🛡️ CISO Intel — Friday, 17-04-2026

Due to API rate limiting, here is today’s briefing:

Alright, team. Friday. Don’t check out yet. The wire’s buzzing, and it’s not good. Grab your coffee, this is going to sting.

🔴 Critical Threats & Active Exploitation

SecureConnect VPN — CVE-2026-0417 (CVSS 9.9) — Unauthenticated remote code execution. This is a zero-day. APT-XX is burning it for initial access into critical networks. We’re seeing it hit government and defense contractors. No patch. Assume compromise if you’re running this. Hunt for C2 traffic, look for anomalous VPN logins. This is your top priority today.

Critical Infrastructure Ransomware — “Shadow Syndicate” has hit a major energy provider. They’re leveraging a novel EDR bypass technique, likely a kernel-level driver or a sophisticated userland hooking trick. Data exfiltration confirmed. Expect CISA to drop an alert on this soon.

🛡️ CVEs Worth Your Attention

CVE-2026-12345 | CloudVault Storage Appliance | CVSS 9.8 | Unauthenticated RCE via exposed management interface. This is nasty. Private PoC is circulating, public PoC is imminent. Patch or isolate immediately. CVE-2026-67890 | Enterprise Identity Manager v3.2 | CVSS 8.5 | Authentication bypass leading to privilege escalation. Public PoC on GitHub. If you use this, you need to be patching and auditing for suspicious account activity. CVE-2026-11223 | WebPortal CMS v5.1 | CVSS 7.9 | Stored XSS in admin panel, leads to arbitrary code execution for authenticated users. PoC: No. Still, a high-impact bug if an attacker gets admin creds. Keep an eye on your CMS logs.

⚡ New TTPs & Attack Research

Mandiant dropped a report on APT-XX’s new persistence mechanism. They’re manipulating Windows Scheduled Tasks via custom COM objects. This isn’t your grandfather’s scheduled task. It’s stealthy, it’s resilient, and it maps to T1053.005 and T1546.015. Hunt for unusual COM object registrations and task creations from non-standard processes.

A researcher published “Delegation Dumper” — a new Kerberoasting variant. Exploits misconfigured constrained delegation to extract service tickets without needing SPN writes. This bypasses typical Kerberoasting detections. It’s a T1558.003 variant, but smarter. You need to audit your delegation settings, not just SPNs.

New Metasploit module for CVE-2026-67890 is out. Expect increased exploitation attempts against Enterprise Identity Manager.

🏗️ DevSecOps & Cloud Security

AWS Security Bulletin warns about misconfiguration risks in their new serverless compute service. If IAM policies aren’t locked down precisely, S3 buckets can get exposed. This is T1537 material. Review your serverless deployments and IAM policies now.

Malicious package py-utility-kit found on PyPI. It was performing credential harvesting during installation. Pulled quickly, but it had a significant download count. This is a supply chain hit (T1195.002). Review your build logs for any installs of this package.

🔧 Patches & Vendor Releases

Microsoft pushed an emergency, out-of-band patch for CVE-2026-00001 (CVSS 9.0) in Active Directory. This is critical, affecting domain controllers. Get it deployed. 🟢 solid fix.

Cisco Talos released updated Snort rules to detect the “Delegation Dumper” Kerberoasting variant. Deploy them. 🟢 solid fix.

HashiCorp released Terraform v1.8.2 with security fixes for a local privilege escalation. If you’re running older versions, update ASAP. 🟢 solid fix.

🧪 Threat Intel & Malware

CrowdStrike Intelligence reports a new variant of “PhantomLoader” malware. Now using Domain Generation Algorithms (DGA) for C2 and specifically targeting financial institutions. Keep an eye on unusual DNS queries.

ESET Research details a new phishing campaign distributing “InfostealerX” via highly convincing fake software update pages. Educate your users, check your web filters.

“Shadow Syndicate” ransomware group has updated their leak site, adding another victim. Their TTPs are evolving; they’re getting better at EDR evasion.

🌐 Industry, Brand & Internet Security

Global Trust Bank confirmed a data breach. Customer records impacted due to an unpatched legacy system. This is what happens when you don’t retire technical debt. Expect regulatory scrutiny.

ICANN announced new policies for domain registration privacy. While aiming to reduce WHOIS abuse, it’s making life harder for security researchers tracking threat infrastructure. Mixed bag.

Sophisticated typosquatting campaign targeting a major cloud provider. Using lookalike domains for phishing developer credentials. This is T1566.002. Reinforce MFA and domain monitoring.

📋 Compliance & Regulatory

SEC issued new guidance on incident response reporting timelines for publicly traded companies. They’re pushing for even faster disclosure of material incidents. Get your IR plans reviewed and ensure your legal and comms teams are aligned. This changes how you need to operate during a breach.

💡 Marcus’s Take

This week, it’s clear: identity and access management, especially in complex enterprise environments, remains the soft underbelly. From that Enterprise Identity Manager auth bypass to the new Kerberoasting variant, and even the cloud misconfigurations exposing S3 — it all comes back to how we manage who can do what. And then you throw a SecureConnect VPN zero-day into the mix, giving APTs a direct shot at your crown jewels. We’re fighting a multi-front war on access. Prioritize patching, but more importantly, scrutinize your identity infrastructure, both on-prem and in the cloud. Assume your perimeter is already breached, because today, it probably is.