# Threat Intel Brief — May 31, 2026

TL;DR

  • CVE-2026-0257 in Palo Alto Networks PAN-OS GlobalProtect is under active exploitation, allowing attackers to bypass VPN authentication and gain unauthorized network access.
  • CVE-2026-39987 in Marimo notebooks exploited in the wild; attackers used an LLM-based agent for post-compromise credential theft and cloud environment access.
  • North Korean APT Kimsuky deployed new malware (HTTPSpy, HelloDoor) against South Korean military and corporate targets, leveraging VS Code Tunnels for command and control.
  • Supply chain attacks targeting npm and NuGet ecosystems continue, with malicious packages stealing cloud credentials and Brazilian banking authentication material.
  • Russian-linked GREYVIBE actor maintains persistent operations against Ukrainian government and critical infrastructure since August 2025.

---

Critical Threats

Palo Alto PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257)

What happened:
Palo Alto Networks disclosed that CVE-2026-0257, an authentication bypass vulnerability in PAN-OS GlobalProtect VPN and Prisma Access, is being actively exploited. The flaw allows attackers to establish unauthorized VPN connections without valid credentials, providing direct access to internal corporate networks.

Impact:
Organizations using PAN-OS GlobalProtect face immediate risk of perimeter breach. Successful exploitation grants attackers network access for lateral movement, data exfiltration, and deployment of additional payloads. The vulnerability carries a CVSS score of 7.8 and affects both on-premises PAN-OS firewalls and cloud-based Prisma Access deployments.

Recommendations:

  • Apply Palo Alto Networks security updates immediately upon release or follow vendor hotfix guidance.
  • Review GlobalProtect VPN access logs for anomalous authentication patterns, particularly successful connections from unexpected geolocations or following failed attempts.
  • Implement temporary IP allowlisting for GlobalProtect access if operationally feasible.
  • Monitor Palo Alto threat feeds and enable Threat Prevention signatures for CVE-2026-0257.
  • Conduct incident response sweeps on systems accessed via GlobalProtect in the past 30 days for indicators of compromise.

---

Marimo Notebook Exploitation with LLM-Driven Post-Compromise (CVE-2026-39987)

What happened:
An unknown threat actor exploited CVE-2026-39987 in internet-exposed Marimo notebook instances to extract cloud credentials and conduct post-exploitation activities using an LLM-based agent. This represents an emerging trend of AI-driven automation in offensive operations.

Impact:
Organizations running Marimo notebooks with internet exposure face credential theft and potential cloud infrastructure takeover. The use of autonomous or semi-autonomous LLM agents for post-compromise operations marks a novel evolution in attacker tradecraft, enabling rapid reconnaissance and lateral movement.

Recommendations:

  • Immediately identify and isolate all internet-facing Marimo notebook instances pending patch availability.
  • Review cloud provider audit trails (AWS CloudTrail, Azure Activity Log, GCP Cloud Audit Logs) for unauthorized access or credential usage from Marimo infrastructure.
  • Rotate all cloud credentials (API keys, service account tokens, IAM credentials) accessible from Marimo environments.
  • Implement network segmentation to restrict Marimo notebook access to internal networks only, using VPN or bastion hosts for legitimate remote access.
  • Monitor for anomalous command execution patterns indicative of LLM agent activity, including rapid sequential API calls or automated reconnaissance behavior.

---

Microsoft May 2026 Patch Tuesday: 118 Vulnerabilities

What happened:
Microsoft released patches for 118 vulnerabilities in its May 2026 Patch Tuesday update, including 16 critical and 102 important severity issues affecting Windows endpoints, servers, and Microsoft services.

Impact:
High-volume patch release requiring immediate planning and deployment across enterprise environments. With 16 critical-severity issues, risk of remote code execution or privilege escalation is likely. Delayed patching increases exposure window for both opportunistic and targeted attacks.

Recommendations:

  • Review Microsoft Security Response Center (MSRC) May 2026 release notes to identify CVEs affecting your environment and prioritize based on exploitability and asset criticality.
  • Deploy critical patches to internet-facing Windows servers, domain controllers, and Exchange servers within 24-48 hours.
  • Test patches in staging environments for business-critical applications before broad deployment.
  • Enable enhanced logging on Windows Security Event Log (Event IDs 4688, 4624, 4625) and monitor for anomalous authentication or process execution patterns.

---

Threat Actor Activity

Kimsuky (Velvet Chollima) — North Korean APT

North Korean state-sponsored group Kimsuky conducted cyber attacks against South Korean military and corporate entities in March and April 2026, deploying new malware tools including HTTPSpy and HelloDoor. The campaign employed sophisticated social engineering tactics, including spoofed security software installation pages and fake Webex meeting invitations. Notably, the group leveraged Visual Studio Code Tunnels for command and control, demonstrating continued evolution in operational tradecraft.

Defensive focus: Monitor for suspicious VS Code Tunnel connections, implement email security controls to detect domain spoofing, and deploy endpoint detection rules for malicious file execution from email attachments and web downloads.

---

GREYVIBE — Russian-Linked APT Targeting Ukraine

WithSecure identified a previously undocumented Russian-linked threat actor dubbed GREYVIBE conducting persistent cyberattacks against Ukraine and Ukraine-related entities since at least August 2025. The group is assessed as Russian-speaking, operating in Russian time zones, with activities aligned to Kremlin state interests. Targeting focuses on Ukrainian government institutions and critical infrastructure.

Defensive focus: Implement enhanced monitoring for lateral movement and credential access attempts, deploy network segmentation and zero-trust architecture principles, and coordinate with national CERT teams for timely indicators of compromise.

---

ShinyHunters — Data Extortion Gang

ShinyHunters breached Charter Communications in early April, stealing personal information from 4.9 million accounts. The breach was confirmed through the Have I Been Pwned data breach notification service. The financially-motivated cybercrime group specializes in large-scale data exfiltration and extortion operations targeting enterprises with large customer databases.

Defensive focus: Implement continuous monitoring for abnormal database queries and bulk data exfiltration patterns, enforce strict access controls and privileged access management for systems containing customer PII, and deploy network egress filtering and data loss prevention controls.

---

Supply Chain Threats

Malicious NuGet Package Targets Brazilian Banking

The malicious NuGet package "Sicoob.Sdk" (versions 2.0.0-2.0.4) was discovered stealing banking credentials and PFX certificates from users of Sicoob, a major Brazilian cooperative financial system. The compromised package exfiltrates sensitive client IDs and cryptographic certificates used for authentication.

Organizations using the affected package must immediately remove it, revoke all PFX certificates, and rotate Sicoob client IDs accessible on compromised systems.

---

npm Dependency Confusion and Typosquatting Campaigns

Two distinct supply chain attacks targeted the npm ecosystem:

1. Dependency Confusion Campaign: 33 malicious npm packages collected reconnaissance data from developer and build environments, exploiting dependency confusion vulnerabilities to profile target systems.

2. Mini Shai-Hulud Campaign: Typosquatted npm packages stole cloud and CI/CD credentials from developer environments.

Defensive measures: Configure npm to use scoped packages for all internal dependencies, implement package lock files with integrity hash verification, and deploy private npm registries with higher priority than public registries.

---

Geopolitical Context

Russia-Ukraine Cyber Operations

GREYVIBE's emergence adds to the documented ecosystem of Russian cyber operations supporting military and intelligence objectives in Ukraine. The persistent targeting of Ukrainian government and critical infrastructure reflects Moscow's doctrine of integrated warfare, where cyber operations complement conventional military pressure.

Korean Peninsula Tensions

Kimsuky's March-April 2026 campaign aligns with North Korea's long-standing strategic intelligence priorities on the Korean Peninsula. The deployment of novel malware tooling demonstrates continued investment in cyber capabilities as a cost-effective asymmetric instrument under international sanctions regimes.

U.S. Critical Infrastructure Vulnerabilities

The Charter Communications breach and California's lawsuit against 23andMe over a 2023 genetic data breach highlight ongoing challenges in protecting U.S. critical infrastructure and sensitive personal information. The 23andMe case may establish precedent for state-level enforcement against companies handling biometric data.

---

Recommended Actions

Immediate (0-24 hours)

  • Patch CVE-2026-0257 in all PAN-OS GlobalProtect and Prisma Access deployments.
  • Isolate internet-facing Marimo notebook instances and rotate cloud credentials.
  • Deploy Microsoft May 2026 critical patches to internet-facing Windows servers and domain controllers.
  • Remove malicious Sicoob.Sdk NuGet package versions and revoke compromised certificates.
  • Alert users about fake ChatGPT outage pages hosted on chatgpt.com shared links.

Short-term (24-72 hours)

  • Review VPN, cloud provider, and database access logs for indicators of compromise.
  • Audit npm package installations in developer environments and CI/CD pipelines for unexpected public packages.
  • Implement enhanced monitoring for VS Code Tunnel connections and unusual remote access tool usage.
  • Coordinate with national CERT teams for IOCs related to the Dutch botnet disruption.

This week

  • Apply vendor security updates for the CIFSwitch Linux kernel vulnerability as patches are released.
  • Conduct security assessments of internet-facing assets and apply timely patching for known vulnerabilities.
  • Review and update incident response procedures for data breach scenarios.
  • Implement application control policies to prevent unauthorized ChatGPT desktop client installations.
  • Deploy file integrity monitoring and audit logging on credential stores and configuration files.

---

Watch List

  • Oracle Critical Patch Update: CERT.BE issued urgent warnings regarding multiple Oracle vulnerabilities. Review Oracle's latest CPU advisory to identify affected products in your environment.
  • ChatGPT Markdown Renderer Vulnerability: Permiso Security disclosed "ChatGPhish," a vulnerability enabling prompt injection and phishing attacks via ChatGPT's web summary response renderer. Monitor OpenAI security advisories for patch guidance.
  • Dutch Botnet Disruption: Dutch authorities disrupted a botnet comprising 17 million infected devices. Monitor for IOCs and domains associated with the seized infrastructure once published.
  • Linux CIFSwitch Vulnerability: Local privilege escalation flaw in Linux kernel CIFS implementation. CVE not yet publicly assigned; monitor vendor security updates.

---

Sources

  • BleepingComputer: Palo Alto GlobalProtect VPN auth bypass flaw now exploited in attacks
  • The Hacker News: PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257) Under Active Exploitation
  • The Hacker News: Attackers Use LLM Agent for Post-Exploitation After Marimo CVE-2026-39987 Exploit
  • CERT.BE (Belgium): Microsoft Patch Tuesday May 2026 patches 118 vulnerabilities
  • The Hacker News: Kimsuky Deploys HTTPSpy, Expands Arsenal with HelloDoor and VS Code Tunnels
  • The Hacker News: New Russian-Linked GREYVIBE Targets Ukraine with AI-Powered Cyberattacks
  • BleepingComputer: Charter Communications data breach affects 4.9 million accounts
  • The Hacker News: Malicious Sicoob NuGet Steals Banking Credentials as npm Packages Target Cloud Secrets
  • Microsoft Security: Malicious npm packages abuse dependency confusion to profile developer environments
  • Microsoft Security: Typosquatted npm packages used to steal cloud and CI/CD secrets
  • BleepingComputer: ChatGPT share links abused to host fake outage pages to deliver malware
  • BleepingComputer: California AG sues 23andMe over 2023 breach exposing health data
  • BleepingComputer: Dutch govt disrupts malware botnet with 17 million infected devices
  • BleepingComputer: New CIFSwitch Linux flaw gives root on multiple distributions
  • CERT.BE (Belgium): Multiple Vulnerabilities in Oracle Products, Patch Immediately