ctipilot.ch

CTI Daily Brief — 2026-06-19

Typedaily
Date2026-06-19
GeneratorAnthropic Claude (specific model not determined)
ClassificationTLP:CLEAR
LanguageEnglish
Promptv2.60
Items11
CVEs13
On this page

On this page

Tags (25)
Regions (5)
References (30)

0. TL;DR

  • A dense critical-patch cycle landed in widely-deployed CH/EU public-sector infrastructure within 36 h: Cisco ISE, pgAdmin 4, NGINX, and Drupal core. The standout is the Cisco ISE pair (Cisco PSIRT, 2026-06-17): an unauthenticated attacker can read hashed administrator credentials (CVE-2026-20190), then reuse them to reach an authenticated path-traversal command-execution flaw that escalates to root (CVE-2026-20181, CVSS 9.1) — no workaround, and ISE 3.5's full fix slips to August. No in-the-wild exploitation is reported for any of these four advisories.
  • pgAdmin 4 ships an unauthenticated pickle.loads() RCE primitive and an AI-Assistant read-only-transaction bypass (CVE-2026-12046 / CVE-2026-12045, CVSS 9.5 / 9.4), patched in v9.16 (pgAdmin, 2026-06-18).
  • Law enforcement extended Operation Endgame to SocGholish/TA569, taking down 106 C2 servers and stripping the FakeUpdates loader from 14,971 compromised WordPress sites in a Dutch-led, Europol-coordinated action (Politie, 2026-06-18).
  • The Icarus extortion group turned a dormant credential at SaaS vendor Klue into bulk Salesforce CRM theft across its customers, harvesting stored OAuth tokens and querying each victim's Salesforce REST API for ~24 h before detection — Huntress self-disclosed as a victim (ReliaQuest, 2026-06-17).
  • ESET detailed GentleKiller, an operator-maintained EDR-killer framework run centrally by the Gentlemen RaaS gang — eight BYOVD driver variants against 400+ security processes across 48 product families, with confirmed Western-European targeting (ESET, 2026-06-18). Microsoft's Defender LPE zero-day from the Nightmare Eclipse wave now carries a CVE (CVE-2026-50656) with a public PoC and no patch.

3. Research & Investigative Reporting

ESET: the Gentlemen RaaS gang centrally builds and maintains its affiliates' EDR-killer framework

ESET's months-long investigation into the Gentlemen ransomware-as-a-service operation reveals a structural departure from the affiliate norm: rather than each affiliate sourcing its own evasion tooling, the operators build, maintain and distribute a modular EDR-killing framework — GentleKiller — centrally (ESET, 2026-06-18; Help Net Security, 2026-06-18). GentleKiller comprises at least eight variants, each abusing a different legitimately-signed driver via BYOVD (T1543.003), targeting 400+ named security processes mapped to 48 EDR/AV/XDR product families. The defining operational pattern is speed: ESET documents the gang operationalising newly disclosed BYOVD proof-of-concepts within days of public release, and in one case wielding a Huawei-audio-driver kill technique before its public disclosure — ESET telemetry shows the gang using it since at least 2026-01-23, weeks ahead of the technique's public write-up (by Huntress) on 2026-03-19. Common evasion across variants includes Enigma/Themida packing and invalid copies of digital certificates impersonating major AV vendors; a Rust-based credential stealer (OxideHarvest) handles browser-credential theft. The gang reached top-5 most-active RaaS in Q1 2026, offers affiliates a 90% cut, and shows globally distributed victimology including Western Europe — a profile overlapping Swiss critical-sector exposure. Why it matters to us: an operator-curated EDR-killer means affiliates of even modest skill get current BYOVD capability on day one of a PoC. Enable the Microsoft Vulnerable Driver Blocklist (HVCI) and enforce WDAC driver allowlisting; hunt for service creation loading unexpected kernel drivers and DeviceIoControl calls from non-security processes, plus process-termination loops targeting security software (Sysmon EID 6 / kernel-callback telemetry).

Sophos X-Ops: underground AI adoption is cautious but concrete — LLM-assisted packers, LLM C2 orchestration, NLP-triaged leak markets [SINGLE-SOURCE]

Sophos Counter Threat Unit's underground-forum monitoring paints a nuanced picture of criminal AI adoption rather than the hype-or-nothing framing common elsewhere (Sophos X-Ops, 2026-06-17). Concrete operational uses they observed: an open-source polymorphic PE packer (PolyEngine) that uses an LLM for code refinement to defeat static detection; a modified Cobalt Strike build integrating an LLM via an MCP interface for C2 orchestration; a stolen-data exchange ("Leak Bazaar") applying NLP to auto-triage and categorise stolen datasets for buyers; and advertised AI voice-bots for vishing. At the same time, scepticism persists among skilled actors who doubt practical gains and fear AI will erode the market rate for manual services. [SINGLE-SOURCE] — the specific forum-actor claims derive solely from Sophos CTU's own monitoring and cannot be independently corroborated, though the broader trend is consistent with multiple concurrent reports. Why it matters to us: the defender-relevant signal is that AI-assisted packing and obfuscation are weakening static signature matching faster, and AI-quality language lowers the cost and raises the success rate of vishing. Supplement signature-only detection with behavioural controls and update social-engineering awareness training to assume fluent, localised lures.

4. Updates to Prior Coverage

UPDATE: Nightmare/Chaotic Eclipse zero-day wave — the Defender LPE now carries a CVE, a public PoC, and Microsoft's "Exploitation More Likely" rating, with no patch

UPDATE (originally covered in the 2026-W24 weekly summary): The serialised Windows zero-day campaign tracked as Nightmare/Chaotic Eclipse has a new, formally-identified entry: RoguePlanet, the local elevation-of-privilege flaw in the Microsoft Malware Protection Engine (mpengine.dll, used by Defender on all supported Windows 10/11), is now assigned CVE-2026-50656, acknowledged by Microsoft, and rated Exploitation More Likely on the MSRC Exploitability Index (Microsoft MSRC, 2026-06-16; Help Net Security, 2026-06-17).

The exploit abuses a TOCTOU race: during a scan Defender resolves a file path and later reopens it for analysis, and the PoC swaps in a malicious file in that window to obtain a SYSTEM shell. It requires only local low-privilege access, needs no user interaction, and the researcher states it functions regardless of whether real-time protection is enabled — though the race makes it non-deterministic ("hit or miss") (The Hacker News, 2026-06-17). As of 2026-06-18 Microsoft states a fix is in development with no timeline; the public PoC is the in-window delta.

5. Deep Dive — Cisco ISE CVE-2026-20181 + CVE-2026-20190: an unauthenticated credential-harvest primitive feeding authenticated root code execution on the identity plane

Cisco Identity Services Engine is not just another exposed appliance — it is the policy brain of network access control in most large Swiss and European public-sector estates: the RADIUS/TACACS+ server behind 802.1X port authentication, the posture/profiling engine, and frequently the AD/identity-policy enforcement point for both wired and wireless. A root shell on an ISE node is therefore not an endpoint compromise; it is control of the authentication plane that decides which devices and users get onto the network. That is what makes the pair Cisco patched on 2026-06-17 worth a deep read even with no in-the-wild exploitation yet reported (Cisco PSIRT, 2026-06-17).

The two primitives. CVE-2026-20190 (CVSS 7.5, improper authorization) is the entry primitive: specific ISE/ISE-PIC APIs fail to enforce authorization, so an unauthenticated remote attacker who can reach the management interface over HTTP can read sensitive data — explicitly including hashed administrator credentials — with crafted requests (T1190 Exploit Public-Facing Application → T1212 Exploitation for Credential Access). CVE-2026-20181 (CVSS 9.1, path traversal / CWE-22) is the impact primitive: an authenticated administrator can submit a crafted request that escapes the intended directory and executes arbitrary operating-system commands, escalating to root; on single-node deployments the same flaw can also be driven to a denial-of-service (SecurityWeek, 2026-06-18).

Why the chain matters more than either CVE. On its own, CVE-2026-20181 requires administrator authentication — a meaningful barrier. CVE-2026-20190 removes that barrier: it hands an unauthenticated attacker the hashed admin credentials, which can then be cracked offline (T1110.002 Password Cracking) or, depending on the credential material and authentication scheme, replayed (T1550 Use Alternate Authentication Material). With administrator authentication in hand (T1078 Valid Accounts), the attacker pivots to CVE-2026-20181 for command execution as root (T1059 Command and Scripting Interpreter → T1068 Exploitation for Privilege Escalation). The net effect is a network-reachable, no-interactive-credential path from "can talk to the ISE management plane" to "root on the identity controller." From root on ISE, an adversary is positioned to tamper with authentication and authorization policy itself (T1556 Modify Authentication Process) — issuing or trusting RADIUS responses, weakening 802.1X enforcement, or harvesting credentials traversing the policy engine.

Exposure and prerequisites. The only hard prerequisite for the entry primitive is network reachability of the ISE management/API interface; everything after that is consequence. Cisco states there is no workaround. Affected trains are fixed in ISE 3.3 Patch 11 and 3.4 Patch 6 (both available now). ISE 3.5 is the gap: Patch 3 closes only the unauthenticated read (CVE-2026-20190), and the full fix (Patch 4) is not scheduled until August 2026 — so 3.5 operators carry the authenticated-RCE half for roughly two months and must compensate with exposure reduction.

Hunt and detection concepts. Because there is no public exploit detail yet, detection here is behavioural and access-surface-oriented, not signature-based:

  • Management-plane reachability is the first control: alert on any source outside your defined administration subnets reaching the ISE management/API interface at all. The unauthenticated read only works if the attacker can reach those APIs.
  • API-access anomalies: review ISE application/admin logs for unauthenticated or unexpected requests to the credential-adjacent API endpoints, and for ERS/API request patterns from newly-seen source addresses.
  • Administrator-session anomalies: correlate any administrator CLI/command activity with the set of source addresses and accounts you expect to perform it; a successful chain shows up as admin-context command execution from an unusual origin shortly after anomalous unauthenticated API reads.
  • Identity-plane integrity: baseline expected RADIUS/TACACS+ behaviour and alert on policy or device-admin changes that did not originate from your change process — post-compromise tampering is the high-impact outcome to catch even if the intrusion itself was missed.

Hardening / mitigation (cite Cisco's own guidance). Apply the fixed patches as the only complete remediation: ISE 3.3 Patch 11 or 3.4 Patch 6 now; for 3.5, apply Patch 3 immediately to remove the unauthenticated credential read and plan the August Patch 4 upgrade. Independently of patch state, restrict the ISE management and API interfaces to dedicated, tightly-firewalled administration subnets (out-of-band management VLAN), enforce strong administrator credentials and MFA on admin logon to blunt the offline-cracking step, and monitor the management plane as a tier-0 asset. Treat ISE, like AD and the PKI, as identity infrastructure whose compromise is a full-network event — segment and instrument it accordingly.

6. Action Items

  • Patch Cisco ISE now and lock the management plane to admin subnets (§ 2, § 5). Apply ISE 3.3 Patch 11 or 3.4 Patch 6; for ISE 3.5 apply Patch 3 immediately to close the unauthenticated credential read (CVE-2026-20190) and plan the August Patch 4 for CVE-2026-20181. There is no workaround — restrict the management/API interface to an out-of-band admin subnet, enforce MFA on admin logon, and alert on any off-subnet source reaching the ISE APIs.
  • Upgrade pgAdmin 4 to v9.16 and restrict server-mode exposure (§ 2). Until patched, keep the server-mode interface off untrusted networks, disable the AI Assistant, and rotate the Flask SECRET_KEY; review server logs for unauthenticated requests to /sqleditor/close/ and the update_connection endpoint.
  • Update NGINX to 1.31.2+ (1.30.3 stable) / Plus R36 P6 / 37.0.2.1 / Gateway Fabric 2.6.4 (§ 2). As interim mitigation remove quic from listen directives to disable HTTP/3 (CVE-2026-42530) and confirm ignore_invalid_headers is at its default on (CVE-2026-42055).
  • Patch Drupal core to 10.5.12 / 10.6.11 / 11.2.14 / 11.3.12 (§ 2). On sites that cannot update immediately, disable JSON:API write access and configure trusted host patterns to blunt the object-injection chain (CVE-2026-55803/55804) and the rebuild.php host-header issue.
  • Hunt for SocGholish stage-1 and harden any WordPress estate you run (§ 1). Alert on wscript.exe/mshta.exe spawned from a browser process and on browser-initiated .zip downloads from WordPress hosts; audit wp-admin credentials and theme-file integrity. The takedown removes infrastructure, not the technique.
  • Audit Salesforce Connected-App OAuth grants and stream Event Monitoring to your SIEM (§ 1, Icarus/Klue). Revoke dormant/prototype third-party integrations, enforce short token TTLs and IP-range restrictions, and alert on SObject enumeration and bulk SOQL from integration users.
  • Enable HVCI / Microsoft Vulnerable Driver Blocklist and WDAC driver allowlisting (§ 3, GentleKiller). Hunt for service creation loading unexpected kernel drivers, DeviceIoControl from non-security processes, and process-termination loops against security tooling.
  • Compensate for the unpatched Defender LPE (CVE-2026-50656) (§ 4). No patch exists — monitor for MsMpEng.exe spawning cmd.exe/powershell.exe as SYSTEM (Sysmon EID 1 parent-image filter, WEL 4688) and constrain which low-privilege accounts can trigger on-demand scans.
  • Block the removable-media worm vector (§ 1, CryptoBandits). Enforce NoAutorun/NoDriveTypeAutorun, block LNK execution from removable media via ASR, restrict wscript.exe/cscript.exe to signed scripts, and block Tor egress (localhost:9050 SOCKS5 from non-Tor processes).

7. Verification Notes

  • Items dropped (relevance / less-is-more): Kaspersky — malicious Steam Workshop "application wallpapers" distributing DarkComet/Lumma/Vidar (S3): consumer/gaming exposure, no public-sector nexus, single-source — below the daily bar. Nintendo employee data via the TinyPulse/WebMD breach (S4): single-source (BleepingComputer), technology/entertainment sector; the third-party-HR-SaaS lesson is already carried more richly by the Icarus/Klue item. "Popa"/Vo1d residential-proxy botnet on Android TV boxes (S3, Krebs): only the Krebs primary was actually fetched this run; the Synthient corroboration URL was listed but not verified in the URL-liveness ledger, leaving the item effectively single-source, and its relevance to a public-sector SOC is marginal — dropped rather than cite an unfetched URL.
  • Items dropped (out of recency window, window_hours=36): EvilTokens device-code phishing-as-a-service (S3): although Switzerland is explicitly listed in the victim geography, the freshest fetched source is the ESET write-up of 2026-06-15 and the substantive primary (Sekoia) is from March 2026 — both outside the 36 h window with no fresh in-window development. Will resurface as an UPDATE if a fresh delta appears.
  • Items dropped (already covered, no material delta): DragonForce Backdoor.Turn Microsoft Teams TURN-relay C2 + five-driver BYOVD (S3): this was the 2026-06-17 deep dive; the Symantec analysis re-surfaced via aggregators on 2026-06-18 but carries no new development.
  • Broken-link remediation (verification iterations 1–2): seven cited URLs were 404 wrong-slug or redirect-to-homepage at compose time and were replaced with re-fetched live equivalents, or dropped: Politie and Proofpoint (Operation Endgame), ReliaQuest and BleepingComputer (Icarus/Klue — BleepingComputer dropped as its replacement could not be content-confirmed), The Record (ICO — replaced with the ICO's own regulator-primary statement, fetched via the bridge after the routine UA 403'd), Help Net Security (GentleKiller — corrected slug), and CCB Belgium (pgAdmin — the original advisory path 301-redirects to the CCB homepage, and the same-titled advisory at the new canonical path is in fact a stale 2025 CCB advisory for older pgAdmin CVEs, so the CCB citation was dropped entirely). The underlying facts were independently corroborated in every case.
  • pgAdmin sourcing note: the pgAdmin 4 § 2 item's primary is the project's own v9.16 coordinated-disclosure release notes (authoritative for the CVEs, prerequisites and fixed versions); the CCB Belgium corroborator was dropped after it resolved to a stale 2025 advisory, and because the release notes publish no CVSS, the CVSS v4 9.5/9.4/9.3 figures are sourced from and cited to ENISA EUVD (EUVD-2026-37966 / -37965 / -37968) as the additional source.
  • Single-source items (included, flagged inline): Sophos X-Ops — AI adoption in the underground (§ 3) rests solely on Sophos Counter Threat Unit's own forum monitoring (HIGH-reliability vendor research); the named open-source tooling is publicly verifiable but the specific forum-actor claims cannot be independently corroborated.
  • Contradiction (resolved): S1 read CVE-2026-20190 as CVSS 7.5 (improper authorization / unauthenticated data read) while S2 reported 9.1 for the same CVE. Cisco groups both ISE CVEs under one advisory (cisco-sa-ise-multi-G5WP8vv); the brief uses the per-CVE breakdown CVE-2026-20181 = 9.1 (authenticated root command execution) and CVE-2026-20190 = 7.5 (unauthenticated read), which matches the more granular sub-agent read and Cisco's separation of the two flaws. Verify against the linked Cisco advisory before acting if the exact score is operationally load-bearing.
  • § 2 inclusion note (Drupal): the lead CVE-2026-55803 requires authenticated JSON:API write permission plus a non-default serialized field type, and no in-the-wild exploitation or public PoC is reported — so it does not clear the § 2 active-exploitation/PoC gates on exploitation maturity. It is included on the basis of BSI's kritisch aggregate rating and Drupal's heavy Swiss/EU government-CMS footprint, framed as a patch-prioritisation item rather than an imminent-exploitation one.
  • No Immediate Action callout: all four critical advisories this run (Cisco ISE, pgAdmin, NGINX, Drupal) lack confirmed in-the-wild exploitation or a public working PoC against internet-exposed deployments, and the Defender LPE (CVE-2026-50656) is a local-access elevation, not a "stop-everything" internet-facing pre-auth RCE. None meets the callout bar.
  • Coverage gaps: inside-it-ch (Cloudflare Managed Challenge 403, no usable Wayback snapshot — gap in 7+ consecutive runs, rotation-priority); databreaches-net (transport-403, no Wayback snapshot); csirt-acn-it (SPA, no structured advisory endpoint reachable); edpb (TLS/connection timeout); cnil-fr (no in-window items); sec-disclosures-edgar (zero Item 1.05 8-K filings in the window — genuinely empty); cert-pl (SPA, no RSS); anssi-fr (most recent CERT-FR avis 2026-06-12, out of window); vulncheck (RSS endpoint 404); dragos, dfirreport (no new in-window OT/DFIR content); chrome-releases (RSS 302 redirect).