VulnHub

A Chinese threat actor has been targeting high-value organizations across South, Southeast, and East Asia in a long-running campaign. This group has focused on sectors such as aviation, energy, government, law enforcement, pharmaceuticals, technology, and telecommunications. Palo Alto Networks Unit 42 has linked these activities to a new, undocumented threat group that exploits web servers and utilizes Mimikatz, a tool known for stealing credentials. The implications of these attacks are significant, as they threaten the security of critical infrastructure in the region and could lead to serious disruptions or data breaches. Organizations in these sectors need to enhance their cybersecurity measures to defend against these sophisticated threats.

A recent report from Palo Alto Networks reveals that a cyberspy group has successfully targeted governments and critical infrastructure across 37 countries. While the specific origin of these attacks hasn't been confirmed, there are strong indications pointing to China as the likely source. The affected entities include various government agencies and critical infrastructure sectors, which raises significant concerns about national security and the potential for disruption in essential services. The scale of the operation suggests a sophisticated level of planning and execution, highlighting the ongoing risks that nation-states pose in the cyber realm. This incident serves as a reminder for organizations worldwide to bolster their cybersecurity defenses and remain vigilant against such threats.

Palo Alto Networks has addressed a serious vulnerability in its GlobalProtect Gateway and Portal software, identified as CVE-2026-0227, which carries a CVSS score of 7.7. This flaw allows for a denial-of-service (DoS) condition that can crash firewalls without requiring user authentication. A proof-of-concept exploit for this vulnerability is already available, raising concerns about its potential impact on organizations using these systems. Companies utilizing GlobalProtect PAN-OS software should promptly apply the security updates released by Palo Alto to safeguard their networks. Failure to address this vulnerability could leave systems open to disruptions, affecting overall network availability.

VVS Stealer is a new type of malware written in Python that specifically targets Discord users by stealing their credentials and tokens. Discovered by researchers at Palo Alto Networks, this malware has been available for purchase on Telegram since at least April 2025. The ease of access to this tool poses a significant risk to Discord users, as attackers can use stolen credentials to hijack accounts, potentially leading to further scams or unauthorized activities within the platform. This incident raises concerns about the security measures in place for popular communication tools like Discord, and users are urged to be vigilant about their account security. Protecting accounts with strong, unique passwords and enabling two-factor authentication can help mitigate some of the risks associated with such malware.

The React2Shell vulnerability is currently being exploited by cybercriminals to install malware on Linux systems. Researchers from Palo Alto Networks and NTT Security have identified that this vulnerability facilitates the deployment of malicious tools like KSwapDoor and ZnDoor. KSwapDoor is particularly concerning as it is a sophisticated remote access tool designed to operate stealthily, allowing attackers to maintain control over compromised systems without detection. This ongoing threat affects organizations running vulnerable Linux environments, making it crucial for them to take immediate action to secure their systems. Users need to be aware of the risks and ensure their defenses are updated to mitigate potential attacks.

A hacking campaign has been targeting GlobalProtect logins and scanning SonicWall APIs since December 2, 2025. The attack is significant due to its scale, involving over 7,000 IP addresses linked to a German hosting provider, indicating a coordinated effort that poses a serious threat to the security of affected systems.

CISA has identified that various cyber threat actors are using commercial spyware to target users of mobile messaging applications, employing tactics such as phishing, zero-click exploits, and impersonation. The focus is primarily on high-value individuals including government and military officials, indicating a serious threat to sensitive communications.