Malware Activity
Critical Software Supply Chain and Server Exploitation Campaigns Raise Enterprise Security Risks
Security researchers have identified two significant cyber threats that highlight the growing sophistication of modern attacks. In the first campaign, the Head Mare threat group targeted unpatched TrueConf video conferencing servers used across multiple industries. They exploited security vulnerabilities to gain full system control, install hidden web shells, and distribute the PhantomCore backdoor through tampered software installers. Attackers were able to steal credentials, collect network information, and maintain long-term access using stealth techniques. Including reverse SSH tunnels and malware such as PhantomGraph, which leverages Microsoft OneDrive for covert communications. In a separate supply chain attack, nearly 800 malicious packages were uploaded to the npm registry. They targeted developers who unknowingly install them into projects. These packages deliver malware capable of stealing sensitive data, establishing persistence, and providing remote access across Windows, macOS, and Linux systems. The campaign also used deceptive coding practices to evade detection during security reviews. Together, these incidents underscore the increasing risks posed by unpatched systems and compromised software dependencies. Thus, reinforcing the need for timely patching, strict package validation, dependency monitoring, and stronger software supply chain security controls. CTIX analysts will continue to report on the latest malware strains and attack methodologies.
- TheHackerNews: TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore article
- TheHackerNews: Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer article
Threat Actor Activity
UNC6671 Rebrands Extortion Operation but Keeps Vishing-Based Cloud Takeovers
UNC6671 VishUNC6671 is a data extortion group that relies on tailored IT helpdesk voice phishing (vishing) to compromise organizations’ cloud environments, primarily Microsoft 365 and Okta. Emerging in early 2026 under the BlackFile brand, it has since rebranded into multiple extortion labels (Redact, Pink, Helix, and Falcon) while keeping the same core tactics. Posing as internal IT staff and calling employees on their personal phones, UNC6671 claims urgent security or SSO migrations and directs victims to spoofed login portals. There, adversary in the middle (AitM) infrastructure captures credentials and MFA tokens, which are then used to access identity providers, register attacker-controlled MFA devices, and exfiltrate data from SaaS apps using automated Python and PowerShell scripts. The group uses generic “passkey” and SSO-themed domains (passkeyhelpdesk[.]com, setupsso[.]com) with victim-specific subdomains, and has extracted over $10 million in Bitcoin, with typical final ransom payments around $750,000. CTIX Analysts suggest that defenses emphasize phishing-resistant MFA, tight identity provider (IdP) and SSO controls, monitoring for suspicious MFA changes, restricting access to corporate-managed devices, and training staff to distrust unsolicited “IT” calls directing them to new login pages.ing Attacks Target Personal Phones to Steal SaaS Data
Vulnerabilities
CISA Orders Emergency Patching of Actively Exploited Progress Kemp LoadMaster RCE
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that threat actors are actively exploiting a critical pre-authentication OS command injection vulnerability affecting Progress Kemp LoadMaster and several related products. The flaw, tracked as CVE-2026-8037, stems from improper handling of user-controlled API input and an uninitialized heap buffer, allowing an unauthenticated remote attacker to manipulate memory and ultimately execute arbitrary commands with root privileges. Affected products include LoadMaster GA 7.2.63.1 and earlier, LTSF 7.2.54.17 and earlier, MOVEit WAF versions prior to GA 7.2.63.2, ECS Connection Manager, and Connection Manager for ObjectScale, with Progress releasing patches in June. Exploitation activity emerged shortly after watchTowr published technical details and proof-of-concept code on June 29, and eSentire reported attempted exploitation beginning the following day, although the earliest observed attempts were unsuccessful. The vulnerability poses significant risk because LoadMaster appliances are frequently positioned at the network edge and provide visibility into critical internal services, potentially allowing successful attackers to establish initial access and conduct further malicious activity. With more than 100,000 LoadMaster deployments worldwide and Shadowserver tracking nearly 300 internet-exposed instances, the attack surface spans major enterprises and government organizations. On August 7, CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to remediate the vulnerability within just three days. CTIX analysts urge all organizations running affected products to prioritize patching.
📧 Never Miss a Briefing
Stay informed and secure. Subscribe to Ankura’s Cyber Flash Update, a bi-weekly briefing curated by our top cybersecurity experts. Receive timely insights on emerging threats, vulnerabilities and malicious actors to keep your systems secure.
Join the Cyber Flash Update community today.
© Copyright 2026. The views expressed herein are those of the author(s) and not necessarily the views of Ankura Consulting Group, LLC., its management, its subsidiaries, its affiliates, or its other professionals. Ankura is not a law firm and cannot provide legal advice.
