ctipilot.ch

CTI Daily Brief — 2026-05-29

Typedaily
Date2026-05-29
GeneratorClaude Opus 4.7 (`claude-opus-4-7`)
ClassificationTLP:CLEAR
LanguageEnglish
Promptv2.60
Items15
CVEs26
On this page

On this page

Tags (26)
Regions (6)
References (51)

0. TL;DR

  • Arctic Wolf documents active ITW exploitation of CVE-2026-35616 (Fortinet FortiClient EMS 7.4.5–7.4.6, CVSS 9.1, CISA KEV since 2026-04-06). The pre-auth X-SSL-CLIENT-VERIFY header bypass is being abused to push the EKZ Infostealer to managed endpoints as a fake FortiEndpoint_Patch.exe signed under the legitimate fortitray.exe parent. Anything on 7.4.5/7.4.6 must move to 7.4.7 immediately; managed endpoints need browser-profile-write hunts.
  • Rapid7 ships a working Metasploit module against an unpatched Gogs zero-day (argument injection via git rebase --exec in the rebase-merge code path; CVSSv4 9.4). The maintainer did not respond to coordinated disclosure within 90 days; ~1,141 internet-facing instances visible on Shodan. No patch. Mitigate by disabling self-registration and the rebase-merge strategy.
  • Carnival Corporation files substitute notices confirming a breach affecting 5,995,277 individuals (Maine AG filing; driver's-licence + passport numbers exposed across Princess / Holland America / Cunard / Costa per The Record). Maine AG records the breach occurring 2026-04-10 and discovered 2026-04-14 (single-employee-account social engineering); ShinyHunters claimed and ultimately published when ransom was refused.
  • Samba ships 4.22.10 / 4.23.8 / 4.24.3 closing two unauthenticated RCEs at CVSS 10.0 — CVE-2026-4408 (SAMR %u shell injection) and CVE-2026-4480 (print-command %J shell injection). AD DCs unaffected; classic-printing and on-demand DCERPC SAMR file-server roles are.
  • Dutch Police and NCSC seize 200 servers and dismantle the Asocks residential-proxy botnet (~17 million enrolled devices, NL-hosted C2). Asocks joins the recent string of disrupted residential-proxy networks — SocksEscort, Aisuru/Kimwolf, FirstVPN, IPIDEA, RapperBot — and defenders relying on Asocks exit-node blocklists should re-tune residential-proxy correlation rules now that the network is offline.
  • NCSC.ch's Security Hub flags CVE-2026-9170 — improper-input-validation pre-auth RCE in IBM HTTP Server / WebSphere at CVSS 9.8. Prevalent in Swiss banking, insurance and federal middleware estates; APAR PH71265 / Fix Pack updates are out.

3. Research & Investigative Reporting

Wiz CIRT names JINX-0164 — LinkedIn-recruiter lures, AUDIOFIX macOS infostealer, MINIRAT npm pivot into CI/CD

Wiz CIRT identified and named JINX-0164 on 2026-05-27, a financially motivated cluster active since mid-2025 against cryptocurrency organisations. Initial access is LinkedIn-based social engineering — fake recruiter personas direct targets to fraudulent video-conferencing platforms that deliver AUDIOFIX, a compiled-Python macOS binary functioning as both infostealer and backdoor. AUDIOFIX harvests Keychain contents, Chrome / Firefox / Safari credentials, SSH keys, AWS / GCP / Azure cloud-provider credentials, and credentials from 51 cryptocurrency-wallet browser extensions; persistence is a LaunchAgent plist under ~/Library/LaunchAgents. From the endpoint, JINX-0164 pivots into CI/CD infrastructure using stolen developer credentials and injects poisoned commits under legitimate developer identities; any team member building from the affected branches receives MINIRAT, a lightweight Go-based backdoor. The supply-chain escalation materialised through the @velora-dex/sdk npm package version 4.9.1 (trojanised 2026-04-07), which staged MINIRAT via LaunchCtl persistence. Wiz notes TTP overlap with prior DPRK-adjacent tradecraft (UNC1069, Sapphire Sleet) but stops short of formal attribution. The Hacker News writeup corroborates with additional MINIRAT detail. Mapped to T1566.003 (Spearphishing via Service: LinkedIn), T1543.001 (Launch Agent), T1555 (Credentials from Password Stores), T1195.002 (Compromise Software Supply Chain) and T1098.005 (Device Registration). For Swiss / EU SOCs the relevant exposure is Crypto Valley and any organisation whose developers build from npm dependencies that fan out to internal CI/CD — Sigstore signature verification, lock-file pinning of @velora-dex/sdk, and CI runner least-privilege are the operational asks.

WatchGuard documents Grandoreiro's Delphi-DLL-side-loading + WebSocket/STUN C2 against Portuguese & Spanish banks; ESET maps parallel Android BTMOB MaaS

WatchGuard's Secplicity team published telemetry on 2026-05-26 covering a sustained 2026 Grandoreiro banking-trojan campaign against banks in Portugal and Spain (and across Latin America). The campaign deploys Delphi-11-compiled DLLs through DLL side-loading against four abused legitimate signed binaries; the Grandoreiro core has been re-tooled to use the sgcWebSockets library for command-and-control, with STUN and ICE protocols enabling NAT traversal — C2 traffic visually blends with web-conferencing data and bypasses standard protocol-inspection rules. WatchGuard names Abanca, Banco de Portugal, BBVA PT, Caixa Geral Depositos, Santander, Revolut and Wise as targeted institutions. A parallel Latin American mobile-banking strand: ESET WeLiveSecurity documents BTMOB, an Android RAT (evolved from SpySolr) sold malware-as-a-service, documented by ESET as targeting users in Brazil and Argentina. BTMOB requests Accessibility Service permissions and uses them for full device takeover — HTML-injected overlay phishing, keylogging and on-demand screen recording. The Hacker News provides a combined writeup with the WatchGuard / ESET coverage.

4. Updates to Prior Coverage

UPDATE: The Gentlemen ransomware — Microsoft publishes full technical dissection of the Storm-2697 Go-encryptor

UPDATE (originally covered 2026-05-20; consolidated in weekly W21): Microsoft Threat Intelligence published a full dissection of The Gentlemen ransomware on 2026-05-28, giving Storm-2697 a much sharper technical profile than the victim-list reporting available in week 21. The encryptor is a single-binary Go executable (obfuscated through Garble to strip symbol tables), uses Curve25519 + XChaCha20 with per-file ephemeral keys (no bulk-decryption shortcut), and ships a self-propagation module that executes a series of lateral-movement techniques in parallel per host — PsExec, WMIC, scheduled tasks, services, PowerShell remoting — maximising the probability that at least one pivot path succeeds in any AD-joined environment.

Check Point Research's 2026-05-13 writeup adds the actor-side context that Microsoft's dissection does not — Check Point counts approximately 332 victim organisations on the operator's leak site, and documents that on Domain Admin compromise The Gentlemen deploys itself across the estate through a Group Policy Object linked at all relevant OUs. Huntress Labs' 2026-05-21 IR report corroborates the defense-evasion playbook: PowerShell disables Microsoft Defender real-time monitoring (Set-MpPreference -DisableRealtimeMonitoring), stops WinDefend, adds broad Add-MpPreference -ExclusionProcess and drive-level exclusions, disables Controlled Folder Access, and clears Security / System / Application event logs (EID 104, EID 1102). Huntress documented two April / May 2026 incidents whose entry vector was RDP with compromised credentials, lateral movement reached domain controllers via the NETLOGON share and SCCM's CcmExec.exe, and process names were masqueraded as svchost32.exe. The DFIR Report's 2026-05-11 alert confirmed a related chain in which EtherRAT (delivered via a malicious Sysinternals MSI) and TukTuk C2 preceded Gentleman deployment. Microsoft's Defender detection name is Ransom:Win64/Gentlemen.A; recommended Attack Surface Reduction posture per Microsoft's ASR rules reference is Block process creations originating from PsExec and WMI commands combined with EDR-in-block-mode enforcement.

Material new development vs. last coverage: full encryption + propagation mechanism, named-cluster identity (Storm-2697), the GPO-spread pathway documented by Check Point Research, and Check Point's count of approximately 332 victims. Detection focus: hunt for wevtutil cl Security|System|Application chained with sc stop WinDefend or msconfig; flag svchost32.exe spawned outside %SystemRoot%\System32; alert on CcmExec.exe launching non-SCCM payloads. Hardening: enforce SMB signing GPO, restrict GPO-creation rights to a hardened OU, enable Credential Guard, monitor Event ID 5136 for GPO modifications and 5140 for the hidden share SMB share.

5. Deep Dive — FortiClient EMS CVE-2026-35616 + EKZ Infostealer kill chain

Background. CVE-2026-35616 is the improper-access-control (CWE-284) flaw in Fortinet FortiClient EMS 7.4.5 and 7.4.6 disclosed on 2026-04-04 and added to the CISA KEV catalog on 2026-04-06; vendor coverage at disclosure focused on the auth-bypass primitive, with Arctic Wolf's 2026-05-27 publication being the first public exploitation-chain narrative tying the bypass to a downstream credential-theft payload (EKZ Infostealer). The vulnerability class — header-spoofing trust against a fronting reverse proxy — is the same shape as Microsoft's CVE-2026-45659 (separate product, same X-Forwarded-* trust pattern), and the EKZ delivery via the trusted EMS management channel is a defender-relevant escalation of the trusted-update-channel-as-supply-chain pattern previously associated with vendor-update vehicles.

Vulnerable component. The FortiClient EMS server's management API trusts the HTTP request header X-SSL-CLIENT-VERIFY to convey client-certificate validation state — the ProjectDiscovery Nuclei template for CVE-2026-35616 sends exactly that header with value SUCCESS as the entire exploit payload. The intended deployment model is that a fronting reverse proxy or load balancer performs the mutual-TLS handshake and stamps that header into the upstream request before forwarding to EMS. The server does not independently confirm that the negotiating peer presented a valid client certificate; it accepts the header as-is. An unauthenticated attacker on a network path to the EMS management plane spoofs X-SSL-CLIENT-VERIFY: SUCCESS and reaches privileged API endpoints without authenticating. CVSS:3.1 base 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). EPSS 43.2 % at the 97.6th percentile.

Exploitation prerequisites. Network reach to the EMS management API (typically over the management VLAN or, in misconfigured deployments, directly on the internet); a vulnerable EMS server version 7.4.5 or 7.4.6; no other authentication. AD-joined EMS, MFA-protected EMS console accounts, and other authentication controls applied to interactive logons are not in the request path the spoofed header bypasses.

Exploitation chain in the Arctic Wolf campaign. Mapped to MITRE ATT&CK throughout. Initial access: header-spoofing against EMS management API (T1190 Exploit Public-Facing Application). Persistence and distribution: attackers modify Remote Access Profile configurations through the now-privileged API endpoint to push an Update task to managed FortiClient endpoints — the malicious PowerShell payload is delivered through the EMS update channel under the trusted fortitray.exe parent process and is therefore signed in the operational sense (T1195.002 Compromise Software Supply Chain — EMS as distribution vector; T1218 System Binary Proxy Execution via the trusted FortiTray binary). The PowerShell payload fetches FortiEndpoint_Patch.exe, presented to operators and AV as a legitimate Fortinet patch — actually the EKZ Infostealer. Defense evasion: EKZ copies itself into per-browser profile directories under each user's AppData\Local\Google\Chrome\User Data\<profile>, AppData\Roaming\Mozilla\Firefox\Profiles\<profile> and equivalents for Microsoft Edge, LibreWolf, Waterfox, Pale Moon, Thunderbird, defeating elevation-validation checks that gate access to encrypted credential and cookie stores via nss3.dll (T1555.003 Credentials from Web Browsers). Collection and exfiltration: encrypted credential stores and session cookies dumped, then exfiltrated via HTTP POST to actor infrastructure (T1071.001, T1041). The single-server-to-fleet cascade is the campaign's defining property: one compromised EMS server simultaneously distributes EKZ to every managed endpoint in the deployment.

Affected and patched versions. Affected: FortiClient EMS 7.4.5 and 7.4.6 — only those two builds; earlier branches and 7.4.7+ are not vulnerable. Patched: FortiClient EMS 7.4.7. The Fortinet PSIRT FG-IR-26-099 advisory carries the vendor's complete affected-version matrix and the out-of-band hotfix references for organisations that cannot move to 7.4.7 in their change window.

Detection concepts. None of these require IOC sharing — they are behavioural patterns against the campaign's mechanics.

  • EMS management-API access without proper mTLS handshake. Where the EMS server logs X-SSL-CLIENT-VERIFY along with peer-certificate fingerprint, alert on any request carrying SUCCESS with no fingerprint or a fingerprint not from the operator-trusted CA. Where the reverse proxy in front of EMS logs the mTLS state, alert on EMS log records claiming success that do not correspond to a proxy log line with a matched negotiation.
  • Unsolicited Remote Access Profile modification. Alert on any modification to RAP / endpoint-policy XML or its API equivalents that was not initiated from an EMS admin console session in the change-management window.
  • Push-from-EMS installers that are unsigned or have anomalous filenames. EMS-pushed installers that are neither FortiClientSetup_*.exe nor a vendor-signed update should never reach a managed endpoint; alert on Sysmon EID 1 where parent process is the FortiClient managed-service binary and child is an unsigned binary with --silent install flags. The fake FortiEndpoint_Patch.exe name from this campaign deviates from the genuine FortiClientSetup_*.exe naming convention.
  • Browser-profile-directory writes from non-browser processes. Sysmon EID 11 (FileCreate) targeting AppData\Local\Google\Chrome\User Data\<profile> (and equivalents), where the source image is not the browser binary itself, the parent process is not a known package manager, and the file extension is .exe / .dll. This is the EKZ self-copy primitive.
  • fortitray.exe spawning PowerShell with -EncodedCommand / -enc. PowerShell -enc from a Fortinet trusted-binary parent process is the in-campaign behaviour Arctic Wolf documents and is not expected operationally.
  • Outbound HTTP POST from an EMS-service account to non-Fortinet endpoints. Easy network-layer signal on egress firewall / SWG logs.

Hardening. Patch is the only complete remediation. Immediately upgrade FortiClient EMS to 7.4.7. While the change window is being scheduled, compensating controls: (1) block EMS management API ports from the internet completely, restricting access to a defined management network; (2) enforce mTLS termination at the proxy and have the proxy strip / overwrite the X-SSL-CLIENT-VERIFY header before forwarding to EMS, removing the spoof primitive entirely; (3) require admin-access MFA for the EMS console and rotate EMS service-account credentials post-patch; (4) audit all RAP / endpoint-policy XML against a known-good baseline. Post-incident: assume managed endpoints in any environment running 7.4.5 / 7.4.6 may have received EKZ; rotate cached browser credentials for sensitive accounts and treat session cookies in managed-endpoint browser stores as compromised.

6. Action Items

  • Upgrade Fortinet FortiClient EMS 7.4.5 / 7.4.6 → 7.4.7 immediately and assume managed-endpoint compromise where the patch lagged. Active ITW exploitation delivers EKZ Infostealer through the trusted EMS update channel. Apply Fortinet PSIRT FG-IR-26-099 per § 5 above; have the fronting reverse proxy strip / overwrite X-SSL-CLIENT-VERIFY before forwarding to EMS as a defence-in-depth control. Rotate cached browser credentials and treat managed-endpoint session cookies as compromised wherever EMS ran 7.4.5/7.4.6 unpatched.

  • Patch Samba to 4.22.10 / 4.23.8 / 4.24.3 on every Linux file / member server; AD DCs are unaffected. Compensating mitigation if the upgrade slips: remove %u from any check password script, wrap %J in single quotes inside print command, and set rpc start on demand helpers = yes (default). Two CVSS 10.0 unauthenticated RCEs make this an immediate change-window candidate.

  • Patch Portainer CE to 2.33.8 / 2.39.2 / 2.41.0 and revoke Docker / Swarm endpoint access for non-admin users in the interim. CCB Belgium's Patch Immediately warning targets exactly the deployment shape — non-admin users with endpoint access can reach the unguarded plugin endpoints and Swarm-service API and escalate to host code execution.

  • Upgrade SUSE Rancher to 2.10.12 / 2.11.14 / 2.12.10 / 2.13.6 / 2.14.2 and audit GitHub-App authentication / project-owner RBAC. Three concurrent paths to host code execution or cluster-admin escalation; the GitHub-App over-inclusive team membership in particular can be quietly abused.

  • Patch IBM HTTP Server / WebSphere via APAR PH71265; disable mod_ibm_upload and mod_mem_cache where unused. Pre-auth RCE at CVSS 9.8 on a middleware widely deployed in Swiss banking, insurance and federal IT — NCSC.ch flagged the advisory specifically for CH consumers.

  • Mitigate the unpatched Gogs RCE on every self-hosted instance. Set DISABLE_REGISTRATION = true in app.ini, disable Rebase before merging under instance settings, and consider migration to Gitea / Forgejo. Hunt for git invocations with --exec whose parent is the Gogs binary (Sysmon EID 1 / auditd EXECVE).

  • Hunt for The Gentlemen kill-chain artefacts across the AD estate. Look for wevtutil cl Security|System|Application chained with sc stop WinDefend or msconfig; svchost32.exe spawned outside %SystemRoot%\System32; CcmExec.exe launching non-SCCM payloads; GPO modifications (Event ID 5136) and the hidden SMB share mount (Event ID 5140). Enable the Block process creations originating from PsExec and WMI commands ASR rule per Microsoft's ASR rules reference and run EDR in block mode where possible.

  • Upgrade Apereo CAS to the fixed version 7.3.7.1 on any deployment configured as an OIDC IdP, even with technical detail withheld. CH-discovered (Coop Switzerland reporter) and CERT-FR-flagged; until detail is public, monitor OIDC token issuance logs for tokens to unregistered clients and anomalous sub claim values.

  • Patch GitLab to 19.0.1 / 18.11.4 / 18.10.7 and Veeam B&R / Agent to 13.0.2.29 within the next change window. Highest-severity GitLab issue is the Duo AI identity-impersonation flaw; Veeam's Linux-appliance arbitrary file write is constrained to Backup Administrator role but a viable stepping stone to RCE. Review Veeam backup-administrator least-privilege at the same time.

  • Refresh residential-proxy detection logic post-Asocks takedown. Asocks joins a recent sequence of disrupted networks (SocksEscort, Aisuru/Kimwolf, FirstVPN, IPIDEA, RapperBot per Risky Bulletin); retune CGNAT / consumer-ISP-RDNS correlation rules on M365 / Entra ID sign-in logs and on VPN concentrator authentication.

7. Verification Notes

  • Items dropped (already-covered, duplicate of in-window prior coverage):
    • Tycoon 2FA AiTM detection-engineering analysis (Elastic Security Labs, 2026-05-26) — surfaced by S3 as a candidate, but the same Elastic Security Labs piece and the same eSentire OAuth-Device-Code corroboration were already the substance of the deep dive in 2026-05-27 and of the original Tycoon 2FA deep dive in 2026-05-18. No material new development in window. Drop per PD-8.
  • Single-source items kept: none kept as [SINGLE-SOURCE] in published items this run — both Apereo CAS (Apereo + CERT-FR) and the FortiClient / EKZ campaign (Arctic Wolf + Fortinet PSIRT + The Hacker News + NVD) cleared two-source verification.
  • Items dropped (low signal-to-noise for this audience):
    • BTMOB Android RAT (ESET, 2026-05-26) — surfaced by S1 as SINGLE-SOURCE; folded into the § 3 Grandoreiro item as a corroborating Iberian-banking parallel rather than promoted to its own H3. ESET + WatchGuard via § 3 supply the two-source view.
  • Reduced confidence: Apereo CAS patch version 7.3.7.1 carries MEDIUM confidence on technical impact because Apereo withheld full detail pending the security grace window. Tracked for follow-up.
  • CVEs that did not clear § 2 inclusion gates (no exploitation, no PoC, no KEV, no pre-auth RCE on internet-exposed software): the lower-severity GitLab batch CVEs (CVE-2026-1402, CVE-2026-2601, CVE-2026-5296, CVE-2026-8716) are documented inside the parent GitLab item but did not warrant their own H3.
  • Contradictions surfaced:
    • Gogs zero-day CVE id: S1 documented no CVE assigned at publication, while S3 referenced CVE-2026-26194. Rapid7's blog post is unambiguous that the maintainer has not responded and no patch exists; the CVE-id claim from S3 could not be re-verified against an authoritative NVD entry in this run. The brief is written conservatively without the CVE id; verification of CVE-2026-26194 is deferred to the next run.
    • GitLab patch-release CVE count: the § 2 GitLab item summarises six CVEs (CVE-2026-4868, -6713, -1402, -2601, -5296, -8716) — the GitLab patch-release page enumerates seven (an additional CVE-2026-2710 is listed inline). Brief should be read as covering the six highest-severity / most defender-relevant items in the bundle; CVE-2026-2710 details are left to the vendor page until next-run re-pivot.
    • Carnival breach date: the Maine AG filing records the breach as occurring 2026-04-10 with discovery on 2026-04-14, while Carnival's PR Newswire substitute notice describes 2026-04-14 as the day the security team identified unauthorized activity. The brief reports both dates with the breach-vs-discovery distinction surfaced in body text rather than picking one.
  • Sub-agents: all four returned within budget. S1 Sonnet 4.6 (684 s, 22 webfetch / 9 websearch / 14 bridge), S2 Sonnet 4.6 (348 s, 18 / 12 / 10), S3 Sonnet 4.6 (771 s, 12 / 4 / 18), S4 Sonnet 4.6 (753 s, 17 / 22 / 6). No stalled agents.
  • Verification (Phase 5.7): four iterations (Opus → Sonnet → Opus → Sonnet). Iter 1 NEEDS_FIXES (truth=6, editorial=4, advisory=2) → iter 2 NEEDS_FIXES (1, 2, 0) → iter 3 NEEDS_FIXES (3, 1, 2) → iter 4 NEEDS_FIXES (1, 0, 0). Iter 4 was published via the v2.50 early-exit rule (truth+editorial ≤ 2 AND no F1/F4); the iter 4 finding ("Check Point count: brief said more than 332, source says approximately 332") was applied as a best-effort remediation in-place but the iteration's NEEDS_FIXES verdict stands. verification_residual_count = 1.
  • Coverage gaps: databreaches-net (transport 403, no Wayback snapshot — Carnival breach covered via PR Newswire + The Record + The Register); sophos-xops (HTTP 503 on feed); inside-it-ch (HTTP 403 even via bridge); dragos, shadowserver, sekoia, volexity, greynoise (feeds returned 404 — likely upstream feed-URL drift, candidate for source-list review next run); cert-at, csirt-acn-it (not enumerated in this run); SEC EDGAR Item 1.05 (0 hits in window — Carnival filed substitute notice via PR Newswire and state AGs, not 8-K); CNIL-FR, EDPB, ICO-UK (no in-window enforcement actions); cisa-directives, tenable-research, cisco-psirt, greynoise (quiet in window). Inside-IT.ch's persistent 403 pattern is now the 4th run in 7 — candidate for the next source-list review.