🛡️ CISO Intel — Saturday, 20-06-2026

By Marcus Reed | 19-06-2026 08:00 IST → 20-06-2026 08:00 IST | All sources cross-referenced

Executive Summary

It’s Saturday, and the threat landscape is anything but quiet. The single most critical item demanding immediate attention is the FortiGate SSL VPN unauthenticated RCE, CVE-2026-40201 (CVSS 9.8). This vulnerability is being actively exploited in the wild, notably by the Rhysida ransomware gang, for initial access, leading directly to full system compromise. Patching this device is not a “Monday morning” task; it’s a “drop everything and do it now” mandate. Beyond this critical flaw, we’re seeing continued evolution in loader evasion techniques, clever Kerberos delegation abuse in hybrid Azure AD, and persistent supply chain risks in cloud and open-source ecosystems.

🔴 Critical Threats — Act Now

FortiGate SSL VPN — CVE-2026-40201 (CVSS 9.8) — Unauthenticated RCE

What happened: Fortinet has released an emergency patch, FG-IR-26-003, for a critical pre-authentication remote code execution (RCE) vulnerability, CVE-2026-40201, affecting their FortiGate SSL VPN products. This heap-based buffer overflow allows a remote, unauthenticated attacker to execute arbitrary code with root privileges on the device, leading to full system compromise. The vulnerability was added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog today, indicating active exploitation in the wild. Multiple APT groups are reportedly leveraging this flaw for initial access, and more alarmingly, the Rhysida ransomware gang is actively weaponizing it to breach healthcare organizations and other targets.

Source verification: The information is confirmed by multiple authoritative sources. CISA’s KEV Catalog listing provides strong validation of active exploitation. Fortinet’s PSIRT advisory (FG-IR-26-003) details the vulnerability and provides patching instructions. Independent security researchers, such as those from Kudelski Security and Rapid7, have previously highlighted the severe implications of such pre-authentication RCEs in FortiGate SSL VPNs, noting the widespread internet exposure of these devices. BleepingComputer and other threat intelligence firms corroborate the active use by Rhysida. The NVD entry for CVE-2026-40201 confirms its existence but notes it is “Not Scheduled” for NVD enrichment, meaning it lacks CVSS vector strings and detailed analysis directly from NIST, likely due to recent NVD policy changes prioritizing critical categories only. However, the CVSS 9.8 score is widely reported by vendors and aligns with the severity of an unauthenticated RCE on an edge device.

Technical breakdown: CVE-2026-40201 is described as a heap-based buffer overflow vulnerability within the SSL-VPN component of FortiOS. Attackers can trigger this flaw by sending specially crafted HTTPS requests to the SSL-VPN service, typically on TCP port 443. These requests contain oversized data fields that cause the buffer to overflow, corrupting adjacent memory and allowing the attacker to control the execution flow. Since this is a pre-authentication vulnerability, no valid credentials are required, making it extremely easy to exploit. Successful exploitation grants root privileges on the FortiGate device itself.

The attack kill chain typically involves:

1. Initial Access (MITRE ATT&CK T1190: Exploit Public-Facing Application): An unauthenticated attacker sends malicious requests to an internet-exposed FortiGate SSL VPN.
2. Execution (MITRE ATT&CK T1059: Command and Scripting Interpreter): The buffer overflow allows the attacker to execute arbitrary code with root privileges on the device.
3. Persistence (MITRE ATT&CK T1543.003: Create or Modify System Process: Windows Service): Attackers often establish persistence, for example, by creating new administrative accounts or implanting backdoors. Previous FortiGate exploits have shown persistence mechanisms like symbolic link (symlink) abuse.
4. Privilege Escalation (MITRE ATT&CK T1068: Exploitation for Privilege Escalation): While the initial exploit often grants root, subsequent actions might involve further privilege escalation within the internal network.
5. Lateral Movement (MITRE ATT&CK T1021: Remote Services): From the compromised FortiGate, attackers can then pivot into the internal network, often using the VPN’s access to reach internal resources.

Public Proof-of-Concept (PoC) code is not yet widely available on platforms like GitHub for CVE-2026-40201 specifically, likely due to its recency and critical nature. However, the rapid inclusion in CISA KEV and active exploitation suggests that sophisticated threat actors have developed their own exploits. Discussions on X/Twitter and Reddit’s r/netsec and r/cybersecurity indicate high awareness and urgency among defenders, with many sharing Fortinet’s advisory and urging immediate patching.

Blast radius: The blast radius for this vulnerability is catastrophic. FortiGate firewalls and SSL VPNs are widely deployed as perimeter security devices, providing remote access to corporate networks. An unauthenticated RCE on such a device means an attacker gains a direct foothold into the entire internal network, bypassing traditional perimeter defenses. All organizations using affected FortiGate SSL VPN versions are exposed. Given the historical exploitation patterns of FortiGate vulnerabilities, the majority of internet-accessible appliances are likely vulnerable if not immediately patched. The direct targeting of healthcare by Rhysida ransomware further amplifies the risk, as these organizations often handle sensitive patient data and face severe operational disruption from ransomware.

Marcus’s verdict: This isn’t a drill. This is the kind of vulnerability that keeps CISOs up at 3 AM. An unauthenticated RCE on your network edge is the digital equivalent of leaving your front door wide open with a sign that says “Please take everything.” The CVSS 9.8 is absolutely accurate, if not understated, given the real-world impact. The fact that Rhysida is already using it means the clock is ticking in hours, not days. If you run FortiGate SSL VPN, you must patch this immediately. Don’t wait for your change window, don’t wait for Monday. Your skeleton crew on a Saturday needs to be all hands on deck for this. The vendor isn’t downplaying it; the threat is as real as it gets.

Actions:

1. Immediate Patching: Deploy Fortinet’s emergency patch FG-IR-26-003 for CVE-2026-40201 to all affected FortiGate SSL VPN devices now. Verify the patch has been successfully applied.
2. Indicators of Compromise (IoCs) Review: Scrutinize logs for any signs of compromise, including unusual login attempts, new user accounts (especially fortinet-tech-support or fortigate-tech-support which have been IoCs in past Fortinet exploits), unexpected process execution, or outbound connections from the FortiGate device.
3. Network Segmentation & MFA: Ensure robust network segmentation is in place to limit lateral movement even if the device is compromised. Enforce multi-factor authentication (MFA) for all VPN access, though be aware that some pre-auth RCEs can bypass MFA if not properly configured.
4. Out-of-Band Management: Review and harden management interfaces, ideally moving them to an out-of-band network.
5. Threat Hunting: Actively hunt for Rhysida ransomware activity within your network, especially if you have FortiGate devices exposed. Look for their typical TTPs post-exploitation.

Sources: CISA KEV Catalog, Fortinet PSIRT Advisory FG-IR-26-003, NVD CVE-2026-40201, BleepingComputer, Kudelski Security Research Center, SentinelOne, Rapid7 Blog, Assetnote, Ransomware.live, NVD, Blumira, From Exploit to Escalation: Tracking and Containing a Real-World Fortinet SSL-VPN Attack, VULNERABILITY BULLETINS, SSL-VPN Symlink Persistence Patch Bypass - PSIRT | FortiGuard Labs, Black Duck Blog, CISA #StopRansomware: Rhysida Ransomware, Huntress, Vectra AI, BlackFog, FourCore ATTACK, HHS.gov, Trend Micro, DeXpose, Recorded Future

🛡️ CVEs — Full Analysis

CVE-2026-51302 — Microsoft SQL Server v2022

Summary: This is a Remote Code Execution (RCE) vulnerability in Microsoft SQL Server 2022, carrying a CVSS score of 8.3. The vulnerability stems from a deserialization flaw, which, if exploited, allows an authenticated attacker to execute arbitrary code on the SQL Server. A public Proof-of-Concept (PoC) is available, increasing the immediate risk. CVSS/Details: CVSS 8.3 (High). This vulnerability requires authenticated access, meaning an attacker would first need to compromise a legitimate SQL Server account. However, SQL service accounts are often highly privileged and can be attractive targets for lateral movement once an attacker is inside a network. The patch is included in the latest Cumulative Update for SQL Server 2022. Marcus’s take: An 8.3 for an authenticated RCE is a fair score. While “authenticated” might sound like a relief, it’s a false sense of security for SQL Servers. Service accounts, often configured with excessive privileges and sometimes weak passwords, are prime targets for attackers already within your perimeter or those who’ve gained initial access via other means (like that FortiGate RCE we just talked about). A public PoC means this will be weaponized quickly. This isn’t a “wait for next patch Tuesday” item if you have internet-facing SQL servers or a high-risk internal environment.

Source: MSRC — https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-51302

CVE-2026-33015 — VMware ESXi v8.0.x

Summary: This vulnerability is a Local Privilege Escalation (LPE) flaw in VMware ESXi version 8.0.x, rated with a CVSS score of 7.5 (High). The vulnerability exists within the vmtoolsd service, allowing an attacker who has already gained access to a guest operating system to escalate their privileges to root on the underlying ESXi host. A public PoC is available. CVSS/Details: CVSS 7.5 (High). This LPE requires prior access to a virtual machine running on the ESXi host. Once an attacker has a foothold in a guest VM, this vulnerability provides a clear path to compromise the hypervisor itself, which is a critical control plane for your virtualized infrastructure. Marcus’s take: A 7.5 for an LPE might seem lower than an RCE, but don’t be fooled. In a virtualized environment, compromising the hypervisor is the ultimate prize for an attacker. It’s game over for every VM running on that host. “Attackers already on the host” is the story of lateral movement. This is a critical link in the kill chain for many sophisticated attacks. Patching ESXi is often a tedious process, but the risk of a compromised hypervisor far outweighs the operational inconvenience.

Source: Tenable Research — https://www.tenable.com/security/research/tra-2026-12

⚡ TTPs & Attack Research — Deep Dives

New Bumblebee Loader Variant

What happened: CrowdStrike Intelligence has identified a new variant of the Bumblebee loader, showcasing advanced anti-analysis techniques designed to evade detection by Endpoint Detection and Response (EDR) solutions. This variant specifically leverages API hashing and indirect syscalls to bypass EDR hooks, making its post-exploitation payload significantly stealthier. Initial access for Bumblebee remains consistent, primarily through phishing campaigns. Technical breakdown:

• Bumblebee’s Role: Bumblebee is a sophisticated loader, often used as a precursor to other malware families, including ransomware. Its primary function is to establish a foothold and then download and execute additional payloads.
• API Hashing (MITRE ATT&CK T1027.004: Obfuscated Files or Information: Compile After Delivery / T1027.002: Software Packing): Instead of directly calling Windows API functions by name, this variant hashes the API function names and resolves them at runtime. This technique makes it harder for EDRs to identify malicious API calls by simply scanning for known function names in the import address table (IAT) or through static analysis. The EDR hook, which often intercepts direct API calls, can be bypassed.
• Indirect Syscalls (MITRE ATT&CK T1055.004: Process Injection: Process Hollowing / T1055.012: Process Injection: Thread Execution Hijacking): Traditional EDRs often place hooks in user-mode libraries (like ntdll.dll) to monitor system calls. Indirect syscalls involve the malware directly invoking the kernel-mode system call dispatcher, bypassing these user-mode hooks. This allows the malware to execute privileged operations without triggering EDR alerts that rely on user-mode API monitoring.
• Attack Chain: A user falls victim to a phishing email, often containing a malicious attachment or link. This leads to the initial compromise, and the new Bumblebee variant is deployed. Once executed, it uses its anti-analysis techniques to remain undetected while preparing for the download and execution of the next-stage payload, such as a Cobalt Strike beacon or ransomware. Detection opportunities:
• Behavioral Analysis: While API hashing and indirect syscalls evade signature-based and some hook-based detections, the behavior of the malware (e.g., process injection, unusual network connections, attempts to disable security software) can still be detected by advanced EDR/XDR solutions.
• Kernel-level Monitoring: EDRs that operate at a deeper kernel level might still intercept indirect syscalls, though this is more challenging.
• Network Egress: Monitoring for suspicious outbound connections (e.g., to known command-and-control infrastructure) remains crucial.
• Memory Forensics: Post-exploitation, memory analysis might reveal the de-obfuscated code or injected payloads. Mitigations:
• Robust Email Security: Implement advanced email gateways with strong anti-phishing capabilities.
• User Awareness Training: Continuous training to recognize and report phishing attempts.
• Advanced EDR/XDR: Deploy EDR/XDR solutions capable of behavioral analysis, kernel-level monitoring, and threat intelligence integration.
• Application Whitelisting: Restrict unauthorized executables from running.
• Principle of Least Privilege: Limit user permissions to reduce the impact of a successful initial compromise.

Sources: CrowdStrike Intelligence — https://www.crowdstrike.com/blog/new-bumblebee-variant-evasion/

Kerberos Delegation Abuse in Azure AD

What happened: Researchers at SpecterOps have detailed a novel method for escalating privileges within hybrid Azure AD environments. This technique chains misconfigured constrained delegation settings with the privileges of Azure AD Connect sync accounts, allowing attackers to gain elevated access. Technical breakdown:

• Kerberos Delegation: In Active Directory, Kerberos delegation allows a service to impersonate a user when accessing another service. Constrained delegation restricts this impersonation to specific services.
• Azure AD Connect Sync Accounts: These accounts are critical in hybrid environments, responsible for synchronizing identities between on-premises Active Directory and Azure AD. They often hold significant privileges to perform their synchronization tasks.
• The Attack Chain (MITRE ATT&CK T1558.003: Steal or Forge Kerberos Tickets: Kerberoasting - Note: While the briefing cites T1558.003, this technique is more broadly about Kerberos abuse, specifically delegation, rather than Kerberoasting which targets service principal names (SPNs) for password cracking. However, it falls under the umbrella of Kerberos attack vectors.):
  1. Initial Compromise: An attacker gains control of an Azure AD Connect sync account. This could be through phishing, credential stuffing, or exploiting a vulnerability in a system where the account’s credentials are stored.
  2. Discovery: The attacker enumerates Kerberos delegation settings, specifically looking for misconfigured constrained delegation where the sync account has overly permissive delegation rights.
  3. Abuse of Delegation: By leveraging the compromised sync account and its misconfigured delegation, the attacker can request Kerberos service tickets on behalf of other users (including highly privileged ones) to access services that the sync account is delegated to. This effectively allows the attacker to impersonate these users and escalate privileges.
  4. Privilege Escalation: This impersonation can lead to full domain compromise in the on-premises AD or significant privilege escalation within the Azure AD environment, depending on the delegated services and the scope of the sync account’s permissions.
• Why it’s clever: This attack exploits a common misconfiguration pattern that arises from the complexity of hybrid environments. Organizations often grant broad permissions to sync accounts to ensure smooth operation, inadvertently creating a powerful pathway for privilege escalation if those accounts are compromised. Detection opportunities:
• Anomalous Kerberos Activity: Monitor for unusual Kerberos service ticket requests originating from Azure AD Connect sync accounts, especially requests for high-privilege services or from unusual source IPs.
• Changes to Delegation Settings: Audit changes to Kerberos delegation settings in Active Directory.
• Sync Account Activity: Monitor the Azure AD Connect sync account for any activity outside its normal synchronization operations. Mitigations:
• Principle of Least Privilege: Strictly adhere to the principle of least privilege for Azure AD Connect sync accounts. Only grant the minimum necessary permissions for synchronization.
• Secure Sync Account Credentials: Implement strong, unique passwords and enforce multi-factor authentication (MFA) for the sync account where possible. Consider using managed service accounts (MSAs) or group managed service accounts (gMSAs).
• Regular Audits: Periodically audit Kerberos delegation settings and sync account permissions to identify and correct misconfigurations.
• Network Segmentation: Isolate the Azure AD Connect server and restrict its network access.
• Threat Intelligence: Stay informed on new attack techniques targeting hybrid identity environments.

Sources: SpecterOps Blog — https://posts.specterops.io/azure-ad-connect-kerberos-delegation-abuse-2026/

🏗️ DevSecOps & Cloud

AWS S3 Bucket Policy Misconfiguration

What happened: AWS has issued a new security bulletin highlighting a common misconfiguration pattern in S3 bucket policies that can lead to unauthorized public access to sensitive data. This isn’t a vulnerability in AWS itself, but rather a user-induced configuration error where specific s3:GetObject policies, when combined with certain IAM roles, inadvertently grant public read access. Technical breakdown:

• The Problem: While S3 buckets are private by default, customers can configure policies to allow access. The issue arises when an s3:GetObject policy, intended for specific, limited access (e.g., by internal applications or known users), is too broadly defined or combined with an IAM role that itself has overly permissive trust policies. This can result in unintended “public” access, where anyone on the internet can retrieve objects from the bucket. For example, a policy might allow s3:GetObject from “any principal” ("Principal": "*") but be intended to be restricted by other conditions, which are either missing or incorrectly applied.
• Impact: This misconfiguration leads to data exposure, potentially including sensitive customer data, proprietary information, or internal documents. Such breaches can result in significant reputational damage, regulatory fines (e.g., under GDPR, CCPA), and legal liabilities. Concrete Remediation:

1. Block Public Access (BPA): Enable S3 Block Public Access (BPA) at the account level. This is the strongest defense and should be the default for almost all S3 buckets. BPA overrides individual bucket and object permissions that would otherwise allow public access.
2. Least Privilege for Policies: Review all S3 bucket policies and IAM roles associated with S3 access. Ensure that s3:GetObject (and other actions) are granted only to the absolute minimum necessary principals and with the tightest possible conditions (e.g., specific VPC endpoints, IP ranges, or authenticated users). Avoid "Principal": "*" unless truly intended for public web hosting, and even then, use condition keys.
3. IAM Access Analyzer: Utilize AWS IAM Access Analyzer for S3 to identify buckets with unintended public or cross-account access. This tool can proactively flag policies that allow access to external entities.
4. Regular Audits: Conduct regular automated and manual audits of S3 bucket policies and IAM roles.
5. Encryption and Versioning: While not directly preventing public access, enforce server-side encryption (SSE) and enable versioning to protect data at rest and provide recovery options.

Sources: AWS Security Bulletin — https://aws.amazon.com/security/security-bulletins/AWS-2026-003/, JumpCloud, Pentera, Snyk, Misconfigured Amazon S3 Buckets: A Glaring Vulnerability, AWS Security Hub

Malicious PyPI Package “colorama-ng”

What happened: A malicious package named “colorama-ng” was discovered on the Python Package Index (PyPI), attempting to exfiltrate environment variables and SSH keys during installation. This was a typo-squatting attack, leveraging a common misspelling or similar name to trick developers into installing it instead of the legitimate colorama package. The package has since been removed from PyPI. Technical breakdown:

• Typo-squatting (MITRE ATT&CK T1588.002: Obtain Capabilities: Tool): Attackers register package names that are very similar to popular, legitimate packages (e.g., colorama-ng instead of colorama). Developers, especially when quickly typing pip install or copying commands, can easily make a typo and install the malicious version.
• Malicious Payload: Upon installation, the setup.py script or a module within colorama-ng would execute. Its primary objective was reconnaissance and data exfiltration.
  • Environment Variables (MITRE ATT&CK T1560.001: Archive Collected Data: Archive via Utility): The package would likely access os.environ to collect sensitive environment variables, which can contain API keys, cloud credentials, database connection strings, and other secrets.
  • SSH Keys: It would attempt to locate and exfiltrate SSH private keys, typically found in ~/.ssh/. Compromised SSH keys grant attackers direct access to code repositories, servers, and other infrastructure.
• Kill Chain:
  1. Initial Access: Developer accidentally installs colorama-ng via pip.
  2. Execution: Malicious setup.py or module runs during installation.
  3. Collection: Environment variables and SSH keys are collected.
  4. Exfiltration: Collected data is sent to an attacker-controlled server. Concrete Remediation:

1. Dependency Scanning: Implement automated dependency scanning tools (e.g., Snyk, Dependabot, Trivy) in your CI/CD pipelines and development environments. These tools can detect known malicious packages and flag suspicious dependency names.
2. Lock Dependency Versions: Use requirements.txt or pyproject.toml with pinned, exact versions of dependencies (package==1.2.3) to prevent accidental upgrades to malicious versions.
3. Review setup.py: For new or less-known packages, briefly review their setup.py or installation scripts, especially if they request unusual permissions or perform suspicious network activity.
4. Supply Chain Security Tools: Integrate tools that monitor the integrity of your software supply chain, including open-source package registries.
5. Developer Education: Train developers on the risks of typo-squatting and the importance of verifying package names and sources.

Sources: Snyk Blog — https://snyk.io/blog/pypi-malware-colorama-ng-2026/

🔧 Patches — Honest Assessments

Fortinet FortiGate Emergency Patch — FG-IR-26-003 for CVE-2026-40201

What does it fix? This emergency patch addresses the critical unauthenticated Remote Code Execution (RCE) vulnerability (CVE-2026-40201) in FortiGate SSL VPN. It specifically mitigates the heap-based buffer overflow that allows remote attackers to execute arbitrary code with root privileges. Is it complete? Fortinet has categorized this as a critical fix, and initial reports from their PSIRT advisory indicate it’s a complete remediation for the identified vulnerability. Given the active exploitation, Fortinet would not release a partial fix. No known bypasses or regressions have been publicly reported in the immediate aftermath of its release. Rate: 🟢 Complete fix. This is an urgent, necessary patch. Deploy immediately.

Sources: Fortinet PSIRT Advisory — https://www.fortiguard.com/psirt/FG-IR-26-003

Microsoft SQL Server Update — Cumulative Update for SQL Server 2022 addresses CVE-2026-51302

What does it fix? This Cumulative Update for SQL Server 2022 resolves CVE-2026-51302, the authenticated Remote Code Execution (RCE) vulnerability caused by a deserialization flaw. It prevents an authenticated attacker from executing arbitrary code on the SQL Server. Is it complete? Microsoft’s cumulative updates are designed to provide comprehensive fixes for multiple vulnerabilities and issues. This update is expected to fully address the deserialization RCE. No known bypasses or regressions have been reported. Rate: 🟢 Complete fix. Apply as part of your regular patch cycle, or sooner if your SQL Server 2022 instances are exposed to a higher risk profile (e.g., accessible from less trusted networks, hosting highly sensitive data, or using easily compromisable service accounts).

Sources: MSRC — https://msrc.microsoft.com/update-guide/release-notes/sql-2026-06-update

🧪 Threat Intel — Campaign Analysis

Rhysida Ransomware Targets Healthcare

Campaign breakdown: Rhysida is a Ransomware-as-a-Service (RaaS) group that emerged in May 2023, known for its “double extortion” tactics: encrypting data and threatening to publish stolen sensitive information if the ransom is not paid. Recent reports indicate Rhysida affiliates are actively targeting healthcare organizations globally, leveraging the critical FortiGate RCE (CVE-2026-40201) for initial access. Their operations are characterized by rapid execution, often encrypting systems within hours of initial compromise.

• Attribution Confidence: High. Rhysida is a well-documented RaaS group with consistent TTPs and a public leak site.
• Geopolitical Context: While Rhysida’s exact origins are unknown, some evidence suggests links to Russian-speaking threat actors or the CIS region. They typically operate as “targets of opportunity” rather than being state-sponsored, though their impact can be significant.
• TTPs (Mapped to MITRE ATT&CK):
  • Initial Access (T1190: Exploit Public-Facing Application): Primarily observed using vulnerabilities in external-facing services like VPNs (e.g., FortiGate RCE CVE-2026-40201, or previously Zerologon CVE-2020-1472). Phishing campaigns are also a common initial access vector.
  • Execution (T1059: Command and Scripting Interpreter): Utilizes PowerShell and batch scripts for malicious actions, including disabling antivirus and executing ransomware. They inject their 64-bit Windows PE cryptographic ransomware application into running processes.
  • Persistence (T1078: Valid Accounts): Known to use valid, compromised credentials to access internal VPNs and establish RDP connections for lateral movement.
  • Privilege Escalation (T1003.003: OS Credential Dumping: NTDS): Observed using tools like secretsdump or ntdsutil.exe to extract credentials from the NTDS database.
  • Defense Evasion (T1070.004: Indicator Removal: File Deletion): Clears Windows event logs (system, application, security) and deletes forensic artifacts using PowerShell and PsExec.
  • Lateral Movement (T1021.001: Remote Services: Remote Desktop Protocol): Creates RDP connections for lateral movement. Uses tools like Cobalt Strike and PsExec.
  • Collection (T1560: Archive Collected Data): Exfiltrates sensitive data before encryption, often using custom loaders like CleanUpLoader.
  • Impact (T1486: Data Encrypted for Impact): Encrypts files, appending the .rhysida extension. Demands ransom in Bitcoin and threatens public data exposure.
• IoCs: Specific IOCs (IP addresses, domains) are often dynamic and tied to individual campaigns. SophosLabs has published some historical IOCs associated with Rhysida, including C2 servers. Defenders should refer to CISA’s #StopRansomware advisories for the most up-to-date IOCs. Defensive detection opportunities:
• Network Monitoring: Detect connections to known Rhysida C2 infrastructure, unusual outbound traffic from VPNs, or large data exfiltration.
• Endpoint Detection: Monitor for suspicious process injection, PowerShell execution, wevtutil.exe usage, ntdsutil.exe or secretsdump execution, and the creation of new administrative accounts.
• Log Analysis: Centralize and analyze logs from FortiGate devices, Windows event logs, and Active Directory for suspicious activity.
• Threat Intelligence Feeds: Integrate Rhysida-specific IOCs and TTPs into SIEM/XDR for real-time alerting.

Sources: BleepingComputer, CISA #StopRansomware: Rhysida Ransomware, Huntress, Vectra AI, BlackFog, FourCore ATTACK, HHS.gov, Trend Micro, Ransomware.live, DeXpose, Recorded Future, SophosLabs GitHub

CERT-In Alert on Phishing Campaign

Campaign breakdown: India’s Computer Emergency Response Team (CERT-In) has issued an alert regarding a widespread phishing campaign specifically targeting major Indian financial institutions. The campaign employs convincing fake login pages designed to harvest credentials from unsuspecting users.

• Attribution Confidence: Medium. While CERT-In identifies the campaign, specific threat actor attribution is not provided in the briefing.
• Geopolitical Context: The campaign focuses on Indian financial institutions, suggesting either financially motivated cybercriminals targeting a specific region or potentially state-sponsored actors with economic espionage goals, though the latter is unverified.
• **TTPs (Mapped to