Microsoft Patches Actively Exploited Office Zero-Day as Ransomware Groups Target Major Supply Chains

New developments in the Under Armour data breach, attributed to the Everest ransomware group, include the filing of a class-action lawsuit against the company in the U.S. This legal action highlights the escalating consequences for Under Armour following the exposure of 72 million customer records. Furthermore, the leaked dataset has been confirmed to include additional Personally Identifiable Information (PII) such as customer genders and dates of birth, alongside previously reported names, emails, phone numbers, locations, and purchase histories. The initial ransomware attack occurred in November 2025, leading to the data leak in January 2026 after failed ransom negotiations. The lawsuit underscores the increased legal and financial repercussions for the company and heightened risks for affected individuals.

The new article provides crucial specifics for CVE-2026-22844, clarifying the vulnerability as a command injection exploitable by an authenticated participant within a meeting, a more precise attack vector than previously stated. Affected versions are identified as prior to 5.2.1716.0. The update also includes detailed cyber observables and detection methods, such as monitoring for unusual child processes and outbound network connections from Zoom Node routers. Zoom reports no active exploitation in the wild. This new information significantly enhances understanding of the threat and mitigation strategies.

Further analysis of the Osiris ransomware confirms its continued use of the 'Poortry' malicious kernel driver for defense evasion. New information indicates this driver is deceptively signed and designed to masquerade as a legitimate Malwarebytes component, allowing it to terminate security software processes more effectively. This specific deceptive tactic aims to bypass detection and complicate forensic analysis, reinforcing the ransomware's sophisticated evasion capabilities. The use of Rclone for data exfiltration to Wasabi cloud storage remains a core tactic.

Fortinet has officially confirmed active exploitation of a critical authentication bypass vulnerability affecting its FortiCloud Single Sign-On (SSO) feature on FortiGate firewalls. This vulnerability, explicitly linked to CVE-2025-59718 and CVE-2025-59719, is being successfully exploited even on fully patched devices. Attackers are leveraging specially crafted SAML messages to gain unauthorized administrative access. Post-exploitation activities include creating persistent administrative accounts, enabling remote access VPNs, and exfiltrating sensitive device configurations, posing a severe risk of long-term network compromise.