# Threat Intel Brief — May 30, 2026

TL;DR

  • Critical zero-day in Gogs Git service enables remote code execution on internet-facing instances; no patch available—immediate isolation required.
  • Active exploitation of CVE-2026-35616 in Fortinet FortiClient EMS delivers EKZ credential stealer; patch and hunt for compromise urgently.
  • Russian-linked GREYVIBE APT targets Ukrainian government and infrastructure with AI-generated lures since August 2025.
  • Supply chain attacks surge: malicious npm packages (33 in dependency confusion campaign, Mini Shai-Hulud typosquatting) and NuGet package "Sicoob.Sdk" steal cloud credentials and Brazilian banking certificates.
  • North Korean Kimsuky deploys new HTTPSpy and HelloDoor malware against South Korean military and corporate targets via fake recruiter lures.

---

Critical Threats

Gogs Git Service Zero-Day RCE (Unpatched)

What happened: An unpatched remote code execution vulnerability in Gogs self-hosted Git service allows attackers to execute arbitrary code on internet-facing instances. Any authenticated user can exploit the flaw (CVSS 9.4). No CVE has been assigned and no vendor patch is available.

Impact: Organizations running Gogs instances accessible from the internet face immediate risk of full system compromise, data theft, lateral movement, and supply chain attacks via repository manipulation. The vulnerability's public disclosure without a patch creates a critical window for exploitation.

Recommendations:

  • Immediately isolate all internet-facing Gogs instances behind VPN or IP allowlist until a patch is released.
  • Audit Gogs access logs for suspicious authentication attempts, unusual API calls, or unexpected repository operations.
  • Deploy network-level monitoring and IDS/IPS rules to detect exploitation attempts targeting Gogs endpoints.
  • Review all Gogs instances for unauthorized code commits, new user accounts, or configuration changes.
  • Consider migrating to alternative Git hosting solutions (GitLab, Gitea) if Gogs patch timeline remains unclear.

---

FortiClient EMS Authentication Bypass Exploited (CVE-2026-35616)

What happened: Threat actors are actively exploiting CVE-2026-35616, an authentication bypass vulnerability in Fortinet's FortiClient Enterprise Management Server (EMS), to deploy EKZ credential stealer malware. The flaw allows unauthorized access to EMS servers, which then distribute malware disguised as legitimate Fortinet components to managed endpoints.

Impact: Organizations running FortiClient EMS face immediate risk of credential theft and unauthorized network access. EMS typically manages endpoint security for enterprise deployments, making compromise high-impact. Attackers can bypass authentication to gain control and deploy malware for credential harvesting across the entire managed endpoint fleet.

Recommendations:

  • Immediately identify all FortiClient EMS instances and isolate them from internet access if possible.
  • Apply Fortinet security patches for CVE-2026-35616 immediately per vendor advisory.
  • Review FortiClient EMS logs for unauthorized authentication attempts or anomalous administrative activity.
  • Hunt for indicators of EKZ malware on endpoints managed by FortiClient EMS, focusing on credential access patterns.
  • Implement network segmentation to limit EMS server exposure and enforce strict access controls.

---

Marimo Notebook Exploitation with AI-Driven Post-Compromise (CVE-2026-39987)

What happened: An unknown threat actor exploited CVE-2026-39987 in Marimo notebook platform to compromise internet-reachable instances, extract cloud credentials, and conduct post-exploitation activities using an LLM-based agent. This represents the first documented operational use of AI-driven tools for autonomous post-compromise operations.

Impact: Organizations running Marimo notebooks exposed to the internet face immediate risk of compromise, credential theft, and lateral movement into cloud environments. The use of LLM agents for post-exploitation indicates sophisticated attacker capabilities and potential for rapid, automated escalation.

Recommendations:

  • Immediately identify and isolate all internet-facing Marimo notebook instances until patching is complete.
  • Review Marimo vendor security advisories for CVE-2026-39987 patch availability and apply updates urgently.
  • Audit cloud access logs for unauthorized API calls or credential usage from compromised notebook instances.
  • Rotate all cloud credentials and API keys that may have been accessible from Marimo environments.
  • Monitor for anomalous LLM API usage patterns or automated reconnaissance activity in your environment.

---

Threat Actor Activity

GREYVIBE (Russian-linked APT)

A previously undocumented Russian-linked threat actor dubbed GREYVIBE has been conducting persistent cyberattacks targeting Ukraine and Ukraine-related entities since at least August 2025. WithSecure assesses the group as Russian-speaking, operating in Russian time zones, with activities aligned to Kremlin state interests. The actor demonstrates technical sophistication through operational use of generative AI platforms (ChatGPT, Gemini) to craft social engineering lures and deploys custom malware tooling. Primary targets include Ukrainian government entities and critical infrastructure sectors, consistent with Russian strategic objectives to degrade Ukrainian state capacity.

Defensive priorities: Implement advanced email filtering to detect AI-generated phishing content; deploy EDR solutions with behavioral analytics to identify custom malware execution patterns; establish threat intelligence sharing with Ukrainian CERT and regional ISACs.

---

Kimsuky (North Korean APT)

Kimsuky (also tracked as Velvet Chollima) conducted cyber attacks against South Korean military and corporate entities in March and April 2026, deploying new malware tools including HTTPSpy and HelloDoor while leveraging VS Code Tunnels for command and control. The campaign employed sophisticated social engineering tactics including spoofed security software installation pages and fake Webex meeting pages. This activity aligns with North Korea's sustained intelligence collection priorities targeting the Republic of Korea's defense posture and dual-use technologies.

Defensive priorities: Monitor for anomalous VS Code Tunnel connections; implement email security controls to detect spearphishing attempts spoofing security software vendors; hunt for HTTPSpy and HelloDoor malware indicators; enable enhanced logging for RDP connections and local account usage.

---

ShinyHunters (Cybercrime Group)

ShinyHunters extortion gang breached Charter Communications in early April, stealing personal information from 4.9 million accounts, and claimed a breach of Carnival Corporation affecting nearly 6 million people. The group specializes in large-scale data theft and extortion operations, typically selling stolen databases on underground forums or leveraging them for ransom demands. Their targeting of major telecommunications and travel companies demonstrates continued focus on organizations with large consumer databases.

Defensive priorities: Implement robust authentication controls for database access including MFA and privileged access management; deploy database activity monitoring and data loss prevention solutions; monitor dark web forums for early warning of credential exposure.

---

Supply Chain Threats

Malicious npm Packages (Dependency Confusion & Typosquatting)

Two distinct campaigns targeted the npm ecosystem:

1. Dependency confusion: 33 malicious npm packages collected reconnaissance data from developer and build environments, profiling target systems and gathering intelligence on development infrastructure.

2. Mini Shai-Hulud typosquatting: Attackers exploited typosquatted npm packages to steal cloud and CI/CD credentials from developer environments.

Impact: Attackers gained intelligence on development environments including system configurations, environment variables, network topology, and potentially credentials. This reconnaissance typically precedes more targeted supply chain attacks.

Recommendations:

  • Audit npm package.json and lock files for unexpected public packages matching internal private package naming conventions.
  • Configure npm to use scoped packages (@yourorg/package-name) for all internal dependencies.
  • Implement package allowlisting in CI/CD pipelines using tools like npm-allowlist or Artifactory/Nexus.
  • Scan for the 33 known malicious package names and check installation history via npm audit logs.

---

Malicious NuGet Package Targets Brazilian Banking (Sicoob.Sdk)

Malicious NuGet package "Sicoob.Sdk" (versions 2.0.0–2.0.4) was discovered stealing banking credentials and PFX certificates from users of Sicoob, a major Brazilian cooperative financial system. The compromised package exfiltrates sensitive client IDs and cryptographic certificates used for authentication.

Impact: Organizations using affected package versions have exposed banking credentials and cryptographic certificates to threat actors. Compromised PFX certificates enable attackers to impersonate legitimate users for fraudulent banking transactions.

Recommendations:

  • Immediately audit all .NET projects for Sicoob.Sdk versions 2.0.0–2.0.4 using dotnet list package.
  • Remove malicious packages and clear NuGet cache using dotnet nuget locals all --clear.
  • Revoke all PFX certificates and client IDs used on systems where compromised packages were installed.
  • Contact Sicoob to obtain legitimate SDK and request new authentication credentials.

---

Geopolitical Context

Russia-Ukraine Cyber Operations

GREYVIBE's emergence adds to the roster of Russian-linked threat actors conducting sustained cyber operations against Ukraine. The group's use of AI-generated lures powered by ChatGPT and Gemini represents a tactical evolution in social engineering tradecraft, enabling rapid generation of contextually relevant and linguistically convincing pretext material. This activity occurs within the broader context of Russia's hybrid warfare doctrine, where cyber operations complement kinetic military actions to degrade Ukrainian state capacity and resilience.

North Korea-South Korea Tensions

Kimsuky's March–April 2026 campaign against South Korean military and corporate sectors demonstrates North Korea's continued investment in cyber espionage capabilities despite international sanctions. The deployment of new malware families (HTTPSpy, HelloDoor) and abuse of legitimate developer infrastructure (VS Code Tunnels) reflects operational continuity and tooling evolution. This activity supports Pyongyang's strategic intelligence requirements regarding defense posture, policy deliberations, and dual-use technologies.

Transnational Cybercrime

The ShinyHunters breaches of Charter Communications and Carnival Corporation underscore the persistent threat posed by organized cybercrime to critical infrastructure and consumer-facing enterprises. The scale of data exfiltration—nearly 11 million records combined—highlights vulnerabilities in telecommunications and travel sectors despite regulatory frameworks and sector-specific cybersecurity guidance.

---

Recommended Actions

Immediate (0–24 hours)

  • Isolate all internet-facing Gogs instances behind VPN or IP allowlist (unpatched zero-day RCE).
  • Patch CVE-2026-35616 in FortiClient EMS and hunt for EKZ malware on managed endpoints.
  • Patch CVE-2026-39987 in Marimo notebooks and rotate cloud credentials accessible from those environments.
  • Audit npm dependencies for the 33 malicious packages and Mini Shai-Hulud typosquatting campaign indicators.
  • Remove Sicoob.Sdk versions 2.0.0–2.0.4 from .NET projects and revoke associated PFX certificates.

Near-term (24–72 hours)

  • Patch CVE-2026-8990 (Kidsview authentication bypass) and CVE-2026-42250 (bzip2 out-of-bounds write).
  • Review authentication logs for Gogs, FortiClient EMS, and Marimo systems for signs of compromise.
  • Hunt for HTTPSpy and HelloDoor malware indicators if your organization operates in South Korea or has Korean business relationships.
  • Monitor for anomalous VS Code Tunnel connections and unauthorized remote development tool usage.
  • Implement enhanced email filtering to detect AI-generated phishing content and spoofed security software lures.

This week

  • Apply patches for critical vulnerabilities in Starlette/FastAPI (authentication bypass), LiquidJS (RCE), and Dell Container Storage Modules (information disclosure) when vendor updates become available.
  • Conduct user awareness training on AI-generated social engineering, fake recruiter lures, and ChatGPT-hosted phishing pages.
  • Review and restrict ChatGPT desktop app execution to verified publisher signatures only; block downloads from chatgpt.com/share/* URLs.
  • Deploy mobile threat defense solutions on corporate and BYOD Android devices to detect BTMOB RAT behavior patterns.
  • Establish threat intelligence sharing with Ukrainian CERT if your organization supports Ukraine-related entities.

---

Watch List

  • Gogs vendor response: Monitor for CVE assignment and patch release timeline; consider migration to alternative Git hosting if delays persist.
  • GREYVIBE expansion: Watch for targeting of Ukraine-related entities in allied nations, including diaspora organizations and logistics networks.
  • ShinyHunters data leaks: Monitor underground forums for Charter Communications and Carnival Corporation data listings; prepare for potential secondary fraud impacts.
  • Supply chain campaigns: Anticipate additional malicious packages in npm, NuGet, and PyPI ecosystems; maintain heightened vigilance in dependency management.
  • AI-driven post-exploitation: Track emergence of additional LLM agent malware families and operational use cases by threat actors.

---

Sources

  • BleepingComputer: ChatGPT share links, 23andMe lawsuit, Dutch botnet disruption, elderly data breach, Charter Communications, FortiClient EMS, Gogs zero-day, Romanian sentencing, Carnival breach, GreyVibe, BTMOB, FIFA fraud, Fortinet exploitation
  • The Hacker News: ChatGPhish, Marimo CVE-2026-39987, GREYVIBE, Sicoob.Sdk, Kimsuky, Gogs RCE, FortiClient EMS, JINX-0164
  • Microsoft Security: 33 malicious npm packages, Mini Shai-Hulud, The Gentlemen ransomware
  • CERT.BE: Starlette/FastAPI, LiquidJS, Dell Container Storage Modules
  • CERT.PL: CVE-2026-8990 (Kidsview), CVE-2026-42250 (bzip2)