CTI Weekly Summary — 2026-W21

SonicWall Gen6 SSL-VPN CVE-2024-12802 — Akira-linked actors bypassing MFA on *officially-patched* firmware

If you did nothing this week: patching alone did not close this. Actors whose TTPs match Akira ransomware successfully bypassed MFA on SonicWall Gen6 SSL-VPN appliances running officially-patched firmware between February and March 2026, by abusing a UPN/SAM account-name split in the authentication path — covered 2026-05-21.

This is an incomplete-patch case (CVE-2024-12802, CVSS 9.1): the original fix did not fully remediate the MFA-bypass path, so a "patched" appliance can still be brute-forced through the account-name-split primitive. Swiss/EU public-sector and finance estates that treated the earlier SonicWall advisory as closed should re-open it: audit SSL-VPN authentication logs for UPN-vs-SAM mismatches and repeated MFA challenges, and confirm the appliance is on the firmware build that fully closes CVE-2024-12802 rather than the earlier partial fix.

“If you did nothing this week: patching alone did not close this.” — ctipilot v2 brief (migrated)

Two CISA KEV additions under active exploitation — Trend Micro Apex One and Langflow

If you did nothing this week: if you run Apex One On-Premise, your endpoint-management server can push attacker code to every managed agent; if you run Langflow, a cross-origin request can steal a session. CISA added both to KEV on 2026-05-21 with confirmed in-the-wild exploitation.

CVE-2026-34926 (Apex One On-Premise, CVSS 6.7) is a post-auth relative-path-traversal flaw in builds below 17079 that lets an admin-credential holder inject code which the management server then deploys fleet-wide to all managed agents — turning the security console into a malware distribution point; JPCERT/CC issued at260014 corroborating. CVE-2025-34291 (Langflow ≤ 1.6.9, CVSS 9.4) is an overly-permissive CORS configuration combined with a SameSite=None refresh token that enables cross-origin token theft, exploited by the Flodric botnet. Patch both; for Apex One, restrict management-console access and audit agent-deployment jobs for unexpected packages.

Drupal core CVE-2026-9082 — pre-auth SQL injection, CISA KEV, active exploitation confirmed; NCSC.ch flipped to "actively exploited"

If you did nothing this week: an internet-exposed Drupal site on PostgreSQL was anonymously SQL-injectable, and exploitation is now confirmed in the wild. Drupal pre-warned an emergency advisory via PSA-2026-05-18, shipped SA-CORE-2026-004 on 2026-05-21, and by 2026-05-23 the advisory was updated to confirm exploit attempts, CISA had KEV-listed it, and NCSC Switzerland flipped its Cyber Security Hub post 12584 to "Actively exploited."

CVE-2026-9082 is a "highly critical" pre-authentication SQL injection in the Drupal core database abstraction layer, exploitable only against PostgreSQL backends. Drupal is widely deployed across Swiss and EU public-administration web estates; the PostgreSQL-only condition narrows but does not eliminate exposure. Apply the SA-CORE-2026-004 fixed core release immediately; if you cannot patch a PostgreSQL-backed Drupal site, take it off the public internet until you can.

“If you did nothing this week: an internet-exposed Drupal site on PostgreSQL was anonymously SQL-injectable, and exploitation is now confirmed in the wild.” — ctipilot v2 brief (migrated)

Microsoft Defender Engine CVE-2026-41091 + CVE-2026-45498 — both confirmed exploited in the wild; out-of-band engine update is the fix

If you did nothing this week: the malware-protection engine on your Windows estate became the foothold. Microsoft confirmed both CVEs as actively exploited and shipped a combined out-of-band Defender Engine update (4.18.26040.7) — first disclosed 2026-05-20, confirmed-exploited 2026-05-22.

CVE-2026-41091 is a link-following elevation-of-privilege flaw in the Defender Engine (CVSS 7.8) flagged exploited=Yes and publiclyDisclosed=Yes in the MSRC update guide on 2026-05-19; CVE-2026-45498 was confirmed exploited alongside it. A third flaw disclosed the same day — CVE-2026-45584, a heap-based buffer overflow in the Defender Engine reachable over the network (AV:N) for unauthenticated code execution in the Defender process context (CVSS 8.1) — is patched by the same engine train but not confirmed exploited (§ 3). The engine auto-updates for most estates, but air-gapped, version-pinned, or managed-update environments must verify they are on engine ≥ 4.18.26040.7. Hunt for Defender engine-version regressions and anomalous MpCmdRun.exe activity.

“If you did nothing this week: the malware-protection engine on your Windows estate became the foothold.” — ctipilot v2 brief (migrated)

Drupal CVE-2026-9082 — disclosure-only Monday to KEV-confirmed-exploited by Friday

A textbook example of why the weekly lens matters: an item that was a pre-patch warning at the start of the week was confirmed exploited in the wild by its end. Drupal pre-announced an emergency advisory via PSA-2026-05-18 (daily 2026-05-20); SA-CORE-2026-004 shipped the "highly critical" pre-auth SQL injection fix on 2026-05-21; and by 2026-05-23 Drupal had updated the advisory to confirm exploit attempts, CISA had KEV-listed it, and NCSC Switzerland had flipped its Cyber Security Hub post 12584 to "Actively exploited." See § 1 for the operational framing — the trajectory itself is the lesson: a PostgreSQL-backed public-sector Drupal site left unpatched across this one week moved from "watch" to "presumed-targeted."

“A textbook example of why the weekly lens matters: an item that was a pre-patch warning at the start of the week was confirmed exploited in the wild by its end.” — ctipilot v2 brief (migrated)

Windows "Chaotic Eclipse" zero-day proliferation — YellowKey, GreenPlasma, MiniPlasma

The researcher cluster "Chaotic Eclipse" / "Nightmare Eclipse" continued releasing unpatched Windows LPE/bypass PoCs across the window. On 2026-05-19 a third PoC — MiniPlasma — landed, targeting the cldflt.sys CfAbortHydration path and claiming a re-exploitable regression of the 2020-era CVE-2020-17103. On 2026-05-20 Microsoft formally assigned CVE-2026-45585 to the BitLocker/WinRE bypass (YellowKey) disclosed on 2026-05-12 and published a WinRE mitigation — but confirmed there is still no security update for the cluster; the earliest fix window remains the June 2026 Patch Tuesday. Three public PoCs (YellowKey, GreenPlasma, MiniPlasma) now exist against the Windows-centric desktop estates standard in CH/EU federal and cantonal administrations. Until a patch ships, enforce BitLocker PIN/Network-Unlock GPOs and AppLocker/WDAC rules on ctfmon.exe injection paths, and segregate privileged accounts from the workstation tier.

TeamPCP / Mini Shai-Hulud / Megalodon — the open-sourced supply-chain worm became commodity infrastructure this week

This is the week's defining chain. After the worm framework was open-sourced on 2026-05-12, the window saw it move from a single operator's tool to commodity capability, escalating almost daily:

• 2026-05-18 → 19 — First copycat wave: TeamPCP imitators deploy Phantom Bot plus SSH/cloud stealers, the Checkmarx Jenkins plugin is re-trojanised, and a rival "PCPJack" worm appears, per Ox Security (daily 2026-05-19). Same window: the Nx Console VS Code extension (2.2M installs) is pushed malicious for an 11-minute window (12:36–12:47 UTC, 2026-05-18) via stolen publisher credentials, and all 53 tags of actions-cool/issues-helper are moved to an imposter commit reading /proc/PID/mem of the Runner.Worker (daily 2026-05-20).
• 2026-05-21 — Escalation to platform scale: GitHub itself is named in a breach claim, Microsoft's official durabletask PyPI package is weaponised (propagating via AWS SSM and kubectl exec), and Grafana confirms a missed-token-rotation root cause (The Hacker News; daily 2026-05-21).
• 2026-05-22 — Unit 42 and StepSecurity publish concurrent analyses establishing that SLSA Build Level 3 provenance attestation is invalidated as an integrity gate for these waves — the malicious build step runs inside the legitimately-attested pipeline (Unit 42; daily 2026-05-22).
• 2026-05-23 (disclosure; event 2026-05-18) — SafeDep and OX Security disclose the Megalodon sub-campaign, which mass-poisoned 5,561 GitHub repositories in a ~6-hour window on 18 May using forged CI-bot identities and templated commit messages, harvesting cloud credentials and OIDC tokens (SafeDep; daily 2026-05-23). A further Packagist/Laravel-Lang compromise is reported the same day (daily 2026-05-24).

Two in-window synthesis documents consolidate the picture. The Cloud Security Alliance research note (2026-05-22) frames the whole event as a two-wave attack: Wave 1 (Mini Shai-Hulud, 29 Apr – 12 May) hijacked TanStack's GitHub Actions runner via a pull_request_target trigger plus Actions cache poisoning, extracted a live OIDC token from runner process memory via /proc/PID/mem, obtained a Sigstore signing certificate from Fulcio, and produced SLSA BL3 provenance attestations for 404 malicious package versions across 172 packages (CVE-2026-45321, CVSS 9.6) — the first publicly-documented hijack of trusted build pipelines to generate attestation-bearing malicious artefacts. Wave 2 (Megalodon, from 18 May) pushed 5,718 commits to 5,561 repos in under six hours, harvesting AWS IAM, GCP/Azure IMDS, SSH, Docker auth, .npmrc, .netrc, Kubernetes configs, Vault tokens and Terraform state. Separately, GitHub's official post-incident blog (2026-05-20) confirmed an employee device was compromised via the poisoned Nx Console extension (GHSA-c9j4-9m59-847w) and ~3,800 GitHub-internal repositories were exfiltrated, with no customer-data impact found as of publication and a fuller report still outstanding.

Defender takeaways: set permissions: id-token: none on workflows that do not need OIDC; disable or isolate pull_request_target for fork PRs (permissions: contents: read); treat Git commit author/committer fields as unverified free text (use contributor allow-lists / push-rule bypass-actor audit events to catch Megalodon-style forged identities); audit Sigstore Rekor for unexpected signing events from your own pipeline identity; and do not accept SLSA BL3 attestation alone as a clean-package signal.

CVE-2026-7507 (+15) — Keycloak 26.6.2: identity-provider cluster including OIDC session fixation and cross-realm IDOR

Keycloak 26.6.2 fixed 16 CVEs across its identity, authentication and authorisation subsystems, including OIDC session fixation (CVE-2026-7507), WebAuthn execute-actions token replay (CVE-2026-37982), introspection audience bypass (CVE-2026-37979) and a cross-realm IDOR in Authorization Services (CVE-2026-4630); BSI CERT-Bund issued WID-SEC-2026-1612 at HIGH. Keycloak is the dominant open-source IAM in EU and Swiss public-sector and university SSO deployments — a session-fixation or cross-realm flaw in the IdP undermines every relying-party application behind it. Upgrade to 26.6.2; prioritise multi-realm deployments where the cross-realm IDOR has the widest blast radius.

CVE-2026-42096 … -42100 — Sparx Enterprise Architect / Pro Cloud Server: five-CVE pre-auth chain, public PoC, no patch

CERT Polska coordinated disclosure of five Sparx Systems vulnerabilities (CVE-2026-42096 … -42100), chaining pre-auth SQL injection with a WebEA race-condition to reach RCE; a researcher PoC is public and no vendor patch exists. Sparx EA / Pro Cloud Server is widely used as a modelling and enterprise-architecture repository in Swiss and EU public-administration and university environments, so the CH/education exposure is real. With no patch available, restrict Pro Cloud Server to authenticated VPN reach and monitor WebEA endpoints for the injection patterns CERT-PL documents.

CVE-2026-48172 — LiteSpeed User-End cPanel plugin: authenticated cPanel user to root, actively exploited

CVE-2026-48172 (CWE-266 incorrect privilege assignment, CVSS 10.0) in the LiteSpeed User-End cPanel plugin versions 2.3–2.4.4 lets an authenticated cPanel user escalate to root via the lsws.redisAble path, and is actively exploited. Shared-hosting and managed-WordPress estates running cPanel + LiteSpeed are the exposed population — a single low-privilege hosting account becomes root on the node. Patch to the vendor-recommended build (LiteSpeed advises 2.4.7 / WHM plugin 5.3.1.0) immediately and audit for unexpected root-level cron or service modifications on affected nodes.

“CVE-2026-48172 (CWE-266 incorrect privilege assignment, CVSS 10.0) in the LiteSpeed User-End cPanel plugin versions 2.3–2.4.4 lets an authenticated cPanel user escalate to root via the lsws.redisAble path, and is actively exploited.” — ctipilot v2 brief (migrated)

CVE-2026-45829 — ChromaDB Python server: pre-auth RCE before the auth check, still unpatched

HiddenLayer / Hadrian researchers disclosed a CVSS 10.0 pre-authentication RCE in ChromaDB's Python FastAPI server (affected from v1.0.0): the embedding-function model is loaded before the authentication check runs, so an unauthenticated request reaches code execution "before it asks who you are." Public PoC, still unpatched in v1.5.9. ChromaDB is a common vector-store backend for retrieval-augmented-generation stacks now appearing in public-sector AI pilots; any internet-reachable instance is exposed. Take ChromaDB off the public internet and front it with an authenticating reverse proxy until a fix ships.

CVE-2026-42822 — Azure Local Disconnected Operations: CVSS 10.0 unauthenticated network elevation-of-privilege

Microsoft assigned CVE-2026-42822 (CVSS 10.0, CWE-287 Improper Authentication, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) to an authentication-bypass flaw in Azure Local Disconnected Operations (ALDO), rated "Exploitation More Likely." ALDO is the air-gapped/sovereign-cloud deployment mode that public-sector and regulated operators specifically choose for data-residency reasons — so this CVSS-10 bug lands squarely on the deployments most likely to hold sensitive workloads. No confirmed exploitation; treat as a high-priority patch given the "More Likely" rating and the sovereign-deployment exposure.

CVE-2026-20223 — Cisco Secure Workload: CVSS 10.0 zero-auth REST API grants Site Admin across all tenants, no workaround

An access-validation failure in the internal REST API of Cisco Secure Workload (formerly Tetration), the enterprise micro-segmentation platform, lets an unauthenticated network attacker obtain Site Admin privileges across all tenants (CVSS 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). There is no workaround — patching is the only remediation. No confirmed exploitation yet, but a perfect-10 zero-auth admin bug on a segmentation controller is an attractive target: compromise of the micro-segmentation fabric undermines every downstream lateral-movement control. NCSC.ch carried it on the Cyber Security Hub (post 12588). Patch on the highest-priority schedule and restrict management-plane network reachability in the interim.

Healthcare (DACH) — the soft surface is the administrative intermediary, not the hospital

Two DACH healthcare data-theft events this window both hit intermediaries rather than clinical systems: the Unimed billing processor (exposing patient records across at least six German university hospitals) and ARWINI, the Lower Saxony prescription-audit body (Kairos claims 2.87 TB including ~70,000 Art. 9 records) — both detailed in § 5. The pattern for Swiss and German healthcare CISOs is concentration risk in the back-office tier: billing, audit, lab and imaging processors aggregate patient data from many providers and become a single high-value, lower-defended target. Inventory which processors hold your Art. 9 data and confirm each one's breach-notification SLA and security attestation.

Education — virtual-classroom platforms and EdTech SaaS exposure

BigBlueButton — the open-source virtual-classroom platform deployed across German DFN, Swiss SWITCH and pan-European GÉANT academic networks, including cantonal school deployments — disclosed three flaws (weak session-token randomness, API checksum bypass, SSRF) in bbb-web < 3.0.21 / < 3.0.23 (daily 2026-05-19). In parallel, 7-Eleven became the latest named victim of the ShinyHunters Salesforce campaign that also claimed Instructure/Canvas (§ 5) — keeping EdTech SaaS supply-chain exposure live for the universities and cantonal education directorates that depend on these platforms. Patch BigBlueButton to the fixed branches and re-audit Canvas/Instructure-connected OAuth scopes.

Telecom — sustained pressure from espionage tradecraft and fragile carrier infrastructure

Telecom was hit on two axes. Calypso/Red Lamassu's purpose-built Showboat/JFMBackdoor implant pair (§ 7) signals long-haul espionage intent against carriers, while Recorded Future's disclosure that a Huawei VRP enterprise-router zero-day caused the July 2025 POST Luxembourg nationwide telecom outage — with no CVE filed ten months later — exposes the fragility and disclosure-opacity of carrier-grade network gear (daily 2026-05-20, [SINGLE-SOURCE]). For CH/EU telecom and any public-sector operator depending on carrier uplinks, the combined lesson is that the network-infrastructure layer is both actively espionage-targeted and carries undisclosed vendor risk.

Public administration — web-CMS and identity estate under multi-vector pressure

Public-sector web and identity infrastructure took hits from several directions this week: the actively-exploited Drupal pre-auth SQLi (§ 1), ANSSI/CERT-FR's CERTFR-2026-AVI-0635 on SPIP < 4.4.15 (the dominant French public-administration CMS), the unpatched Sparx Enterprise Architect chain and the Keycloak IAM cluster (§ 3), and Webworm's pivot to EU government targets (§ 7). Add the Krebs-reported CISA-contractor exposure of AWS GovCloud admin keys in a public GitHub repo for ~6 months (daily 2026-05-19) and the Rhysida Stuttgart claim (§ 5), and the week's signal is that the public-administration estate's CMS, IAM and cloud-credential surfaces are all live targets simultaneously. Prioritise the CMS/IAM patch SLAs and audit cloud-credential hygiene in contractor repositories.

Technology / developer toolchain — CI/CD supply chain remains the week's highest-volume attack surface

The Shai-Hulud/Megalodon waves (§ 2) made the developer toolchain the single most-targeted surface of the week by volume — 5,561 repositories mass-poisoned in one Megalodon burst, GitHub's own internal repos exfiltrated, and the SLSA BL3 trust model invalidated. The cross-cutting lesson for every sector running CI/CD (which is now every sector) is that build-time trust controls — OIDC token scoping, provenance attestation, registry publishing gates — are the contested ground, and the npm staged-publishing GA (§ 8) is the first registry-level structural response.

THORChain — ~$11M cross-chain vault drain on a Switzerland-based protocol

A malicious validator node drained approximately $11M in protocol-owned funds from THORChain — a Switzerland-based decentralised cross-chain liquidity protocol — across nine chains on 2026-05-15, covered 2026-05-18. Notable for this audience only as a Swiss-nexus financial-infrastructure incident; the root cause is a threshold-signature (GG20) vault-control failure rather than a defender-actionable enterprise TTP.

Rhysida claims Stuttgart municipal data — city denies a confirmed incident

The Rhysida RaaS group listed Landeshauptstadt Stuttgart (~600,000 residents) on its leak site in mid-May 2026, demanding 5 BTC; the city states it has not confirmed an incident, covered 2026-05-23. Recorded as a claim, not a breach — Rhysida has a history of both genuine municipal compromises and opportunistic re-listing of prior dumps. Watch for a city confirmation or sample-data publication before treating as substantiated.

7-Eleven — ShinyHunters Salesforce campaign claims another 600,000+ records

7-Eleven confirmed on 2026-05-18 that an unauthorised third party accessed franchise-application records (600,000+) in a breach ShinyHunters claimed in April 2026. The operational point for this audience is the campaign, not the victim: 7-Eleven joins Instructure, Vimeo, Wynn Resorts, Vercel and Medtronic as named victims of the same Salesforce-targeting ShinyHunters operation. Any organisation with Salesforce connected apps and OAuth-integrated third parties should re-audit connected-app scopes and refresh-token lifetimes.

ARWINI (Lower Saxony prescription-audit body) — exfiltration confirmed; Kairos claims 2.87 TB including ~70,000 GDPR Art. 9 records

Investigators confirmed on 2026-05-18 that the cyberattack on ARWINI — the body that audits prescription cost-effectiveness for statutory health insurers in Lower Saxony — exfiltrated data after a 4 May intrusion. The Kairos ransomware group claims 2.87 TB, with roughly 70,000 special-category (Art. 9) health records in scope. This is the second DACH healthcare-adjacent data-theft event of the window after Unimed, reinforcing that the sector's softest surfaces are the administrative and audit intermediaries, not the hospitals' clinical systems.

Six German university hospitals — patient records exfiltrated via billing processor Unimed

Unimed, a Saarland-based billing-service provider that handles private-insurance and self-payer invoicing for an estimated 95% of German university hospitals, was breached in mid-April 2026; patient billing data for at least six university hospitals — including Uniklinikum Freiburg and Uniklinik Köln, which issued their own notifications on 2026-05-21 — was stolen; The Record tallies ~96,600 records across four named hospitals, with further hospitals affected per heise's per-hospital breakdown, as of 2026-05-24. The defender lesson is the concentration multiplier: one processor breach simultaneously becomes a GDPR Art. 33/34 event for every covered hospital. CH/EU healthcare entities should inventory which billing, lab, and imaging processors hold their patient data and confirm each processor's breach-notification SLA.

West Pharmaceutical Services — 8-K/A confirms full operational restoration

West Pharmaceutical Services (NYSE: WST) filed an 8-K/A amendment under SEC Item 1.05 on 2026-05-20 confirming full operational restoration across all manufacturing facilities, with the data investigation still ongoing. Closing the loop on the W20 disclosure: the manufacturing-line continuity risk this audience was tracking has resolved; the residual is the data-scope determination.

Grafana Labs / CoinbaseCartel — source-code-only theft confirmed; ransom rejected; detected by canary token

Grafana Labs confirmed on 2026-05-18 that the CoinbaseCartel data-extortion group used a compromised GitHub token granting access to Grafana's GitHub environment to exfiltrate private source code only — no customer data, no production systems — and that it rejected the ransom. (Earlier reporting attributed the entry to a pull_request_target GitHub Actions misconfiguration and credited a canary token with detection; the in-window victim-confirmation sources cited here state only the compromised-token vector, so those mechanism specifics are not asserted as fact.) The defender takeaway the sources do support: audit GitHub token scopes and lifetimes aggressively, restrict pull_request_target workflows as general hardening, and seed canary artefacts in private repositories as a low-cost detection layer for source-code exfiltration.

Verizon 2026 DBIR — vulnerability exploitation is the #1 breach vector for the first time in 19 years; patching cadence regressed

The 19th Data Breach Investigations Report (published 2026-05-19, covering Nov 2024 – Oct 2025) records vulnerability exploitation as the most common initial-access vector at ~31%, overtaking credential abuse (~13%) for the first time in the report's history — Verizon attributes the shift in part to AI-assisted weaponisation compressing the disclosure-to-exploit window. The operationally relevant findings for a public-sector SOC are the defensive regressions, not the headline: the median time to fully patch slipped to ~43 days (from ~32), and organisations remediated only ~26% of CISA KEV-listed vulnerabilities (down from ~38%) against ~50% more critical bugs than the prior dataset. Third-party involvement in breaches rose to ~48% of incidents. These are the precise gaps this week's actively-exploited CVEs (Drupal, Apex One, Langflow, Defender) target; under NIS2 Art. 21(2)(e) the patching-process regression is also a supervisory-audit exposure. "Shadow AI" (unapproved AI tooling) emerged as a notable data-loss action — scope DLP and data-classification controls to LLM upload endpoints.

Check Point Research March–April 2026 AI Threat Landscape Digest — operator-run AI platforms breach government agencies

Check Point's AI Threat Landscape Digest (published 2026-05-22, covered 2026-05-23) documents a single operator running two AI platforms in parallel to breach nine Mexican government agencies — the most concrete public example yet of AI tooling operationalised for end-to-end intrusion rather than reconnaissance assistance. Single-source (Check Point only); the synthesis relevant to this audience is the trajectory, not the victim count: where the Verizon and Rapid7 reports show AI compressing the exploitation timeline, this shows AI compressing the operator skill floor — fewer skilled humans needed per campaign. Treat as a directional indicator pending independent corroboration.

Rapid7 Q1 2026 Threat Landscape Report — corroborates the structural shift; KEV-to-listing window collapsing

Rapid7's Q1 2026 report (published 2026-05-21, covering Jan–Mar 2026 IR data, covered 2026-05-23) independently finds vulnerability exploitation as the top initial-access vector at ~38%. Read alongside the Verizon DBIR, the two datasets agree on direction even where the absolute percentages differ (different windows, different telemetry) — the synthesis a daily reader could not see is that this is a corroborated structural change, not a single-vendor artefact. For CH/EU defenders this argues for prioritising edge-device and public-facing-application patch SLAs over generic awareness programmes.

Midnight Blizzard and others operationalise ROADtools for Entra ID abuse

Unit 42 documented systematic nation-state operationalisation of the open-source ROADtools Entra ID framework by Midnight Blizzard, Curious Serpens and UTA0355 for device registration, token theft and tenant enumeration (daily 2026-05-23). This is the most broadly relevant item in the section — every M365/Entra tenant is in scope. Hunt for unexpected device-registration events, anomalous service-principal token requests, and ROADtools-characteristic enumeration patterns; tighten conditional-access on device-registration and review legacy-auth exposure.

The Gentlemen RaaS — Czech university and Swiss engineering firm listed; comms overhaul continues

The Gentlemen RaaS listed two new European victims — the University of Finance and Administration (Czech Republic) and a Swiss engineering firm — on its leak site (daily 2026-05-20). The operator's previously-announced communications-infrastructure overhaul (rather than shutdown) means continued activity; the Swiss-victim listing is the direct CH-nexus signal this week. Watch for sample-data publication confirming the listings versus opportunistic re-listing.

Fox Tempest — Microsoft DCU disrupts the malware-signing service feeding Rhysida, INC, Qilin and Akira

Microsoft Threat Intelligence and the Digital Crimes Unit disrupted Fox Tempest, a malware-signing-as-a-service operation that supplied code-signing to multiple ransomware operations (daily 2026-05-20). Status: disrupted via combined intelligence exposure and a sealed US legal action. The defender takeaway is that code-signing trust on binaries attributable to Rhysida/INC/Qilin/Akira tooling should not be treated as a benign signal — the signing pipeline was a criminal service.

Calypso / Red Lamassu (Bronze Medley, China-aligned) — Showboat and JFMBackdoor against telecoms

Lumen Black Lotus Labs and PwC disclosed two purpose-built implants — Showboat (Linux) and JFMBackdoor (Windows) — used by Calypso against international telecom firms (daily 2026-05-22).

Ghostwriter / UAC-0057 / FrostyNeighbor (Belarus-aligned) — new OYSTER implant chain

CERT-UA documented a spring-2026 phishing campaign deploying a new OYSTERFRESH → OYSTERBLUES → OYSTERSHUCK implant chain via Prometheus learning-platform lures (daily 2026-05-23). The campaign continues the actor's focus on Ukrainian and allied government organisations; the staged implant chain is the new tradecraft. For EU/CH government estates that share the actor's target profile, the relevant control is attachment-detonation and learning-platform-lure awareness for staff.

Webworm (China-aligned; FishMonger / Aquatic Panda) — pivots to EU government targets

ESET documented Webworm's 2025–2026 pivot to European government victims (Belgian, Italian, Serbian, Polish and Spanish governmental organisations), deploying EchoCreep (Discord-based C2) and GraphWorm (Microsoft Graph / OneDrive C2) backdoors (daily 2026-05-21). The use of Graph/OneDrive as C2 is the defender-relevant shift — it blends with legitimate M365 traffic. Hunt for anomalous Graph API usage patterns and Discord egress from server subnets that have no business reason to reach either.

Screening Serpens / UNC1549 (Iran; Smoke Sandstorm / Nimbus Manticore) — AppDomainManager hijacking in six new RATs

Unit 42 detailed Screening Serpens using AppDomainManager hijacking to silently disable ETW and strong-name verification across six newly-documented RATs (daily 2026-05-23). The ETW-blinding plus strong-name-check bypass is the detection-relevant tradecraft — it defeats both behavioural telemetry and signature-trust controls in one step. Where AppDomainManager-redirection is not required by an application, monitor for the appDomainManagerAssembly / appDomainManagerType config and environment-variable hijack vectors.

EU 20th Russia sanctions package — managed-security-services prohibition effective 25 May; Switzerland adopted most measures 22 May

The single most defender-relevant regulatory change of the window. Council Regulation (EU) 2026/506 introduces a prohibition on providing "managed security services" — defined to include incident handling, penetration testing, security audits and security consulting/technical-support advice — to the Government of Russia and to entities legally established in Russia, effective 25 May 2026. The prohibition reaches EU-incorporated MSSPs supplying Russian subsidiaries absent a national-competent-authority licence; no European Commission interpretive guidance on scope had been published as of 24 May, so law-firm analyses advise a conservative reading. Switzerland's EAER adopted most of the 20th-package measures effective 22 May (115 individuals/entities asset-frozen, 20 Russian banks and 7 third-country intermediaries under transaction ban, RUBx / digital-ruble transactions prohibited from 26 May), deferring some energy/trade provisions; whether the Swiss transposition includes the managed-security-services prohibition specifically requires SECO confirmation. What defenders must do differently: any EU or Swiss SOC, IR firm, or pentest provider with a Russian-law-entity client must have wound those engagements down by 25 May, and should verify no security tooling (EDR agents, SIEM forwarders, ticketing/connector integrations) is being operated or serviced under a contract with a Russian-established entity.

Law-enforcement infrastructure takedowns — Operation Saffron (Switzerland JIT), FIOD/Stark Industries, Kimwolf, INTERPOL Ramz

Four coordinated actions in the window degraded threat-actor infrastructure relevant to this audience. Operation Saffron dismantled First VPN — a Russian-language criminal anonymisation service marketed to ransomware operators — seizing 33+ servers with the user database captured; Switzerland was a named Joint Investigation Team participant, and the infrastructure is linked to Phobos RaaS (Eurojust; daily 2026-05-22). The Netherlands FIOD arrested two suspects for EU-sanctions evasion tied to the Stark Industries bulletproof-hosting front and seized ~800 servers, dismantling NoName057(16) DDoS plumbing (FIOD; daily 2026-05-23). The alleged operator of the Kimwolf 30+ Tbps IoT DDoS-for-hire botnet (AISURU variant) was arrested (US DoJ; daily 2026-05-23), and INTERPOL Operation Ramz logged 201 arrests across a 13-country MENA sweep including a PhaaS-server takedown (INTERPOL; daily 2026-05-19). The defender-relevant pattern: the takedowns hit anonymisation/hosting/DDoS plumbing rather than end actors, so expect short-term infrastructure churn (new VPN/hosting fronts, rebuilt botnet C2) rather than a durable drop in activity.

npm ships 2FA-gated "staged publishing" GA — platform-governance response to the worm waves

GitHub announced on 2026-05-22 that npm staged publishing is now Generally Available: a maintainer runs npm stage publish to create a staged release that must be explicitly promoted under 2FA before it becomes installable, alongside new install-time controls. This is the registry-level governance answer to the Shai-Hulud/Megalodon waves (§ 2) — the OIDC-token-reuse propagation primitive that made those worms self-spreading is blunted when an automated npm publish cannot reach end users without an interactive 2FA promotion step. Defender takeaway: where you operate internal npm publishing pipelines, adopt staged publishing and require the 2FA promotion gate; it does not retroactively clean compromised packages but it raises the cost of the next worm's propagation step.

Looking ahead — 2026-W21

Items already in motion at the close of 2026-W21. Not predictions — each links to the in-motion reporting underneath.

• GitHub's fuller post-incident report on the internal-repo breach is still outstanding. GitHub's 2026-05-20 blog committed to a fuller report; the open questions are the full scope of the ~3,800 exfiltrated internal repos and whether any contained credentials or customer-impacting material. (GitHub Security Blog)
• Shai-Hulud wave-6 candidate registries — Cargo (Rust) and Maven (Java). The OIDC-token-reuse propagation primitive is registry-agnostic; with the worm now open-sourced and commoditised, Cargo and Maven are the un-hit major ecosystems. Pre-stage Sigstore/provenance-anomaly hunts in Rust and Java dependency pipelines. (CSA research note)
• EU 20th-package "managed security services" scope guidance, and SECO confirmation of Swiss transposition. No European Commission interpretive guidance on the managed-security-services definition was published as of 24 May; SECO confirmation of whether Switzerland's 22 May adoption includes the MSS prohibition specifically is the open compliance question for CH providers. (Greenberg Traurig)
• PAN-OS CVE-2026-0300 wave-2 patch builds scheduled ~2026-05-28. Remaining build streams finish the staged patch arc; audit for attacker-created rogue admin accounts before patching wipes implant artefacts. (Palo Alto PSIRT; daily 2026-05-18)
• Windows YellowKey / GreenPlasma / MiniPlasma cluster — June 2026 Patch Tuesday (~2026-06-10) is the expected first fix. Three public PoCs, no out-of-band release; until then BitLocker PIN/Network-Unlock GPOs and ctfmon.exe-injection WDAC rules are the only controls. (MSRC CVE-2026-45585; daily 2026-05-20)
• Sparx Enterprise Architect chain and ChromaDB CVE-2026-45829 remain unpatched. Both carry public PoCs with no vendor fix; watch for the patches and, in the interim, keep both off the public internet behind authenticated access. (CERT-PL; daily 2026-05-21)
• GTIG UNC6671 "BlackFile" probable rebrand. The DLS went offline with a shutdown message; no successor brand had emerged by week-end. Watch for a new leak-site reusing the vishing → AiTM → rogue-MFA → SharePoint-exfiltration TTP set. (daily 2026-05-23)