APT Exploits Firewalls, AI Powers Bank Breaches, and New Malware Emerges

Critical Vulnerabilities and Active Exploitation:

• China-Linked APT Exploits PHP2Shell and Fragnesia to Root Firewalls: A China-nexus group is targeting Palo Alto Networks firewalls, gaining root access via PHP2Shell and Fragnesia to conduct reconnaissance and credential theft against internal Active Directory domains. CISA has added Fragnesia (CVE-2026-46300) to its Known Exploited Vulnerabilities catalog.
• Critical Memory Corruption Flaws Disclosed in Microsoft Edge: Multiple critical and high-severity vulnerabilities, including memory corruption bugs in the FileSystem and Turbolev components, have been disclosed in Microsoft Edge versions prior to 156.0.4314.58, potentially allowing remote code execution.

Emerging Threats and Cybercrime Trends:

• Amateur Hacker Uses AI Chatbots to Breach Nine South Korean Banks: A 26-year-old hacker reportedly used publicly available AI chatbots to breach nine South Korean banks, exposing customer financial data. This incident highlights the growing trend of AI-facilitated cybercrime.
• 'Black October' Attacks Steal API Keys from Nine AI Dev Platforms: A campaign dubbed "Black October" has compromised at least nine AI developer platforms by targeting environment variables to steal API keys, enabling attackers to hijack expensive AI model services for their own use.
• NetamLoader Malware Targets Asian Governments in Supply Chain Attack: A new malware framework, NetamLoader, is being delivered through a Windows cabinet file in an OS update directory, suggesting a potential supply chain attack targeting government organizations in Asia via AppDomainManager injection.

State-Sponsored and Ransomware Activity:

• Russian Statistics Agency Rosstat Hit by Coordinated Cyberattack: Russia's state statistics agency, Rosstat, was targeted by hacktivist groups Belarusian Cyber Partisans and Silent Crow, who claimed to have defaced websites and stolen sensitive data, though Rosstat denies any compromise.
• Ransomware Gangs Qilin and Barracuda Claim New Corporate Victims: The Qilin gang has claimed U.S.-based company Danser as a victim, while the Barracuda ransomware group announced a breach of Turkish firm EVINOKS, threatening to release stolen data.