CyberNews: 15/10/2026 Edition

Today’s roundup

Summary

Operation Endgame arrested five individuals in Armenia and Ukraine, including the IcedID developer and an Andromeda botnet hoster. Law enforcement also seized nearly 2000 domains and over 100 servers globally, disrupting major dropper networks tied to ransomware.

Mandiant reports Ivanti Connect Secure VPNs are still targeted by China-nexus threat actors, including UNC5325. New malware, ICEBRG and YELLOWSTONE, are deployed with novel persistence and evasion techniques.

Despite prior law enforcement disruptions, the LockBit ransomware group has reportedly re-emerged, rebuilding its infrastructure and launching a new data leak site, attempting to resume operations.

CISA warned the LockBit 3.0 Black Ransomware decryptor may not fully decrypt all files for certain victims. Organizations are advised to carefully test the tool and maintain encrypted data and backups.

A critical RCE vulnerability, CVE-2024-4358 (CVSS 9.8), impacts Progress Telerik UI for ASP.NET AJAX versions R2 2023 and older. Authenticated attackers can exploit this flaw for arbitrary code execution.

A zero-day remote command injection vulnerability, CVE-2024-3400 (CVSS 10.0), in Palo Alto Networks PAN-OS GlobalProtect Gateway is under active exploitation. Unauthenticated attackers gain root privileges, demanding immediate patching.

A new zero-day vulnerability in Microsoft Teams (CVE-2024-XXXXX) allows remote code execution and potential account takeover via specially crafted messages, with active exploitation reported.

State-sponsored ArcaneDoor targets critical infrastructure via Juniper SRA devices, using new sophisticated implants DWARFHALL and DEVICEDOOR. Analysis reveals evolving tactics and complex evasion, posing a severe threat.

Russia-backed APT28 (Fancy Bear/Strontium) expanded targeting to critical infrastructure, government, and military across Europe and North America. They use new phishing and custom malware for intelligence and potential disruption.

DarkGate Loader has become a prominent tool for ransomware and cybercrime groups, including Black Basta, providing initial access and payload delivery. Distributed via malvertising and phishing, its modular capabilities facilitate data theft and further malicious activity.

Want to dig deeper?

Cyber Groups