Microsoft Scrambles to Patch 'RoguePlanet' Defender Zero-Day as DragonForce Ransomware Abuses Teams for Stealth Attacks

The Iran-linked APT group UNC1549 has expanded its cyber-espionage campaign from regional to global targeting, focusing on the aerospace, aviation, and defense industries. The group now leverages spear-phishing links to fake career portals to deliver custom malware, including new implants like SIGHTGRAB, TRUSTRAP, and MiniBrowse. New evasion techniques observed include binary padding and DLL Search Order Hijacking, indicating increased sophistication and a broader threat landscape. (Source: SOC Prime)

Further analysis of the DragonForce ransomware campaign reveals that the 'Backdoor.Turn' malware leveraged a previously undisclosed Huawei driver vulnerability for privilege escalation, allowing the threat actors to achieve SYSTEM-level access. Crucially, the sophisticated C2 evasion technique using Microsoft Teams' TURN servers enabled the attackers to remain undetected on the victim's network for an extended period of one to two months, significantly increasing the potential for data exfiltration and comprehensive compromise before the final ransomware deployment. This extended dwell time underscores the advanced stealth capabilities of the group.

The 'RoguePlanet' zero-day (CVE-2026-50656) in Microsoft Defender is now confirmed to affect Windows Server 2019 and 2022, expanding its potential impact. The vulnerability has been assigned a CVSS score of 7.8. While Microsoft has not observed active exploitation in the wild, they have rated it as 'Exploitation More Likely', indicating a high probability of future attacks. New technical details clarify the race condition mechanism involving symbolic links in `mpengine.dll`. Additional hunting hints and detection methods, including Sysmon and file system auditing, have been provided to help organizations identify and mitigate potential exploitation attempts.