CTI Daily Brief — 2026-06-26

• Mandiant reconstructs a months-long zero-day compromise of Cisco Catalyst SD-WAN Manager (CVE-2026-20245) — updating our 6 June coverage, GTIG details an authenticated request tenant-upload CLI command-injection path that planted a troot UID-0 account on the controller, reached after a peering-auth-bypass foothold and exploited at a service provider from late 2025 through March 2026, well before the patch (Mandiant/GTIG, 2026-06-24). Today's deep dive (§5). Patch to the fixed trains immediately and audit vManage hosts for OS-level account creation.
• macOS.Gaslight — a DPRK-aligned Rust backdoor that aims its evasion at the analyst, not the sandbox — SentinelLABS documents a 3.5 KB blob of 38 fabricated "system" messages embedded to derail LLM-assisted triage, alongside Telegram Bot-API C2 and a com.apple.system.services.activity LaunchAgent (SentinelLABS, 2026-06-23).
• ShinyHunters breached Madison Square Garden through a single vishing call into the company's identity platform — 404 Media's review of the stolen data confirms a low-level employee was talked into letting the operators into MSG's systems, the same vishing → identity-platform (Entra/Okta) → MFA-enrollment kill chain that works equally well against EU public-sector tenants (404 Media, 2026-06-24).
• ESET's 2025 Gamaredon paper shows the FSB group's exfil and C2 moving entirely onto trusted cloud services — S3-compatible object storage (Wasabi/Tebi/Intercolo) via rclone and Cloudflare-tunnel/Workers/DevTunnel C2 that blends with legitimate egress; targeting stayed exclusively Ukrainian, but the tradecraft is the transferable part (ESET, 2026-06-25).

No newly-disclosed qualifying vulnerability in window — section intentionally left empty. The window's significant vulnerability development is a material update to previously-covered CVE-2026-20245 (Cisco SD-WAN Manager), handled as an update in §4 with the full forensic kill chain in §5. GitLab's 19.1.1 patch set and the Ubiquiti UniFi OS KEV deadline were assessed and did not clear an inclusion gate — see §7.

Mandiant's Google Threat Intelligence Group published a forensic reconstruction of an intrusion in which Cisco Catalyst SD-WAN Manager (formerly vManage) was compromised through CVE-2026-20245 as a zero-day — exploited at a communications service provider from late 2025 through March 2026, months before Cisco's advisory (Mandiant/GTIG, 2026-06-24). Mandiant attributes the activity to no named actor. The reason this matters beyond one victim: SD-WAN Manager is the control plane for an entire WAN fabric — root on the controller is push-access to every managed edge device — so it warrants the same monitoring tier as a VPN concentrator or firewall, and it is now one of several Cisco SD-WAN flaws confirmed exploited during 2026.

The vulnerability. CVE-2026-20245 (CVSS 7.8, no workaround) is a command-injection weakness in the SD-WAN Manager CLI tenant-upload handler: the feature that ingests a tenant-list CSV fails to sanitise file content before it reaches a shell context, so an authenticated operator can embed OS commands inside a crafted CSV and have them execute as root on the underlying Linux host (Cisco PSIRT, cisco-sa-sdwan-privesc-4uxFrdzx). The injected commands appended a new UID-0 account (troot) to the host's local account databases, giving the actor a persistent root login independent of the vManage application's own user model.

Kill chain (as Mandiant documents it):

• Initial access — the actor reached an authenticated position by abusing peering-authentication-bypass flaws CVE-2026-20127 / CVE-2026-20182 to enrol unauthorised peering and obtain SSH as the vmanage-admin account, or alternatively by using certificate material stolen in a previous compromise (T1190, T1078.004).
• Privilege escalation — exploitation of CVE-2026-20245 via the crafted tenant CSV, executing as root (T1068).
• Persistence — creation of the troot UID-0 account in the host account databases, reachable via su (T1136.001).
• Defense evasion / anti-forensics — the actor changed the legitimate admin password and then reverted it to its original value to reduce detection probability, and deleted command history, syslog entries, and the uploaded files after use (T1070.003).

Hunt and detection concepts. The decisive gap is that vManage's own health dashboards do not surface OS-level account creation — detection has to happen on the underlying host. Baseline and monitor /etc/passwd and /etc/shadow for accounts added since a known-good snapshot (a UID-0 account other than root is the high-fidelity signal here). Review SD-WAN Manager audit logs for tenant-upload CLI/API invocations and correlate them with subsequent privileged shell activity; alert on child processes spawned by the tenant-upload service, and on shell-history truncation or gaps on the controller host. Because the actor reverted the admin password, an unexplained password-change-then-revert pair in admin account auditing is itself worth investigating.

Hardening. Upgrade to a fixed train — 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, or 26.1.1.2 — as there is no workaround. Restrict which operators hold privileged CLI roles, place the management/northbound interfaces behind a source-IP ACL rather than exposing them broadly, enforce MFA on all administrator accounts, and rotate SD-WAN admin credentials (including the default vmanage-admin) on any controller that may have been exposed before patching. Cisco's Catalyst SD-WAN Hardening Guide carries the vendor's own configuration baseline.

• Patch Cisco Catalyst SD-WAN Manager now to a fixed train (20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, or 26.1.1.2) — pre-disclosure root exploitation is confirmed and there is no workaround. On any controller potentially exposed before patching, baseline /etc/passwd//etc/shadow for non-root UID-0 accounts, review tenant-upload audit logs, and rotate admin credentials including default vmanage-admin. See §4 and §5.
• Hunt the vishing → Entra kill chain. Alert on new MFA-method registration events in Entra audit logs correlated with anomalous sign-in geo/user-agent and post-enrollment impossible-travel risk events; move privileged and helpdesk-reachable identities to phishing-resistant FIDO2/passkey MFA and require a compliant device for MFA enrollment via Conditional Access. See §1.
• Add detection for trusted-service abuse in exfil/C2. Flag tunnel-service egress (trycloudflare.com / workers.dev / devtunnels.ms) from Office or scripting processes, and rclone/S3-API PUT/POST from hosts with no backup role — the Gamaredon model that any espionage operator can copy. See §3.
• Treat LLM triage verdicts as provisional on submitted macOS samples. Until human review, do not trust an automated "benign" verdict on a macOS binary, and hunt LaunchAgents under com.apple.system.services.* signed by non-Apple identities. See §3.