Zscaler ThreatLabz
zscaler-threatlabz · B · active
https://www.zscaler.com/blogs/security-research
2026-07-26 weekly quality audit: ADDED as candidate (this run's one new candidate): a major vendor research lab that was absent from the research slice entirely, the coverage re-sweep found its in-window TELESHIM/MIXEDKEY/BINDCLOAK government-espionage toolkit analysis (2026-07-20) had no curated discovery path. Government-sector targeting and DLL-sideload/environmental-keying tradecraft are squarely in scope. Promote to active after 3 contributing runs. | 2026-07-27 intel run: PROMOTED candidate -> active. tools/run_summary.py reported it in sources.promotion_due with 3 contributing runs (most recent 2026-07-26T2309Z-weekly), meeting the three-contributing-run bar. | 2026-09-30 intel run: dated ThreatLabz feed (newest 2026-09-25); the /blogs/security-research listing shows only marketing posts. | 2026-10-18 (S3): the feed https://www.zscaler.com/blogs/feeds/security-research surfaced the NetScaler exploitation post; `extract` reads the article.
Cited in 4 entries
Citation cadence
Citation days per ISO week (15 weeks of coverage span, total 4).
- CVE-2026-88771 / CVE-2026-88772, Citrix NetScaler ADC and Gateway: unauthenticated pre-auth RCE zero-days exploited before a patch existed (CVSS 4.0 9.5)2026-09-28
- TraderTraitor (Jade Sleet) backdoors resurface on a non-cryptocurrency IT-services firm in a campaign that delivers malware through weaponized Terraform provider lockfiles, resolving C2 through a Nostr-relay dead drop2026-09-21
- TELESHIM / MIXEDKEY / BINDCLOAK, DLL side-loading under a legitimate vendor binary, Telegram-API C2 and volume-serial environmental keying against government networks2026-07-26
- Edgecution: abusing the Chrome/Edge Native Messaging API as a browser-sandbox-to-host bridge2026-06-25