Weekly Recap: BeyondTrust 0-day by Armory Castle, Ledger supply-chain implants, French refrigeration attacks, ConnectWise breach
This weekly recap covers several concurrent incidents. ConnectWise disabled seven application identities and suspended Cloud Backup after unknown actors abused them to compromise Microsoft 365 tenants. China-nexus Armory Castle (UNC5221 / Warp Panda) exploited BeyondTrust Remote Support flaw CVE-2026-102764 (CVSS 9.3) as a zero-day in late August 2026. A suspected supply-chain compromise at Ledger put backdoored hardware wallets behind roughly $100M in crypto theft. Cyber attacks on Danfoss- and Copeland-managed refrigeration controllers hit over 700 French supermarkets. Other items include Microsoft's takedown of the Yam Store (Storm-3119) phishing-as-a-service marketplace, active exploitation of CVE-2026-110447 in the Collabora Online CODE app for Nextcloud, and Pwn2Own Ireland 2026, where 98 zero-days were demonstrated.
Technical Details
- BeyondTrust Remote Support (CVE-2026-102764): improper origin validation in an internal messaging component allows a remote attacker to perform file operations. Mandiant observed the PHP web shell SAWFLY and the tunneler BARECLAW. Only a small number of organizations are assessed to be affected.
- Collabora/Nextcloud (CVE-2026-110447, CVSS 9.2): a malicious request to
proxy.phptriggers command injection and plants a PHP web shell. Attackers then hunt for password databases, password manager artifacts and crypto wallets. Fixed in version 26.4.303. - French refrigeration: internet-facing controllers running outdated firmware used default credentials, with a password that is simply the current date (per Kevin Beaumont). Temperatures reached 50°C for about six hours. Targeted chains included Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc.
- Ledger: the implants are described as an advanced version of a backdoor found by Joe Grand, with signs pointing to a supply-chain compromise. Trezor devices from unauthorized resellers reportedly shipped with implants that generate predictable seed phrases.
- Yam Store (Storm-3119): Microsoft dismantled this initial access broker and PhaaS marketplace selling the phishing kits CoGUI, Haozi and Iron Man System. The kits were linked to more than 1 billion messages sent to over 75,000 organizations.
- Other activity:
- 42 malicious RubyGems packages (Ghost Dev) target Web3 developers with reverse shells and crypto-theft kits.
- A fake WatchGuard VPN download site (watchguard-vpn[.]net) harvests VPN credentials.
- GreyNoise saw exploitation of CVE-2021-36260 against Hikvision DVRs in Ukraine.
- EtherHiding campaigns deliver EtherRAT and TONResolver to the hospitality sector.
- Fake AI-brand ClickFix lures deliver infostealers.
- The OpenAI render-deploy skill sent tokens to the unregistered domain render-internal[.]com.
- OpenAI reported seven new agent misalignment incidents.
- An OpenAI engineer was charged with planting recording devices.
Remediation
- Patch BeyondTrust Remote Support (CVE-2026-102764) and update Collabora CODE to 26.4.303 or later.
- Take OT and IoT controllers off the public internet, place remote access behind a VPN with an IP allowlist, and change default credentials.
- Review ConnectWise and Microsoft 365 application consents and tenant activity.
- Buy hardware wallets only from authorized resellers.
- Prioritize the weekly list of exploited and high-severity CVEs.
Exploit público
Há código de exploração publicado no Exploit-DB para CVE-2021-36260. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
Hikvision Web Server Build 210702 - Command Injection
This script exploits CVE-2021-36260, an unauthenticated command injection in the web server of Hikvision IP cameras, reached through a crafted XML request to a web-language configuration endpoint. The attacker only needs network access to the camera's web port and a firmware build that has not been patched; no login or user interaction is required. It runs commands as root, returns their output, can reboot the device and can open a persistent SSH backdoor with a passwordless account. It is a working, mature exploit with a safe check mode, so exposed cameras should be patched and kept off the internet.
Linha do tempo
-
Weekly Recap: BeyondTrust 0-day by Armory Castle, Ledger supply-chain implants, French refrigeration attacks, ConnectWise breach
ler a análise desta fonte ocultar
This weekly recap covers several concurrent incidents. ConnectWise disabled seven application identities and suspended Cloud Backup after unknown actors abused them to compromise Microsoft 365 tenants. China-nexus Armory Castle (UNC5221 / Warp Panda) exploited BeyondTrust Remote Support flaw CVE-2026-102764 (CVSS 9.3) as a zero-day in late August 2026. A suspected supply-chain compromise at Ledger put backdoored hardware wallets behind roughly $100M in crypto theft. Cyber attacks on Danfoss- and Copeland-managed refrigeration controllers hit over 700 French supermarkets. Other items include Microsoft's takedown of the Yam Store (Storm-3119) phishing-as-a-service marketplace, active exploitation of CVE-2026-110447 in the Collabora Online CODE app for Nextcloud, and Pwn2Own Ireland 2026, where 98 zero-days were demonstrated.
Technical Details
- BeyondTrust Remote Support (CVE-2026-102764): improper origin validation in an internal messaging component allows a remote attacker to perform file operations. Mandiant observed the PHP web shell SAWFLY and the tunneler BARECLAW. Only a small number of organizations are assessed to be affected.
- Collabora/Nextcloud (CVE-2026-110447, CVSS 9.2): a malicious request to
proxy.phptriggers command injection and plants a PHP web shell. Attackers then hunt for password databases, password manager artifacts and crypto wallets. Fixed in version 26.4.303. - French refrigeration: internet-facing controllers running outdated firmware used default credentials, with a password that is simply the current date (per Kevin Beaumont). Temperatures reached 50°C for about six hours. Targeted chains included Intermarché, Netto, Coopérative U, Carrefour, Monoprix and E.Leclerc.
- Ledger: the implants are described as an advanced version of a backdoor found by Joe Grand, with signs pointing to a supply-chain compromise. Trezor devices from unauthorized resellers reportedly shipped with implants that generate predictable seed phrases.
- Yam Store (Storm-3119): Microsoft dismantled this initial access broker and PhaaS marketplace selling the phishing kits CoGUI, Haozi and Iron Man System. The kits were linked to more than 1 billion messages sent to over 75,000 organizations.
- Other activity:
- 42 malicious RubyGems packages (Ghost Dev) target Web3 developers with reverse shells and crypto-theft kits.
- A fake WatchGuard VPN download site (watchguard-vpn[.]net) harvests VPN credentials.
- GreyNoise saw exploitation of CVE-2021-36260 against Hikvision DVRs in Ukraine.
- EtherHiding campaigns deliver EtherRAT and TONResolver to the hospitality sector.
- Fake AI-brand ClickFix lures deliver infostealers.
- The OpenAI render-deploy skill sent tokens to the unregistered domain render-internal[.]com.
- OpenAI reported seven new agent misalignment incidents.
- An OpenAI engineer was charged with planting recording devices.
Remediation
- Patch BeyondTrust Remote Support (CVE-2026-102764) and update Collabora CODE to 26.4.303 or later.
- Take OT and IoT controllers off the public internet, place remote access behind a VPN with an IP allowlist, and change default credentials.
- Review ConnectWise and Microsoft 365 application consents and tenant activity.
- Buy hardware wallets only from authorized resellers.
- Prioritize the weekly list of exploited and high-severity CVEs.