for exploitation signatures, not just version checks.

Vendor OAuth and application identities as the new supply chain surface. ConnectWise shut down its Cloud Backup service (formerly SkyKick) after attackers abused application identities tied to the product to access downstream Microsoft 365 tenants. Huntress detailed how the credentials, once obtained, allowed unauthorized access without touching customer-owned user accounts or MFA. This is the same pattern seen in prior Microsoft 365 supply chain incidents: the OAuth application identity, not the end user, is the pivot.

Contractor-driven service disruption. A cyberattack against BAE Systems disrupted the US federal bankruptcy court notice system, halting production of bankruptcy notices. The incident is a reminder that outsourced niche workflows can quietly become single points of failure for public services.

AI-themed social engineering and AI-assisted offense. DarkReading reported a surge in campaigns impersonating Claude and ChatGPT brands and using ClickFix-style lures to target developers. Separately, a flaw in Claude Code Desktop ('SneakPeek') was described as a zero-click credential theft vector affecting SSH keys, AWS credentials, and OAuth tokens. Unit 42 published a case of AI-assisted espionage against government Linux infrastructure. The TAG-217 campaign used an AI-assisted framework. Where AI assistance appeared, it was concentrated in reconnaissance, lure generation, and tooling, not in novel exploitation primitives.

Content management and e-commerce platform exposure. Collabora Online for Nextcloud (CVE-2026-110447) is under active exploitation. Drupal patched two critical RCE flaws with warnings that exploitation is likely imminent. Magento and Adobe Commerce (CVE-2026-103849, 'BlockStrap', maximum severity) allows arbitrary PHP execution. LLM gateway LiteLLM shipped fixes for CVE-2026-35029 and CVE-2026-59823, which allowed low-privilege users to overwrite configuration via an unauthenticated endpoint.

Supply chain poisoning in community repositories. Malicious packages impersonating the Arch Linux helpers 'yay' and 'paru' were uploaded to the AUR, delivering malware with root privileges. The pattern (typosquatting trusted helper tools in community-managed repositories) continues across npm, PyPI, and AUR.

Defender Takeaways

1. Treat BeyondTrust Remote Support, Ivanti Connect Secure, and FortiManager as exposure priorities this week. Patch, then hunt for post-exploitation activity dating back to late summer. Memory-resident ARM64 implants will not appear in file-based scans.
2. Audit all third-party OAuth applications in Microsoft 365 tenants. Specifically review consent grants, application permissions, and sign-in activity for ConnectWise and SkyKick-related application IDs. Where business justification is weak, revoke.
3. Apply October Microsoft Patch Tuesday with priority on the three zero-days. CrowdStrike counted 1,413 CVEs; Talos counted 1,415; both reported roughly 75 to 85 critical. Use whichever vendor's prioritization matches your tooling.
4. For organizations running Nextcloud with Collabora Online, Drupal, Magento or Adobe Commerce, LiteLLM, or any helper-package Linux distros, treat this week as a patch sprint, not a patch cycle.
5. For IT worker fraud risk, implement live video verification during interview, require government ID validation that cannot be screen-shared, and inspect new hire laptop shipping addresses against known laptop farm clusters. Famous Chollima's revenue model survives individual disruption actions.
6. Phishing remains the top volume vector. Microsoft's Storm-2990 and Storm-3119 disruption will not meaningfully reduce inbox pressure. Combine mail filtering with FIDO2 or passkey rollouts, and bear in mind the Huntress analysis of passkey enrollment and recovery flows as the remaining attack surface.
7. For contractor and vendor risk, inventory which externally-managed workflows your organization cannot operate without, and define a tested manual fallback. The BAE Systems and bankruptcy court incident is the public example this week.

Sources

• CrowdStrike, 'U.S. Government Disrupts FAMOUS CHOLLIMA Operation with CrowdStrike Assistance', 2026-10-13.
• Microsoft Threat Intelligence, 'The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime', 2026-10-14.
• Unit 42, 'Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant', 2026-10-14.
• Unit 42, 'Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026', 2026-10-16.
• Unit 42, 'AI-Powered Espionage Campaign Targets Government Linux Infrastructure', 2026-10-15.
• Unit 42, 'The Noise Inside the Network: How an Unsophisticated Attack Exposed a Third-Party Risk', 2026-10-13.
• Huntress, 'ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks', 2026-10-16.
• Huntress, 'Fake WatchGuard VPN Site Steals Credentials', 2026-10-13.
• BleepingComputer, 'Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack', 2026-10-17.
• BleepingComputer, 'BeyondTrust patches zero-day exploited in attacks since August', 2026-10-16.
• BleepingComputer, 'BAE Systems cyberattack disrupts US federal court operations', 2026-10-16.
• BleepingComputer, 'Drupal patches critical RCE flaws, warns exploits may emerge soon', 2026-10-17.
• BleepingComputer, 'Critical BlockStrap flaw lets hackers run code on Magento servers', 2026-10-16.
• BleepingComputer, 'Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers', 2026-10-15.
• BleepingComputer, 'Fake Arch Linux packages push malware with root privileges', 2026-10-15.
• BleepingComputer, 'Burger King Japan data breach exposes 11 million customer records', 2026-10-16.
• The Record, 'Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day', 2026-10-16.
• The Record, 'Federal bankruptcy courts dealing with outages after contractor cyberattack', 2026-10-15.
• The Record, 'Moscow police detain suspected DataSuckers hackers linked to breaches in Ukraine and Russia', 2026-10-16.
• DarkReading, 'Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles', 2026-10-14.
• DarkReading, 'BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs', 2026-10-16.
• DarkReading, 'Yam Store: The Phishing Network Behind a Billion Messages', 2026-10-14.
• DarkReading, 'North Korea Phishes Ukrainians for War Intel', 2026-10-13.
• DarkReading, 'Anthropic SneakPeek Flaw Is a Silent Zero-Click Threat', 2026-10-14.
• DarkReading, 'Fake Claude, ChatGPT Attacks Surge, Putting Developers at Risk', 2026-10-16.
• Cisco Talos, 'Microsoft Patch Tuesday for October 2026', 2026-10-13.
• Cisco Talos, 'Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations', 2026-10-14.
• CrowdStrike, 'October 2026 Patch Tuesday: 1,413 CVEs Include Three Zero-Days and 75 Critical Vulnerabilities', 2026-10-13.
• Check Point Research, 'When LLM Gateways Go Wrong: Findings from LiteLLM', 2026-10-13.
• Recorded Future, 'TAG-217 Targets South Korean Financial Services with ARTEX', 2026-10-16.
• Recorded Future, 'TAG-193's Regional Espionage Operations', 2026-10-14.
• KrebsOnSecurity, 'U.K. Sanctions Cryptomus for RU Money Laundering', 2026-10-14.