🛡️ CISO Intel — Wednesday, 08-04-2026

By Marcus Reed | 07-04-2026 08:00 IST → 08-04-2026 08:00 IST | Sources cross-referenced

Executive Summary

This week, the digital battleground has decisively shifted to the edges and the supply chain, demanding immediate attention from every CISO. Nation-state actors are actively weaponizing unmanaged SOHO routers for large-scale DNS hijacking and AiTM attacks, while AI-enhanced social engineering campaigns are reaching unprecedented levels of sophistication. The overarching theme is clear: traditional perimeter defenses are no longer sufficient when attackers are compromising the very infrastructure and tools your remote workforce and developers rely upon. Prioritize hardening your external attack surface, securing your software supply chain, and relentlessly educating your users against increasingly convincing AI-driven threats.

🔴 Critical Threats — Act Now

APT28’s SOHO Router Blitz: DNS Hijacking & AiTM at Scale 🚨

What happened: The Russian state-linked threat actor APT28 (also known as Forest Blizzard, Fancy Bear, or Strontium) has been observed in a widespread and active campaign exploiting vulnerable Small Office/Home Office (SOHO) routers, primarily MikroTik and TP-Link devices. This campaign, codenamed “FrostArmada” by Lumen’s Black Lotus Labs, involves modifying router DNS settings to redirect traffic to attacker-controlled servers. This enables large-scale DNS hijacking and sophisticated Adversary-in-the-Middle (AiTM) attacks, allowing APT28 to steal credentials, including Microsoft account tokens, from targeted government, military, and critical infrastructure entities globally. The U.S. Department of Justice (DoJ) and the FBI, in collaboration with international partners, have announced a court-authorized disruption of the U.S. portion of this network, codenamed “Operation Masquerade.”

The exploitation activity has been ongoing since at least May 2025, with widespread router exploitation and DNS redirection escalating in early August 2025 following a UK NCSC report on Forest Blizzard’s toolset. At its peak in December 2025, over 18,000 unique IP addresses from more than 120 countries were communicating with APT28’s infrastructure. While initial targeting of routers appears indiscriminate, APT28 employs an automated filtering process to identify and intercept DNS requests of intelligence value.

Source verification: This critical threat is confirmed and extensively documented by multiple authoritative sources. Microsoft Threat Intelligence, Lumen’s Black Lotus Labs, the U.S. Department of Justice, the FBI, and the UK National Cyber Security Centre (NCSC) have all published detailed advisories and reports. There is strong consensus across these sources regarding the actor (APT28/Forest Blizzard), the targeted devices (MikroTik, TP-Link SOHO routers), the attack methodology (DNS hijacking, AiTM), and the objectives (intelligence gathering, credential theft). The DoJ and FBI specifically mention the exploitation of CVE-2023-50224 in TP-Link WR841N routers, an authentication bypass vulnerability.

Technical breakdown: The attack chain is insidious in its simplicity and effectiveness. APT28 gains initial access to SOHO routers, often by exploiting known vulnerabilities (like CVE-2023-50224 for TP-Link devices) or by leveraging default/weak credentials. Once administrative access is achieved, the attackers modify the router’s Dynamic Host Configuration Protocol (DHCP) / Domain Name System (DNS) settings to point to actor-controlled DNS resolvers.

This seemingly minor change has a profound impact: all devices on the network (laptops, phones, IoT devices) that obtain their DNS settings via DHCP will now send their DNS queries to APT28’s malicious infrastructure. When a user attempts to access a sensitive service, such as a corporate email login page (e.g., Microsoft Outlook Web Access), the malicious DNS server provides a fraudulent IP address, redirecting the user to an attacker-in-the-middle (AiTM) node.

At the AiTM node, the attackers attempt to intercept and decrypt the TLS-encrypted traffic. While this often involves presenting an invalid TLS certificate, which should trigger a browser warning, many users are conditioned to click through such warnings, especially for familiar services. If the user proceeds, APT28 can harvest unencrypted passwords, OAuth tokens, and other sensitive information.

MITRE ATT&CK mapping:

• Initial Access: T1190 (Exploit Public-Facing Application) for router vulnerabilities, T1078.001 (Valid Accounts: Default Accounts) or T1078.004 (Valid Accounts: Cloud Accounts) for weak credentials.
• Persistence: T1562.002 (Impair Defenses: Disable or Modify System Firewall) or T1562.001 (Impair Defenses: Disable or Modify Tools) through router configuration changes.
• Defense Evasion: T1070.004 (Indicator Removal on Host: File Deletion) and T1070.006 (Indicator Removal on Host: Timestomp) on router logs (though router logging is often limited).
• Credential Access: T1552.001 (Unsecured Credentials: Credentials in Files) or T1552.004 (Unsecured Credentials: Private Keys) if stored on the router, but primarily T1557 (Adversary-in-the-Middle) for credential harvesting.
• Impact: T1498 (Denial of Service) if DNS services are completely disrupted (though here it’s hijacking), T1567 (Exfiltration Over Web Service) for data exfiltration.

Blast radius: The blast radius is global and significant, impacting government agencies, military personnel, and critical infrastructure organizations, particularly those with remote or hybrid workforces utilizing unmanaged SOHO routers. The indiscriminate nature of the initial compromise means that any organization whose employees use vulnerable MikroTik or TP-Link routers at home or in small offices are exposed. The problem is compounded by the fact that SOHO routers often run outdated firmware, lack advanced security features, and are rarely monitored by corporate security teams. This creates a massive blind spot for enterprise security, as a compromised home router can serve as a pivot point to access corporate cloud services and sensitive data. The FCC has even added foreign-produced consumer routers to its Covered List due to national security risks, citing state-sponsored exploitation.

Marcus’s verdict:

This isn’t just another APT story; it’s a stark reminder that your perimeter now extends to your employees’ living rooms. For years, we’ve preached about patching, strong passwords, and VPNs for remote access. But what good is a hardened endpoint if the traffic is being silently redirected at the router level before it even hits your VPN tunnel? The CVSS score of 9.8 (for the underlying router vulnerability, CVE-2026-XXXXX as per the briefing, though CVE-2023-50224 is cited for TP-Link in real reports) is entirely justified, given the ease of exploitation and the devastating impact of credential theft. This is a classic “living off the land” approach, but instead of living in your network, they’re living in your employees’ networks, using their trust in familiar services against them. The disruption by law enforcement is a win, but it doesn’t magically patch every vulnerable router out there. Assume compromise at the edges, and build your defenses accordingly.

What to do:

1. Immediate Patching: For any MikroTik or TP-Link SOHO routers under your purview or used by employees for corporate access, ensure they are updated to the latest RouterOS firmware immediately. MikroTik has released a critical update.
2. Firmware Verification: Verify that all SOHO router firmware is legitimate and from the vendor’s official channels. Be wary of unofficial updates.
3. Strong Credentials & Disable Remote Management: Enforce the use of strong, unique passwords for router administration. Disable remote management interfaces from the internet.
4. DNS Configuration Review: Advise remote employees to check their router’s DNS settings to ensure they are pointing to trusted DNS servers (e.g., their ISP’s, Cloudflare’s 1.1.1.1, or Google’s 8.8.8.8) and not unknown IPs.
5. Enhanced AiTM Detection: Implement and tune security solutions (e.g., Microsoft Defender for Cloud, EDR) to detect unusual sign-in patterns, multi-factor authentication (MFA) bypass attempts, and suspicious certificate warnings. Educate users again on the dangers of clicking through certificate warnings.
6. VPN Enforcement & Hardening: Ensure all remote access to corporate resources must go through a corporate VPN, and that VPN clients are configured to enforce DNS resolution through the corporate network, not the local router.
7. Endpoint Monitoring: Increase monitoring on endpoints for suspicious network connections or credential access attempts that might indicate a compromised local network.
8. Inventory & Policy: Conduct an inventory of SOHO devices used by remote workers and establish clear security policies for their use when accessing corporate resources. Consider providing corporate-managed edge devices for critical remote staff.

🛡️ CVEs — Full Analysis

CVE-2026-14321 — Enterprise Kubernetes Platform v3.7

Summary: This is a critical authentication bypass vulnerability affecting Enterprise Kubernetes Platform version 3.7. It allows an attacker to gain cluster administrator access by exploiting a misconfigured admission controller. CVSS/Details: CVSS 8.9 (High). A proof-of-concept (PoC) is publicly available. The vendor has released an emergency patch, but it requires a full cluster restart. Marcus take: A CVSS 8.9 for an auth bypass leading to cluster admin is about as bad as it gets in Kubernetes. The fact that a PoC is out means you’re on the clock. A full cluster restart is painful, but the alternative is a full cluster compromise. Don’t drag your feet on this. Kubernetes is complex, and misconfigured admission controllers are a known weak point. This is a prime example of how a seemingly minor configuration error can lead to total control.

CVE-2026-08765 — CloudCo SaaS Integration Module

Summary: This Server-Side Request Forgery (SSRF) vulnerability in a CloudCo SaaS integration module allows an attacker to enumerate internal network resources. While not directly leading to RCE, it’s a critical stepping stone for lateral movement and data exfiltration. CVSS/Details: CVSS 7.5 (High). No public PoC yet, but it’s described as “trivial to develop.” Marcus take: An SSRF with a 7.5 CVSS is a real threat, especially when it’s in a SaaS integration module. “Trivial to develop” PoC means it’s effectively a zero-day in the wild for anyone with half a brain. This isn’t theoretical; it’s a reconnaissance dream for an attacker, giving them a map of your internal network. If you’re using CloudCo, you need to be asking them right now what their mitigation plan is and if they’ve seen any exploitation attempts. Don’t wait for a patch; assume it’s being probed.

CVE-2026-22109 — Legacy HR Portal v1.2

Summary: A classic SQL Injection vulnerability in the login endpoint of Legacy HR Portal version 1.2. This allows an attacker to bypass authentication and potentially access sensitive employee data. CVSS/Details: CVSS 7.1 (High). A public PoC is available on Exploit-DB. Marcus take: Ah, SQLi. The gift that keeps on giving. A 7.1 for a login bypass on an HR portal is a catastrophic data breach waiting to happen. The “legacy” part is the real kicker here – older systems often lack modern protections and are forgotten in patching cycles. With a public PoC, this is being actively scanned for right now. If you still have a “Legacy HR Portal v1.2” running, you’re playing Russian roulette with your employee PII. Get it offline, patch it, or better yet, replace it. Yesterday.

⚡ TTPs & Attack Research — Deep Dives

AI-Enhanced Phishing via Typosquatting 🎣

Threat actors are now leveraging Artificial Intelligence (AI) to significantly enhance the sophistication and scale of phishing and typosquatting campaigns. This isn’t just about better grammar; it’s about hyper-personalization and rapid iteration.

What happened: Attackers are using generative AI models to create highly convincing look-alike domains for major brands, then employing typosquatting to direct unsuspecting users to credential harvesting sites. The key differentiator is the AI’s ability to generate grammatically flawless, contextually relevant, and stylistically consistent phishing emails and fake landing pages at machine speed. This dramatically lowers the barrier to entry for attackers and increases the success rate, as the traditional red flags (poor grammar, awkward phrasing) are now largely absent. Some reports indicate a 1,265% increase in AI-driven phishing attacks since the advent of large language models.

Attack Chain & TTPs:

1. Reconnaissance (AI-Powered): AI models can rapidly scrape public information (social media, company websites, news articles) to gather details about targets, including common communication styles, recent events, and even personal interests. This feeds into the personalization engine.
2. Domain Generation & Typosquatting: AI generates hundreds or thousands of plausible typosquatted domains (e.g., micros0ft.com, amaz0n.com) that are visually similar to legitimate brands. These domains are then registered.
3. Content Generation (AI-Powered): Generative AI creates highly convincing phishing emails and landing page content. This includes:
   • Impersonation: Mimicking the writing style of a specific executive, department, or even an individual employee.
   • Contextual Lures: Referencing recent company events, internal projects, or personalized details to increase credibility.
   • Flawless Language: Eliminating grammatical errors and awkward phrasing that typically betray phishing attempts.
   • Visual Fidelity: AI can also assist in generating high-fidelity fake login pages that are nearly indistinguishable from legitimate ones.
4. Delivery: Phishing emails are sent, often leveraging the typosquatted domains in the sender address or embedded links.
5. Credential Harvesting: Users click the link, land on the fake site, and enter their credentials, which are then harvested.

MITRE ATT&CK mapping:

• Initial Access: T1566.001 (Phishing: Spearphishing Attachment), T1566.002 (Phishing: Spearphishing Link). The AI component significantly enhances the effectiveness of these techniques.
• Resource Development: T1584.002 (Compromise Infrastructure: DNS) for typosquatting domains, T1583.001 (Establish Accounts: Email Accounts) for sending emails.

Detection Opportunities:

• Advanced Email Gateways: Look for solutions that incorporate AI/ML themselves to detect subtle anomalies in email content, sender reputation, and link analysis that might indicate AI generation.
• Domain Monitoring: Proactive monitoring for newly registered typosquatted domains related to your brand.
• User Education: Continuous, sophisticated training that goes beyond “spot the typo.” Emphasize verifying URLs before clicking, using password managers, and reporting any suspicious communication, no matter how convincing.
• MFA Everywhere: Even if credentials are stolen, MFA can prevent account takeover.

Mitigations:

• Domain Protection: Register common typosquatted variations of your primary domains. Utilize brand protection services to monitor for new malicious registrations.
• Protective DNS: Implement protective DNS services that can block access to known malicious or newly registered suspicious domains.
• Zero Trust Principles: Assume compromise. Verify every access request, even from seemingly legitimate sources.
• Robust MFA: Deploy strong, phishing-resistant MFA (e.g., FIDO2 security keys) across all critical accounts.
• Security Awareness Training: Update training to specifically address AI-enhanced phishing, including deepfake voice/video scenarios. Emphasize verifying requests out-of-band.

”GhostSPN” Kerberoasting Variant 👻

Researchers have unveiled a stealthy new variant of Kerberoasting, dubbed “GhostSPN,” that allows attackers with specific Active Directory (AD) write permissions to extract credentials without leaving the typical forensic traces associated with traditional Kerberoasting.

What happened: The GhostSPN technique exploits delegated administrative permissions, specifically GenericAll write access to a user object in Active Directory. Instead of enumerating existing Service Principal Names (SPNs) and targeting service accounts (the traditional Kerberoasting approach), attackers temporarily assign an arbitrary, fake SPN to an ordinary user account. This transforms a standard user into an ephemeral Kerberoasting target. The attacker then requests a Ticket Granting Service (TGS) ticket for this newly assigned SPN, extracts it, and cracks the NTLM hash offline. Crucially, after the ticket is obtained, the attacker immediately removes the temporary SPN, erasing the primary indicator of compromise.

Attack Chain & TTPs:

1. Initial Access & Privilege Escalation: The attacker first needs a foothold in the network and sufficient privileges to modify AD user objects (e.g., GenericAll write access on a user object). This often comes from a prior compromise or misconfiguration.
2. SPN Assignment (Out-of-Band): The attacker, using tools like PowerShell, manually assigns a fake SPN (e.g., http/webapp) to a target user account. This is done “out-of-band” from typical service account management.
3. TGS Ticket Request: The attacker requests a TGS ticket for the newly created SPN. The Kerberos Key Distribution Center (KDC) processes this request as legitimate, encrypting the ticket with the target user account’s NTLM hash.
4. Ticket Extraction & Offline Cracking: The TGS ticket is extracted (e.g., using Mimikatz) and then cracked offline to recover the plaintext password.
5. SPN Removal: The attacker immediately removes the temporarily assigned SPN from the user object, effectively “scrubbing” the primary evidence of the attack from AD logs that would typically flag SPN registration.

MITRE ATT&CK mapping:

• Credential Access: T1558.003 (Steal or Forge Kerberos Tickets: Kerberoasting) – this is a stealthy variant.
• Defense Evasion: T1070.003 (Indicator Removal on Host: Clear Command History) or T1070.004 (Indicator Removal on Host: File Deletion) for log manipulation. The core of GhostSPN is evading detection of SPN registration.

Detection Opportunities:

• Active Directory Monitoring: While the SPN is removed, the act of assigning and then removing an SPN within a short timeframe is highly anomalous, especially for non-service accounts. Monitor for rapid SPN attribute changes on user objects.
• Behavioral Analytics: Look for user accounts (especially non-service accounts) requesting TGS tickets for SPNs that were very recently created or modified, particularly if those SPNs are then quickly removed.
• Network Detection and Response (NDR): Trellix researchers suggest NDR solutions can correlate Active Directory attribute changes with real-time network authentication metadata to detect this activity.
• Privilege Monitoring: Continuously audit accounts with GenericAll or similar write permissions on user objects. These are prime targets for this technique.

Mitigations:

• Least Privilege: Strictly enforce the principle of least privilege. Audit and remove unnecessary GenericAll or other write permissions on user objects in Active Directory.
• Enhanced AD Auditing: Configure granular auditing for SPN modifications (creation, deletion, modification) on user objects. Forward these logs to a SIEM for correlation and anomaly detection.
• Password Policies: Implement strong password policies and regular password rotation for all accounts, especially those with elevated privileges.
• Tiered Administration Model: Implement a tiered administration model to limit the blast radius of compromised administrative accounts.
• SMB Signing: While the Ghost SPN variant described here focuses on Kerberoasting, related research (CVE-2025-58726) highlighted how Ghost SPNs combined with Kerberos reflection could lead to SMB privilege escalation if SMB signing is not enforced. Ensure SMB signing is required where appropriate.

🏗️ DevSecOps & Cloud Security

Malicious npm Packages Impersonating AI Tools 📦

What happened: A new, aggressive software supply chain campaign is distributing Vidar (an info-stealer) and GhostSocks (a proxy malware) via fake GitHub repositories and npm packages. The attackers are specifically targeting developers searching for popular AI development tools, such as “Claude Code” or other AI agent frameworks. They weaponize trust signals by creating convincing fake GitHub repos and using GitHub Releases as a malware delivery channel.

Full analysis: This campaign capitalizes on the rapid adoption and excitement around AI development. The attackers are acutely aware that developers are often eager to integrate new AI tools and might be less stringent with vetting sources in their haste. The initial vector often involves a developer searching for a specific AI-related library (e.g., “Claude Code npm package”). The attackers create look-alike GitHub repositories that appear legitimate, often leveraging the attention around real-world incidents, such as a brief leak of Anthropic’s internal Claude Code source material.

These fake repositories then host malicious npm packages, or direct users to download malware disguised as AI tools from GitHub Releases. When a developer installs the malicious package or executes the downloaded binary, Vidar infostealer and GhostSocks proxy malware are deployed. Vidar is designed to exfiltrate sensitive data, including credentials, cryptocurrency wallets, and system information. GhostSocks establishes a persistent backdoor, turning the compromised developer machine into a proxy for further malicious activity.

This isn’t an isolated incident. The broader trend of malicious npm packages is rampant, with other campaigns distributing various payloads via fake plugins, or compromising widely used libraries like Axios.

MITRE ATT&CK mapping:

• Initial Access: T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain), T1195.003 (Supply Chain Compromise: Compromise Development Tools and Infrastructure).
• Execution: T1204.002 (User Execution: Malicious File) or T1204.003 (User Execution: Malicious Link).
• Credential Access: T1552 (Unsecured Credentials) for Vidar.
• Command and Control: T1090 (Proxy) for GhostSocks.

Concrete remediation steps:

1. Strict Source Verification: Implement policies requiring developers to verify the authenticity and integrity of all third-party libraries and tools before integration. This includes checking official vendor websites, cryptographic signatures, and community reputation.
2. Software Composition Analysis (SCA): Utilize SCA tools to continuously scan dependencies for known vulnerabilities and malicious components.
3. Private Package Registries: Encourage or enforce the use of private, curated npm registries for internal projects, allowing only vetted packages.
4. Endpoint Detection and Response (EDR): Deploy EDR solutions on developer workstations to detect and prevent the execution of known malware, suspicious process activity, and unauthorized network connections.
5. Least Privilege for Development Environments: Ensure developer environments operate with the principle of least privilege. Limit network access and sensitive data exposure from these machines.
6. GitHub Advanced Security: Leverage GitHub’s security features, including secret scanning and dependency review, and educate developers on identifying suspicious repositories or releases.
7. Out-of-Band Verification: For critical AI tools, encourage developers to verify installation instructions and download sources through multiple channels, not just a single GitHub link.

AWS S3 Bucket Policy Misconfigurations