-
The following versions of AVEVA Pipeline Simulation are affected: Pipeline Simulation <=2025_SP1_build_7.1.9497.6351 CVSS Vendor Equipment Vulnerabilities v3 9.1 AVEVA AVEVA Pipeline Simulation Missing Authorization Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: United Kingdom Vulnerabilities Expand All + CVE-2026-5387 The vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations intended only for Simulator Instructor or Simulator Developer (Administrator) roles, resulting in privilege escalation with potential for modification of simulation parameters, training configuration, and training...
T1059: Command and Scripting Interpreter T1068: Exploitation for Privilege Escalation T1557: Adversary-in-the-Middle CVE-2026-5387 Energy Government Technology Critical Infrastructure Manufacturing United Kingdom United StatesWhy it matters
Covers 1 tracked CVE(s) (CVE-2026-5387) with evidence of active exploitation in the wild—affected software should be patched immediately. Primary exposure: Energy, Government, Technology and others sector(s). Attack pattern consistent with malicious code running on victim systems.
MITRE ATT&CK
Technique Name Tactic Confidence T1059 Command and Scripting Interpreter Execution Low T1068 Exploitation for Privilege Escalation Privilege Escalation Low T1557 Adversary-in-the-Middle Credential Access Low Countries affected
United Kingdom United StatesIndustries affected
Energy Government Technology Critical Infrastructure ManufacturingScore breakdown
Recency 0.062Source Credibility 0.190Corroboration 0.045Severity 0.200Breadth 0.100Actionability 0.100Analytical note: ATT&CK technique mappings are inferred from keyword matching and may not reflect confirmed adversary TTPs.
STIX 2.1 Bundle
{ "type": "bundle", "id": "bundle--e2606bb4-b485-4d31-9c18-4416113ef26e", "objects": [ { "type": "report", "spec_version": "2.1", "id": "report--db7355f5-9b4f-49ea-92bc-c7abe50dbd9f", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "AVEVA Pipeline Simulation", "description": "The following versions of AVEVA Pipeline Simulation are affected: Pipeline Simulation <=2025_SP1_build_7.1.9497.6351 CVSS Vendor Equipment Vulnerabilities v3 9.1 AVEVA AVEVA Pipeline Simulation Missing Authorization Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: United Kingdom Vulnerabilities Expand All + CVE-2026-5387 The vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations intended only for Simulator Instructor or Simulator Developer (Administrator) roles, resulting in privilege escalation with potential for modification of simulation parameters, training configuration, and training...", "published": "2026-04-16T12:00:00.000Z", "report_types": [ "threat-report" ], "object_refs": [ "vulnerability--d757f347-dc4d-49e6-8dc3-a28b0c22102f", "attack-pattern--a0605198-4826-4c92-8f19-d92af2ba7df5", "attack-pattern--c276fa77-ee51-4573-a0fb-779e84636c84", "attack-pattern--39bec044-e415-4629-8f6b-ef5b7d736e2d" ], "external_references": [ { "source_name": "CISA Advisories", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-04", "description": "AVEVA Pipeline Simulation" } ], "labels": [ "Energy", "Government", "Technology", "Critical Infrastructure", "Manufacturing" ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--d757f347-dc4d-49e6-8dc3-a28b0c22102f", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "CVE-2026-5387", "external_references": [ { "source_name": "cve", "external_id": "CVE-2026-5387", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5387" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--a0605198-4826-4c92-8f19-d92af2ba7df5", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "Command and Scripting Interpreter", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059", "url": "https://attack.mitre.org/techniques/T1059/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--c276fa77-ee51-4573-a0fb-779e84636c84", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "Exploitation for Privilege Escalation", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1068", "url": "https://attack.mitre.org/techniques/T1068/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "privilege-escalation" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--39bec044-e415-4629-8f6b-ef5b7d736e2d", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "Adversary-in-the-Middle", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1557", "url": "https://attack.mitre.org/techniques/T1557/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] } ] } -
The following versions of Horner Automation Cscape and XL4, XL7 PLC are affected: Cscape v10.0 XL7 PLC v15.60 XL4 PLC v16.32.0 CVSS Vendor Equipment Vulnerabilities v3 9.1 Horner Automation Horner Automation Cscape and XL4, XL7 PLC Weak Password Requirements Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2026-6284 An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and...
T1059: Command and Scripting Interpreter T1110: Brute Force CVE-2026-6284 Government Critical Infrastructure Manufacturing United StatesWhy it matters
Covers 1 tracked CVE(s) (CVE-2026-6284) with evidence of active exploitation in the wild—affected software should be patched immediately. Primary exposure: Government, Critical Infrastructure, Manufacturing sector(s). Attack pattern consistent with malicious code running on victim systems.
MITRE ATT&CK
Technique Name Tactic Confidence T1059 Command and Scripting Interpreter Execution Low T1110 Brute Force Credential Access Low Countries affected
United StatesIndustries affected
Government Critical Infrastructure ManufacturingScore breakdown
Recency 0.062Source Credibility 0.190Corroboration 0.045Severity 0.200Breadth 0.100Actionability 0.100Analytical note: ATT&CK technique mappings are inferred from keyword matching and may not reflect confirmed adversary TTPs.
STIX 2.1 Bundle
{ "type": "bundle", "id": "bundle--6d0eeaa0-e9bb-46a5-a632-0e2b9b672278", "objects": [ { "type": "report", "spec_version": "2.1", "id": "report--c98ac251-9f69-4090-a89b-2079db97eb4e", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "Horner Automation Cscape and XL4, XL7 PLC", "description": "The following versions of Horner Automation Cscape and XL4, XL7 PLC are affected: Cscape v10.0 XL7 PLC v15.60 XL4 PLC v16.32.0 CVSS Vendor Equipment Vulnerabilities v3 9.1 Horner Automation Horner Automation Cscape and XL4, XL7 PLC Weak Password Requirements Background Critical Infrastructure Sectors: Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2026-6284 An attacker with network access to the PLC is able to brute force discover passwords to gain unauthorized access to systems and...", "published": "2026-04-16T12:00:00.000Z", "report_types": [ "threat-report" ], "object_refs": [ "vulnerability--a4be269d-1fae-40ac-8033-8ab0c2d2cb5c", "attack-pattern--05c2a4a0-f7e8-4a94-8be4-8f15f35c896b", "attack-pattern--10e53ae1-8b12-490a-ac18-737d06b749fe" ], "external_references": [ { "source_name": "CISA Advisories", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-106-02", "description": "Horner Automation Cscape and XL4, XL7 PLC" } ], "labels": [ "Government", "Critical Infrastructure", "Manufacturing" ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--a4be269d-1fae-40ac-8033-8ab0c2d2cb5c", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "CVE-2026-6284", "external_references": [ { "source_name": "cve", "external_id": "CVE-2026-6284", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6284" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--05c2a4a0-f7e8-4a94-8be4-8f15f35c896b", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "Command and Scripting Interpreter", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059", "url": "https://attack.mitre.org/techniques/T1059/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--10e53ae1-8b12-490a-ac18-737d06b749fe", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "Brute Force", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1110", "url": "https://attack.mitre.org/techniques/T1110/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "credential-access" } ] } ] } -
We then retrieved the complete exploit kit when it was later used in broad-scale campaigns by UNC6691, a financially motivated threat actor operating from China. Beyond these identified exploits, multiple threat actors have now acquired advanced exploitation techniques that can be re-used and modified with newly identified vulnerabilities.
T1059: Command and Scripting Interpreter T1189: Drive-by Compromise T1027: Obfuscated Files or Information T1190: Exploit Public-Facing Application CVE-2024-23222 CVE-2022-48503 CVE-2023-43000 Finance Technology Retail Manufacturing ChinaWhy it matters
Covers 3 tracked CVE(s) (CVE-2024-23222, CVE-2022-48503, CVE-2023-43000) with evidence of active exploitation in the wild—affected software should be patched immediately. Primary exposure: Finance, Technology, Retail and others sector(s). Attack pattern consistent with malicious code running on victim systems.
MITRE ATT&CK
Technique Name Tactic Confidence T1059 Command and Scripting Interpreter Execution Low T1189 Drive-by Compromise Initial Access Low T1027 Obfuscated Files or Information Defense Evasion Low T1190 Exploit Public-Facing Application Initial Access Low Countries affected
ChinaIndustries affected
Finance Technology Retail ManufacturingScore breakdown
Recency 0.025Source Credibility 0.176Corroboration 0.045Severity 0.200Breadth 0.100Actionability 0.100Analytical note: ATT&CK technique mappings are inferred from keyword matching and may not reflect confirmed adversary TTPs.
STIX 2.1 Bundle
{ "type": "bundle", "id": "bundle--9e3aa968-d648-4a74-9672-46db39b4bc3a", "objects": [ { "type": "report", "spec_version": "2.1", "id": "report--5e87efc7-defc-404a-af08-32eeb191de69", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit", "description": "We then retrieved the complete exploit kit when it was later used in broad-scale campaigns by UNC6691, a financially motivated threat actor operating from China. Beyond these identified exploits, multiple threat actors have now acquired advanced exploitation techniques that can be re-used and modified with newly identified vulnerabilities.", "published": "2026-03-03T14:00:00.000Z", "report_types": [ "threat-report" ], "object_refs": [ "vulnerability--a37ab68c-b38d-4339-9f13-de4c1a4e94db", "vulnerability--dab4bd6f-8345-444b-9c69-13e4878f9a1e", "vulnerability--7108bcc5-0963-42bf-a6e0-12fba876b3af", "attack-pattern--dcf41c83-558f-44b6-890b-3a465d0d14d8", "attack-pattern--9192c7b5-8cd3-4bc6-854f-40f665bbeaeb", "attack-pattern--e41de23e-fa93-4380-aa05-93c73b743980", "attack-pattern--ef44cfb8-1499-4c3a-ac51-100567daf932" ], "external_references": [ { "source_name": "Mandiant Blog", "url": "https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit", "description": "Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit" } ], "labels": [ "Finance", "Technology", "Retail", "Manufacturing" ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--a37ab68c-b38d-4339-9f13-de4c1a4e94db", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "CVE-2024-23222", "external_references": [ { "source_name": "cve", "external_id": "CVE-2024-23222", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23222" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--dab4bd6f-8345-444b-9c69-13e4878f9a1e", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "CVE-2022-48503", "external_references": [ { "source_name": "cve", "external_id": "CVE-2022-48503", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-48503" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--7108bcc5-0963-42bf-a6e0-12fba876b3af", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "CVE-2023-43000", "external_references": [ { "source_name": "cve", "external_id": "CVE-2023-43000", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-43000" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--dcf41c83-558f-44b6-890b-3a465d0d14d8", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "Command and Scripting Interpreter", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059", "url": "https://attack.mitre.org/techniques/T1059/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--9192c7b5-8cd3-4bc6-854f-40f665bbeaeb", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "Drive-by Compromise", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1189", "url": "https://attack.mitre.org/techniques/T1189/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "initial-access" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--e41de23e-fa93-4380-aa05-93c73b743980", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "Obfuscated Files or Information", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1027", "url": "https://attack.mitre.org/techniques/T1027/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "defense-evasion" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--ef44cfb8-1499-4c3a-ac51-100567daf932", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "Exploit Public-Facing Application", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1190", "url": "https://attack.mitre.org/techniques/T1190/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "initial-access" } ] } ] } -
Included were critical updates for the following products: .NET 10.0 installed on Linux .NET 10.0 installed on Mac OS .NET 10.0 installed on Windows .NET 8.0 installed on Linux .NET 8.0 installed on Mac OS .NET 8.0 installed on Windows .NET 9.0 installed on Linux .NET 9.0 installed on Mac OS .NET 9.0 installed on Windows Azure Logic Apps Azure Monitor Agent Microsoft .NET Framework Microsoft .NET Framework 3.5 AND 4.8.1 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft 365 Apps for Enterprise...
Why it matters
Covers 2 tracked CVE(s) (CVE-2026-32201, CVE-2026-33825) with evidence of active exploitation in the wild—affected software should be patched immediately. Primary exposure: Technology sector(s). Attack pattern consistent with malicious code running on victim systems.
MITRE ATT&CK
Technique Name Tactic Confidence T1059 Command and Scripting Interpreter Execution Low Industries affected
TechnologyScore breakdown
Recency 0.113Source Credibility 0.184Corroboration 0.045Severity 0.200Breadth 0.000Actionability 0.100Analytical note: ATT&CK technique mappings are inferred from keyword matching and may not reflect confirmed adversary TTPs. Affected countries could not be determined from available text.
STIX 2.1 Bundle
{ "type": "bundle", "id": "bundle--ca04292c-6885-49ca-9aeb-2d869e2e69a4", "objects": [ { "type": "report", "spec_version": "2.1", "id": "report--f68e5076-943c-4949-9650-aa59081c979b", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "Microsoft security advisory \u2013 April 2026 monthly rollup (AV26-352) - Update 1", "description": "Included were critical updates for the following products: .NET 10.0 installed on Linux .NET 10.0 installed on Mac OS .NET 10.0 installed on Windows .NET 8.0 installed on Linux .NET 8.0 installed on Mac OS .NET 8.0 installed on Windows .NET 9.0 installed on Linux .NET 9.0 installed on Mac OS .NET 9.0 installed on Windows Azure Logic Apps Azure Monitor Agent Microsoft .NET Framework Microsoft .NET Framework 3.5 AND 4.8.1 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft 365 Apps for Enterprise...", "published": "2026-04-17T19:53:33.000Z", "report_types": [ "threat-report" ], "object_refs": [ "vulnerability--113763fc-1f37-4a00-92d3-c168b5b8fd22", "vulnerability--3679ae83-7892-42e5-849b-dc0f2dd0ec55", "attack-pattern--f4143686-5830-48da-b05b-34f59854367c" ], "external_references": [ { "source_name": "Canadian Centre for Cyber Security", "url": "https://cyber.gc.ca/en/alerts-advisories/microsoft-security-advisory-april-2026-monthly-rollup-av26-352", "description": "Microsoft security advisory \u2013 April 2026 monthly rollup (AV26-352) - Update 1" } ], "labels": [ "Technology" ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--113763fc-1f37-4a00-92d3-c168b5b8fd22", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "CVE-2026-32201", "external_references": [ { "source_name": "cve", "external_id": "CVE-2026-32201", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32201" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--3679ae83-7892-42e5-849b-dc0f2dd0ec55", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "CVE-2026-33825", "external_references": [ { "source_name": "cve", "external_id": "CVE-2026-33825", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33825" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--f4143686-5830-48da-b05b-34f59854367c", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "Command and Scripting Interpreter", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059", "url": "https://attack.mitre.org/techniques/T1059/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] } ] } -
50.63 Medium
An Iran-affiliated threat group has evolved from defacing water utility displays to deploying custom ICS malware and exploiting Rockwell Automation PLCs across multiple U.S. The group has escalated from exploiting default credentials on Israeli-made PLCs (2023) to deploying a custom ICS malware platform called IOCONTROL (2024) to actively exploiting CVE-2021-22681, a critical authentication bypass in Rockwell Automation controllers, across U.S. Cyber Command jointly warned that Iranian-affiliated advanced persistent threat actors are actively exploiting internet-facing programmable logic controllers across U.S.
T1059: Command and Scripting Interpreter CVE-2021-22681 Finance Energy Government Technology Telecommunications Critical Infrastructure Israel IranWhy it matters
Covers 1 tracked CVE(s) (CVE-2021-22681) with evidence of active exploitation in the wild—affected software should be patched immediately. Primary exposure: Finance, Energy, Government and others sector(s). Attack pattern consistent with malicious code running on victim systems.
MITRE ATT&CK
Technique Name Tactic Confidence T1059 Command and Scripting Interpreter Execution Low Countries affected
Israel IranIndustries affected
Finance Energy Government Technology Telecommunications Critical InfrastructureScore breakdown
Recency 0.025Source Credibility 0.164Corroboration 0.045Severity 0.200Breadth 0.100Actionability 0.100Analytical note: ATT&CK technique mappings are inferred from keyword matching and may not reflect confirmed adversary TTPs.
STIX 2.1 Bundle
{ "type": "bundle", "id": "bundle--52ebd08e-e829-4bdd-be44-4e3c9b9e1af2", "objects": [ { "type": "report", "spec_version": "2.1", "id": "report--acd39114-23ec-4c39-b2b5-9d69abf62ce6", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "What to Know About CyberAv3ngers: The IRGC-Linked Group Targeting Critical Infrastructure", "description": "An Iran-affiliated threat group has evolved from defacing water utility displays to deploying custom ICS malware and exploiting Rockwell Automation PLCs across multiple U.S. The group has escalated from exploiting default credentials on Israeli-made PLCs (2023) to deploying a custom ICS malware platform called IOCONTROL (2024) to actively exploiting CVE-2021-22681, a critical authentication bypass in Rockwell Automation controllers, across U.S. Cyber Command jointly warned that Iranian-affiliated advanced persistent threat actors are actively exploiting internet-facing programmable logic controllers across U.S.", "published": "2026-04-09T20:28:27.000Z", "report_types": [ "threat-report" ], "object_refs": [ "vulnerability--f06c5dd0-8695-48b4-ba34-ed811ada9554", "attack-pattern--aafc08c9-fe6a-46af-ad35-e2a5fea9df2b" ], "external_references": [ { "source_name": "Tenable Blog", "url": "https://www.tenable.com/blog/what-to-know-about-cyberav3ngers-the-irgc-linked-group-targeting-critical-infrastructure", "description": "What to Know About CyberAv3ngers: The IRGC-Linked Group Targeting Critical Infrastructure" } ], "labels": [ "Finance", "Energy", "Government", "Technology", "Telecommunications", "Critical Infrastructure" ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--f06c5dd0-8695-48b4-ba34-ed811ada9554", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "CVE-2021-22681", "external_references": [ { "source_name": "cve", "external_id": "CVE-2021-22681", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22681" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--aafc08c9-fe6a-46af-ad35-e2a5fea9df2b", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "Command and Scripting Interpreter", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059", "url": "https://attack.mitre.org/techniques/T1059/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] } ] } -
60.62 Medium
April 2026 Patch Tuesday: Two Zero-Days and Eight Critical Vulnerabilities Among 164 CVEs
Why it matters
A zero-day vulnerability is being actively exploited before a vendor patch is available, leaving all unmitigated installations at immediate and unmitigable risk. Attack pattern consistent with adversaries gaining their first foothold in the environment.
MITRE ATT&CK
Technique Name Tactic Confidence T1190 Exploit Public-Facing Application Initial Access Low Score breakdown
Recency 0.250Source Credibility 0.174Corroboration 0.045Severity 0.120Breadth 0.000Actionability 0.033Analytical note: ATT&CK technique mappings are inferred from keyword matching and may not reflect confirmed adversary TTPs. Affected countries could not be determined from available text.
STIX 2.1 Bundle
{ "type": "bundle", "id": "bundle--445de92c-54a7-42d2-8844-a6cb0bdbf6f2", "objects": [ { "type": "report", "spec_version": "2.1", "id": "report--e3e000d8-4eab-414b-a395-177621f3e795", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "April 2026 Patch Tuesday: Two Zero-Days and Eight Critical Vulnerabilities Among 164 CVEs", "description": "April 2026 Patch Tuesday: Two Zero-Days and Eight Critical Vulnerabilities Among 164 CVEs", "published": "2026-04-20T09:05:42.000Z", "report_types": [ "threat-report" ], "object_refs": [ "attack-pattern--0af7a01e-5704-41d0-94b5-d76af34abf49" ], "external_references": [ { "source_name": "CrowdStrike Blog", "url": "https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-april-2026", "description": "April 2026 Patch Tuesday: Two Zero-Days and Eight Critical Vulnerabilities Among 164 CVEs" } ], "labels": [] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--0af7a01e-5704-41d0-94b5-d76af34abf49", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "Exploit Public-Facing Application", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1190", "url": "https://attack.mitre.org/techniques/T1190/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "initial-access" } ] } ] } -
Introduction Last week, Google Threat Intelligence Group (GTIG), Mandiant, and partners took action to disrupt a global espionage campaign targeting telecommunications and government organizations in dozens of nations across four continents. The attacker was using API calls to communicate with SaaS apps as command-and-control (C2) infrastructure to disguise their malicious traffic as benign, a common tactic used by threat actors when attempting to improve the stealth of their intrusions.
T1071: Application Layer Protocol T1068: Exploitation for Privilege Escalation T1053: Scheduled Task/Job Government Technology Telecommunications ChinaWhy it matters
Primary exposure: Government, Technology, Telecommunications sector(s). Attack pattern consistent with adversaries maintaining remote control of compromised hosts. Associated (low confidence) with known threat actor Salt Typhoon.
MITRE ATT&CK
Technique Name Tactic Confidence T1071 Application Layer Protocol Command and Control Low T1068 Exploitation for Privilege Escalation Privilege Escalation Low T1053 Scheduled Task/Job Persistence Low Attribution
- Salt Typhoon Low confidence Named in: Mandiant Blog
Countries affected
ChinaIndustries affected
Government Technology TelecommunicationsScore breakdown
Recency 0.025Source Credibility 0.176Corroboration 0.045Severity 0.200Breadth 0.100Actionability 0.067Analytical note: Attribution is derived from public reporting only and should be treated as preliminary. ATT&CK technique mappings are inferred from keyword matching and may not reflect confirmed adversary TTPs.
STIX 2.1 Bundle
{ "type": "bundle", "id": "bundle--db8e0574-e193-4e15-b0a3-0711ce476b14", "objects": [ { "type": "report", "spec_version": "2.1", "id": "report--3264129d-2c0d-4b89-b46f-c7e205ce86dc", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "Exposing the Undercurrent: Disrupting the GRIDTIDE Global Cyber Espionage Campaign", "description": "Introduction Last week, Google Threat Intelligence Group (GTIG), Mandiant, and partners took action to disrupt a global espionage campaign targeting telecommunications and government organizations in dozens of nations across four continents. The attacker was using API calls to communicate with SaaS apps as command-and-control (C2) infrastructure to disguise their malicious traffic as benign, a common tactic used by threat actors when attempting to improve the stealth of their intrusions.", "published": "2026-02-25T14:00:00.000Z", "report_types": [ "threat-report" ], "object_refs": [ "threat-actor--40e89da7-138e-42ed-883e-1ab0975395cc", "attack-pattern--48511902-a1f2-4084-9851-fb81deda00cd", "attack-pattern--db61398d-ce1d-45b1-ae5c-d15fb3fb7a4a", "attack-pattern--9bf6d985-a9b8-4159-b597-b2eb8d4d360f" ], "external_references": [ { "source_name": "Mandiant Blog", "url": "https://cloud.google.com/blog/topics/threat-intelligence/disrupting-gridtide-global-espionage-campaign", "description": "Exposing the Undercurrent: Disrupting the GRIDTIDE Global Cyber Espionage Campaign" } ], "labels": [ "Government", "Technology", "Telecommunications" ] }, { "type": "threat-actor", "spec_version": "2.1", "id": "threat-actor--40e89da7-138e-42ed-883e-1ab0975395cc", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "Salt Typhoon", "threat_actor_types": [ "unknown" ], "confidence": 25 }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--48511902-a1f2-4084-9851-fb81deda00cd", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "Application Layer Protocol", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1071", "url": "https://attack.mitre.org/techniques/T1071/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "command-and-control" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--db61398d-ce1d-45b1-ae5c-d15fb3fb7a4a", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "Exploitation for Privilege Escalation", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1068", "url": "https://attack.mitre.org/techniques/T1068/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "privilege-escalation" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--9bf6d985-a9b8-4159-b597-b2eb8d4d360f", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "Scheduled Task/Job", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1053", "url": "https://attack.mitre.org/techniques/T1053/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "persistence" } ] } ] } -
Unit 42 details recent Iranian cyberattack activity, sharing direct observations of phishing, hacktivist activity and cybercrime. We include recommendations for defenders. The post Threat Brief: Escalation of Cyber Risk Related to Iran (Updated April 17) appeared first on Unit 42 .
T1566: Phishing IranWhy it matters
An official security advisory has been published. Prompt patching is strongly recommended before adversaries weaponise the disclosed vulnerability. Attack pattern consistent with adversaries gaining their first foothold in the environment.
MITRE ATT&CK
Technique Name Tactic Confidence T1566 Phishing Initial Access Low Countries affected
IranScore breakdown
Recency 0.113Source Credibility 0.174Corroboration 0.045Severity 0.200Breadth 0.000Actionability 0.067Analytical note: ATT&CK technique mappings are inferred from keyword matching and may not reflect confirmed adversary TTPs.
STIX 2.1 Bundle
{ "type": "bundle", "id": "bundle--bad7ab83-d2bc-458c-b25c-62487b8b4edb", "objects": [ { "type": "report", "spec_version": "2.1", "id": "report--2a55654d-fe91-4706-8d67-a9464daf46ec", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "Threat Brief: Escalation of Cyber Risk Related to Iran (Updated April 17)", "description": "Unit 42 details recent Iranian cyberattack activity, sharing direct observations of phishing, hacktivist activity and cybercrime. We include recommendations for defenders. The post Threat Brief: Escalation of Cyber Risk Related to Iran (Updated April 17) appeared first on Unit 42 .", "published": "2026-04-17T22:35:07.000Z", "report_types": [ "threat-report" ], "object_refs": [ "attack-pattern--5a9bf1e8-bcee-4901-8917-616d027d2731" ], "external_references": [ { "source_name": "Palo Alto Unit 42", "url": "https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026", "description": "Threat Brief: Escalation of Cyber Risk Related to Iran (Updated April 17)" } ], "labels": [] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--5a9bf1e8-bcee-4901-8917-616d027d2731", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "Phishing", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1566", "url": "https://attack.mitre.org/techniques/T1566/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "initial-access" } ] } ] } -
Meta Bug Bounty and PortSwigger have formed a partnership to help security researchers sharpen their skills, collaborate more closely, and improve vulnerability discovery. The initiative combines Meta’s bug bounty program with PortSwigger’s Burp Suite, reflecting a shared focus on improving both tooling and education for the global security community. “By joining forces, we’re not just offering resources; we’re building bridges between communities,” Meta Bug Bounty said.
T1059: Command and Scripting Interpreter EducationWhy it matters
Primary exposure: Education sector(s). Attack pattern consistent with malicious code running on victim systems.
MITRE ATT&CK
Technique Name Tactic Confidence T1059 Command and Scripting Interpreter Execution Low Industries affected
EducationScore breakdown
Recency 0.250Source Credibility 0.152Corroboration 0.045Severity 0.080Breadth 0.067Actionability 0.000Analytical note: ATT&CK technique mappings are inferred from keyword matching and may not reflect confirmed adversary TTPs. Affected countries could not be determined from available text.
STIX 2.1 Bundle
{ "type": "bundle", "id": "bundle--3cae683a-244b-4809-9c7c-174d6bf9e322", "objects": [ { "type": "report", "spec_version": "2.1", "id": "report--f68fd6a4-5547-4ea7-b350-0f1e44b4cc65", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "Meta and PortSwigger drive offensive security further to find what others miss", "description": "Meta Bug Bounty and PortSwigger have formed a partnership to help security researchers sharpen their skills, collaborate more closely, and improve vulnerability discovery. The initiative combines Meta\u2019s bug bounty program with PortSwigger\u2019s Burp Suite, reflecting a shared focus on improving both tooling and education for the global security community. \u201cBy joining forces, we\u2019re not just offering resources; we\u2019re building bridges between communities,\u201d Meta Bug Bounty said.", "published": "2026-04-20T08:13:30.000Z", "report_types": [ "threat-report" ], "object_refs": [ "attack-pattern--3f09fcbe-388c-433b-b018-d153f79f80de" ], "external_references": [ { "source_name": "Help Net Security", "url": "https://www.helpnetsecurity.com/2026/04/20/meta-bug-bounty-portswigger-partnership", "description": "Meta and PortSwigger drive offensive security further to find what others miss" } ], "labels": [ "Education" ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--3f09fcbe-388c-433b-b018-d153f79f80de", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "Command and Scripting Interpreter", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059", "url": "https://attack.mitre.org/techniques/T1059/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] } ] } -
Serial number: AV26-360 Date: April 16, 2026 On April 10, 2026, Nginx UI published a security advisory to address a critical vulnerability in the following product: Nginx UI – version v2.3.5 and prior Open-source reporting indicates that the CVE-2026-33032 vulnerability is being exploited in the wild. The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates, when available. Nginx UI - CVE-2026-33032 NVD - CVE-2026-33032 Detail
Why it matters
Covers 1 tracked CVE(s) (CVE-2026-33032) with evidence of active exploitation in the wild—affected software should be patched immediately. Attack pattern consistent with malicious code running on victim systems.
MITRE ATT&CK
Technique Name Tactic Confidence T1059 Command and Scripting Interpreter Execution Low Score breakdown
Recency 0.062Source Credibility 0.184Corroboration 0.045Severity 0.200Breadth 0.000Actionability 0.100Analytical note: ATT&CK technique mappings are inferred from keyword matching and may not reflect confirmed adversary TTPs. Affected countries could not be determined from available text.
STIX 2.1 Bundle
{ "type": "bundle", "id": "bundle--082ea597-947c-4cc3-b789-5e32844631da", "objects": [ { "type": "report", "spec_version": "2.1", "id": "report--01af864b-d6ef-493b-94a7-276f04ee3d08", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "Nginx UI security advisory (AV26-360)", "description": "Serial number: AV26-360 Date: April 16, 2026 On April 10, 2026, Nginx UI published a security advisory to address a critical vulnerability in the following product: Nginx UI \u2013 version v2.3.5 and prior Open-source reporting indicates that the CVE-2026-33032 vulnerability is being exploited in the wild. The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates, when available. Nginx UI - CVE-2026-33032 NVD - CVE-2026-33032 Detail", "published": "2026-04-16T15:06:47.000Z", "report_types": [ "threat-report" ], "object_refs": [ "vulnerability--ae9f11c4-8f62-4824-9ca7-9f43d337ff0f", "attack-pattern--1fd75093-d01d-4960-a096-0bcb77f87de3" ], "external_references": [ { "source_name": "Canadian Centre for Cyber Security", "url": "https://cyber.gc.ca/en/alerts-advisories/nginx-ui-security-advisory-av26-360", "description": "Nginx UI security advisory (AV26-360)" } ], "labels": [] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--ae9f11c4-8f62-4824-9ca7-9f43d337ff0f", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "CVE-2026-33032", "external_references": [ { "source_name": "cve", "external_id": "CVE-2026-33032", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33032" } ] }, { "type": "attack-pattern", "spec_version": "2.1", "id": "attack-pattern--1fd75093-d01d-4960-a096-0bcb77f87de3", "created": "2026-04-20T09:05:57.000Z", "modified": "2026-04-20T09:05:57.000Z", "name": "Command and Scripting Interpreter", "external_references": [ { "source_name": "mitre-attack", "external_id": "T1059", "url": "https://attack.mitre.org/techniques/T1059/" } ], "kill_chain_phases": [ { "kill_chain_name": "mitre-attack", "phase_name": "execution" } ] } ] }
-
Despite the months-long feud between Anthropic and the Pentagon, the National Security Agency is using the AI company's new Mythos Preview, according to Axios , which spoke to two sources with knowledge of the matter. While Anthropic was granted a preliminary injunction by one court to temporarily block this designation, federal judges in the other denied its motion to lift the label.
Government United StatesWhy it matters
Primary exposure: Government sector(s). Attack pattern consistent with malicious code running on victim systems.
Countries affected
United StatesIndustries affected
GovernmentScore breakdown
Recency 0.400Source Credibility 0.075Corroboration 0.090Severity 0.040Breadth 0.017Actionability 0.000Analytical note: ATT&CK technique mappings are inferred from keyword matching and may not reflect confirmed adversary TTPs.
-
Plus: Major data breaches at a gym chain and hotel giant, a disruptive DDoS attack against Bluesky, dubious ICE hires, and more.
European UnionWhy it matters
Attack pattern consistent with destructive actions targeting systems or data.
Countries affected
European UnionScore breakdown
Recency 0.260Source Credibility 0.082Corroboration 0.090Severity 0.060Breadth 0.000Actionability 0.000Analytical note: ATT&CK technique mappings are inferred from keyword matching and may not reflect confirmed adversary TTPs.
-
A security researcher published details of three security vulnerabilities in Windows Defender, and the code used to exploit them. Now, hackers are taking advantage of the vulnerabilities in real-life attacks, according to a cybersecurity firm.
Why it matters
An official security advisory has been published. Prompt patching is strongly recommended before adversaries weaponise the disclosed vulnerability.
Score breakdown
Recency 0.180Source Credibility 0.079Corroboration 0.090Severity 0.080Breadth 0.000Actionability 0.017Analytical note: Affected countries could not be determined from available text.
-
More than 18 months after a ransomware attack disrupted care at hospitals in South East London, documents show at least one NHS trust is still working without fully restored systems and managing large backlogs of delayed test results.
HealthcareWhy it matters
Primary exposure: Healthcare sector(s). Attack pattern consistent with destructive actions targeting systems or data.
Industries affected
HealthcareScore breakdown
Recency 0.180Source Credibility 0.080Corroboration 0.090Severity 0.040Breadth 0.017Actionability 0.000Analytical note: ATT&CK technique mappings are inferred from keyword matching and may not reflect confirmed adversary TTPs. Affected countries could not be determined from available text.
-
The House passed stopgap legislation to extend a warrantless government surveillance power for 10 days, following a failed lobbying campaign by the Trump administration.
Why it matters
Reported by The Record (Recorded Future). Full significance assessment requires additional corroborating data.
Score breakdown
Recency 0.180Source Credibility 0.080Corroboration 0.090Severity 0.020Breadth 0.017Actionability 0.000Analytical note: Affected countries could not be determined from available text.
-
Nicholas Moore hacked into three U.S. government networks using stolen credentials, and then bragged about it and posted victims' personal data on Instagram under the handle @ihackedthegovernment.
United StatesWhy it matters
Attack pattern consistent with adversaries gaining their first foothold in the environment.
Countries affected
United StatesScore breakdown
Recency 0.180Source Credibility 0.079Corroboration 0.090Severity 0.020Breadth 0.017Actionability 0.000Analytical note: ATT&CK technique mappings are inferred from keyword matching and may not reflect confirmed adversary TTPs.
-
A post-midnight revolt in the House sank the White House's efforts to extend Section 702—a spy program the FBI has used to look into members of Congress, protesters, and political donors.
GovernmentWhy it matters
Primary exposure: Government sector(s).
Industries affected
GovernmentScore breakdown
Recency 0.180Source Credibility 0.082Corroboration 0.090Severity 0.000Breadth 0.000Actionability 0.000Analytical note: Affected countries could not be determined from available text.
-
These digital security organizers bring the fight for online privacy to dance parties, wine meetups and reading groups Imani Thompson shows up at Wonderville Bar in Brooklyn looking ready for a DJ set, or to drink, or to dance the night away with friends. Its purpose isn’t a mystery; the main goal is to help attenders understand how to mitigate their vulnerability to surveillance through major tech services.
TechnologyWhy it matters
Primary exposure: Technology sector(s).
Industries affected
TechnologyScore breakdown
Recency 0.100Source Credibility 0.080Corroboration 0.090Severity 0.040Breadth 0.000Actionability 0.017Analytical note: Affected countries could not be determined from available text.
-
A financially motivated data theft and extortion group is attempting to inject itself into the Iran war, unleashing a worm that spreads through poorly secured cloud services and wipes data on infected systems that use Iran's time zone or have Farsi set as the default language.
IranWhy it matters
Attack pattern consistent with data being stolen from victim systems.
Countries affected
IranScore breakdown
Recency 0.040Source Credibility 0.088Corroboration 0.090Severity 0.080Breadth 0.000Actionability 0.000Analytical note: ATT&CK technique mappings are inferred from keyword matching and may not reflect confirmed adversary TTPs.
-
A hacktivist group with links to Iran's intelligence agencies is claiming responsibility for a data-wiping attack against Stryker, a global medical technology company based in Michigan. News reports out of Ireland, Stryker's largest hub outside of the United States, said the company sent home more than 5,000 workers there today. Meanwhile, a voicemail message at Stryker's main U.S.
Healthcare Technology United States IranWhy it matters
Primary exposure: Healthcare, Technology sector(s). Attack pattern consistent with destructive actions targeting systems or data.
Countries affected
United States IranIndustries affected
Healthcare TechnologyScore breakdown
Recency 0.040Source Credibility 0.088Corroboration 0.090Severity 0.060Breadth 0.017Actionability 0.000Analytical note: ATT&CK technique mappings are inferred from keyword matching and may not reflect confirmed adversary TTPs.
No threats match your filter.