# Threat Intel Brief — June 6, 2026

TL;DR

  • Critical zero-days under active exploitation: Cisco SD-WAN Manager (CVE-2026-20245) and Palo Alto PAN-OS (CVE-2026-0257) are being exploited in the wild with no patches available for Cisco; immediate mitigation required.
  • npm supply chain compromise: Over 50 legitimate packages poisoned with IronWorm stealer featuring eBPF rootkit capabilities, threatening developer environments and CI/CD pipelines globally.
  • WordPress RCE actively exploited: Everest Forms Pro plugin vulnerability (CVE-2026-3300, CVSS 9.8) enables complete site takeover across approximately 4,000 installations.
  • Chinese espionage escalation: UNC5221 and OP-512 threat clusters deploy novel malware targeting Microsoft 365 and IIS infrastructure for persistent access.
  • Critical infrastructure exposure: Over 900 U.S. fuel tank monitoring systems accessible online, creating potential for environmental and supply chain disruption.

Critical Threats

Cisco SD-WAN Manager Zero-Day (CVE-2026-20245)

What happened: Cisco disclosed an unpatched zero-day vulnerability in Catalyst SD-WAN Manager enabling root privilege escalation. Active exploitation is confirmed in the wild.

Impact: Organizations running SD-WAN Manager face immediate risk of full system compromise. Attackers achieving root access can manipulate network configurations, intercept traffic across branch locations, establish persistent backdoors, and pivot to connected segments. This is particularly critical for enterprises relying on SD-WAN for branch connectivity and cloud access.

Recommendations:

  • Restrict SD-WAN Manager management interface access to trusted IP ranges only via firewall ACLs
  • Enable enhanced logging and monitor for unusual administrative activity, privilege escalation attempts, and unauthorized configuration changes
  • Review access logs from the past 30 days for indicators of compromise, focusing on unexpected root-level commands
  • Implement network segmentation to isolate SD-WAN Manager from untrusted networks
  • Contact Cisco TAC immediately for interim mitigation guidance

npm Ecosystem Supply Chain Attack

What happened: Threat actors compromised over 50 legitimate npm packages to distribute IronWorm, a Rust-based information stealer with eBPF kernel rootkit capabilities, alongside a new Miasma worm variant. The attack targets developer workstations and CI/CD infrastructure.

Impact: Developer machines and build servers face critical risk of credential theft, source code exfiltration, and environment variable harvesting. The eBPF rootkit provides kernel-level persistence and evasion, making detection and removal extremely difficult. Compromised packages can propagate malware to downstream customers and production environments through the software supply chain.

Recommendations:

  • Audit all npm dependencies immediately using npm audit and cross-reference against npm security advisories
  • Isolate and forensically examine any systems that installed npm packages in the past 14 days; check for eBPF programs using bpftool prog list on Linux systems
  • Rotate all credentials, API keys, and SSH keys accessible from development environments
  • Implement package lock file verification and use --ignore-scripts flag to prevent automatic execution until packages are vetted
  • Monitor network egress from development infrastructure for unusual data exfiltration patterns

Everest Forms Pro WordPress RCE (CVE-2026-3300)

What happened: Attackers are actively exploiting a critical remote code execution vulnerability (CVSS 9.8) in Everest Forms Pro WordPress plugin versions up to 1.9.12, affecting approximately 4,000 installations.

Impact: Complete WordPress site compromise is possible, enabling arbitrary code execution, data theft, malware injection, and potential lateral movement to backend infrastructure. Despite the limited install base, affected organizations face immediate takeover risk.

Recommendations:

  • Identify all WordPress instances running Everest Forms Pro versions ≤1.9.12 immediately
  • Update to version 1.9.13 or later, or disable/remove the plugin until patched version is confirmed
  • Review WordPress access logs and WAF logs for suspicious POST requests targeting Everest Forms endpoints
  • Conduct forensic review for webshells, unauthorized admin accounts, and modified core files
  • Implement WAF rules to block exploitation attempts if immediate patching is not feasible

Palo Alto PAN-OS Exploitation (CVE-2026-0257)

What happened: Unit 42 reports active exploitation of a PAN-OS vulnerability with indicators of activity available. Threat actors are targeting vulnerable firewall systems in the wild.

Impact: Compromise of perimeter security infrastructure can lead to network breach, lateral movement, data exfiltration, and loss of visibility into network traffic. Exploitation of firewall platforms represents a high-value target for both espionage and ransomware operations.

Recommendations:

  • Review Unit 42 threat intelligence report immediately for IOCs and scan PAN-OS logs for matching activity
  • Apply vendor patches for CVE-2026-0257 as published by Palo Alto Networks
  • Verify PAN-OS version inventory and prioritize patching internet-facing management interfaces
  • Implement temporary access restrictions to management interfaces if patching cannot be completed within 24 hours
  • Monitor authentication logs, configuration changes, and administrative activity for signs of compromise

Threat Actor Activity

UNC5221 (China-Nexus)

Chinese APT group UNC5221 is conducting espionage operations targeting Microsoft 365 environments using the Brickstorm backdoor alongside two previously undocumented malware tools: Plenet and AgentPSD. The group demonstrates advanced cloud intrusion capabilities and maintains persistent access across multiple sectors. Organizations with significant M365 deployments should implement enhanced conditional access policies, enforce MFA across all accounts, and audit cloud application permissions for unauthorized OAuth applications.

OP-512 (China-Linked)

A newly identified threat cluster assessed with moderate-to-high confidence to be linked to China is targeting Microsoft IIS servers with a custom web shell framework. The espionage-focused activity indicates strategic intelligence collection against IT infrastructure. Defenders should monitor IIS servers for suspicious file creation in web directories, implement file integrity monitoring, and restrict write permissions to prevent web shell deployment.

IronWorm

This threat actor is conducting sophisticated supply chain attacks against the npm ecosystem, demonstrating advanced technical capabilities through Rust-based malware with eBPF rootkit functionality. The scale of over 50 compromised packages indicates either compromised maintainer accounts or exploitation of package publishing infrastructure. The actor's focus on developer environments suggests objectives beyond immediate financial gain, potentially enabling second-order attacks against downstream software consumers.

PCPJack

PCPJack has hijacked approximately 230 servers across AWS, Google Cloud, and Microsoft Azure to establish a covert SMTP email relay network. Compromised business servers in the U.S., Europe, and Asia are synchronized to downstream consumers every five minutes. Organizations should implement cloud security posture management to detect unauthorized SMTP installations and restrict outbound email traffic to authorized mail servers only.

Geopolitical Context

China-Aligned Espionage Escalation

The simultaneous emergence of UNC5221 and OP-512 targeting cloud and web infrastructure reflects sustained Chinese investment in tooling designed to exploit enterprise migration to cloud platforms. The deployment of previously undocumented malware indicates active evasion of Western cybersecurity defenses. Organizations in NATO member states and those involved in strategic industries face elevated risk, particularly as these campaigns demonstrate broad intelligence requirements across multiple sectors rather than narrow tactical focus.

U.S. Critical Infrastructure Vulnerabilities

The exposure of over 900 automatic tank gauge systems monitoring fuel and chemical storage represents a significant vulnerability in U.S. critical infrastructure. While no specific threat actor is identified, exposed industrial control systems have historically attracted attention from state-aligned APT groups. The vulnerability underscores systemic challenges in securing operational technology across North American energy infrastructure and may prompt CISA emergency directives if exploitation occurs.

European Cybersecurity Coordination

Belgian CERT advisories regarding critical vulnerabilities in Gladinet Triofox and Cisco Unified Communications Manager reflect broader European efforts under the NIS2 Directive to strengthen collective cyber resilience. The warnings are particularly relevant for EU institutions and NATO headquarters located in Brussels, where telecommunications and file-sharing platform compromises could expose sensitive diplomatic and military communications.

Recommended Actions

Immediate (0-24 hours)

  • Patch or mitigate CVE-2026-20245 (Cisco SD-WAN Manager) and CVE-2026-0257 (PAN-OS) on all instances
  • Audit npm dependencies and isolate potentially compromised developer workstations
  • Update Everest Forms Pro WordPress plugin to version 1.9.13+ or disable immediately
  • Restrict access to SD-WAN Manager, PAN-OS, and IIS management interfaces to trusted networks
  • Block C2 domain govlens[.]net associated with Asin Android spyware

Within 24-72 hours

  • Forensically examine systems that installed npm packages in the past 14 days for eBPF programs and credential theft indicators
  • Review Microsoft 365 logs for anomalous authentication patterns and unauthorized OAuth applications
  • Audit IIS servers for suspicious .aspx/.ashx files and web shell indicators
  • Verify ATG systems are not internet-accessible and implement network segmentation
  • Rotate credentials accessible from potentially compromised development environments

This week

  • Implement enhanced logging for PowerShell execution, cloud authentication events, and IIS worker processes
  • Deploy detection rules for Brickstorm, Plenet, AgentPSD, IronWorm, and Miasma malware families
  • Conduct threat hunting for web shells on IIS infrastructure and SMTP relay configurations on cloud instances
  • Review and harden WordPress installations, cloud IAM permissions, and third-party JavaScript dependencies
  • Subscribe to vendor advisories for Cisco, Palo Alto, SolarWinds, and Gladinet for patch notifications

Watch List

  • SolarWinds Serv-U: CISA warns of active exploitation causing server crashes; specific CVE not yet publicly assigned
  • Gladinet Triofox: CERT.BE issued critical warning; CVE and technical details pending
  • Cisco Unified Communications Manager: High-severity flaw with public PoC; CVE not yet assigned
  • Polyfill supply chain compromise: Credential-harvesting prompts on Toshiba and Muji websites; broader impact assessment ongoing
  • FIFA World Cup 2026 fraud campaign: Thousands of lookalike domains and banking malware distribution ahead of June 11 kickoff
  • Asin Android spyware: Targeting Arabic-speaking users via fake news and war-related apps since early 2025

Sources

  • BleepingComputer: Suspicious Polyfill login prompts, CISA SolarWinds Serv-U warning, Chinese APT malware deployment, U.S. fuel tank systems exposure, Cisco SD-WAN zero-day
  • The Hacker News: IronWorm npm supply chain attack, Asin Android spyware, OP-512 IIS targeting, Everest Forms Pro exploitation, FIFA World Cup fraud, PCPJack cloud hijacking
  • Unit 42 (Palo Alto Networks): PAN-OS CVE-2026-0257 active exploitation
  • Microsoft Security: Claude Code GitHub Action prompt injection vulnerability
  • CERT.BE (Belgium): Gladinet Triofox and Cisco Unified Communications Manager advisories

---

*This report synthesizes threat intelligence from multiple sources as of June 6, 2026. Organizations should verify applicability to their specific environments and consult vendor advisories for complete technical details and remediation guidance.*