Iranian APT Targets Aviation, Software Companies With Updated Tools

SecurityWeek

May 26, 2026 at 1:26 PM

Actively Exploited

Overview

Nimbus Manticore, an Iranian advanced persistent threat (APT) group, has been actively targeting aviation and software companies using updated tools. This activity has persisted during and after the recent US military actions against Iran, indicating a sustained effort by the group to exploit vulnerabilities within these sectors. The attacks raise concerns about the security of critical infrastructure and sensitive data in industries that are vital to national security and economic stability. Companies in the aviation and software fields should be on high alert and enhance their security measures to defend against these sophisticated threats. The ongoing nature of these operations suggests that the APT is evolving its tactics and tools, which could lead to more significant breaches if not addressed promptly.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Aviation and software companies
Action Required: Companies should enhance their security measures and monitor for suspicious activity.
Timeline: Ongoing

Original Article Summary

Nimbus Manticore has continued its operations during and after the US military campaign against Iran. The post Iranian APT Targets Aviation, Software Companies With Updated Tools appeared first on SecurityWeek.

Impact

Aviation and software companies

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Ongoing

Remediation

Companies should enhance their security measures and monitor for suspicious activity.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Exploit, APT, Critical.

Read Original Article

Related Coverage

Claude Mythos AI Identified 10,000+ Software Vulnerabilities in One Month

Hackread – Cybersecurity News, Data Breaches, AI and More

Anthropic's Claude Mythos AI has reportedly identified over 10,000 software vulnerabilities in just one month, with a notable number of these flaws found in open-source code. This discovery raises significant concerns for developers and organizations relying on open-source software, as these vulnerabilities could be exploited by malicious actors if not addressed promptly. The identified flaws range from minor issues to critical vulnerabilities, potentially affecting a wide array of software applications. This highlights the importance of continuous security assessments and the need for developers to prioritize vulnerability management in their software supply chains. With software vulnerabilities being a common entry point for cyberattacks, organizations should take immediate action to patch any flaws identified by AI tools like Claude Mythos.

May 26, 2026

Anthropic: Mythos finds more than 10,000 software flaws in first month

CyberScoop

Anthropic's new tool, Mythos, has identified over 10,000 software flaws in its first month of operation. This impressive figure indicates a tenfold increase in the rate of bug discovery among some partnered organizations. However, there is a concerning trend of a growing gap between identifying these flaws and actually fixing them, which could leave systems vulnerable. The findings suggest that while many companies are becoming more aware of their software vulnerabilities, they may not be equipped to address them promptly. This situation highlights the ongoing challenges in software security and the need for effective remediation strategies to protect against potential exploitation.

May 26, 2026

Chinese Threat Actors Ditch Static Phishing Pages for Live Credential Interception

Infosecurity Magazine

Chinese cybercriminals are shifting tactics from using static phishing pages to employing live credential interception techniques. Research indicates that these phishing operations overwhelmingly target non-Chinese organizations, suggesting a strategic choice to avoid domestic entities. This shift allows attackers to capture login information in real-time, making their phishing efforts more effective. As these tactics evolve, it raises concerns for global organizations who may find themselves impersonated in these schemes. The implications are significant, as the potential for data breaches and unauthorized access increases with the sophistication of these attacks.

May 26, 2026

Actively exploited Trend Micro Apex One flaw gets CISA warning (CVE-2026-34926)

Help Net Security

Trend Micro has reported a serious security vulnerability in its Apex One platform, identified as CVE-2026-34926. This flaw allows for a directory path traversal, which means attackers could potentially access files and directories outside the intended scope. The company has confirmed that this vulnerability is being actively exploited in the wild, with at least one confirmed incident. Organizations using the Apex One platform are at risk, which makes it crucial for them to act quickly. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding this vulnerability, urging affected users to take immediate action to protect their systems.

May 26, 2026

Malware Found in Laravel-Lang Composer Packages After Git Tag Poisoning Attack

Security Affairs

Recently, attackers compromised four Laravel-Lang Composer packages, which are widely used for providing translation and localization files in Laravel applications. By rewriting over 700 Git tags linked to historical versions, they managed to inject malware into these packages, potentially affecting numerous Laravel apps. This incident poses a significant risk to developers using Laravel-Lang, as the malware could lead to unauthorized access or other security breaches in their applications. Users of these packages should take immediate action to ensure their systems are not vulnerable and consider removing or updating the compromised packages. This situation serves as a reminder for developers to monitor the integrity of their dependencies closely.

May 26, 2026

High-severity SharePoint RCE bug patched by Microsoft (CVE-2026-45659)

Help Net Security

Microsoft has patched a serious remote code execution vulnerability in SharePoint, identified as CVE-2026-45659. This flaw impacts SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. The vulnerability arises from the way SharePoint handles untrusted data, allowing an authenticated attacker to execute code on a vulnerable server without requiring any user interaction. The simplicity of the attack makes it particularly concerning, as it poses a risk to organizations using these versions of SharePoint. Companies should prioritize applying the patches to safeguard their systems from potential exploitation.

May 26, 2026