# Threat Intel Brief — June 7, 2026

TL;DR

  • Critical supply chain attacks: IronWorm malware with eBPF rootkit capabilities distributed through 50+ compromised npm packages; Miasma worm compromised 73 Microsoft GitHub repositories.
  • Active exploitation of unpatched flaws: Cisco SD-WAN Manager (CVE-2026-20245) exploited with no patch available; Palo Alto PAN-OS (CVE-2026-0257) and WordPress Everest Forms Pro (CVE-2026-3300) under active attack.
  • Chinese APT activity intensifies: UNC5221 deploys new M365 espionage tools; OP-512 cluster targets IIS servers with custom web shells.
  • Critical infrastructure exposure: Over 900 U.S. fuel tank monitoring systems accessible online without adequate security controls.
  • Mobile surveillance: Asin Android spyware targets Arabic-speaking users via fake news and war-themed applications.

---

Critical Threats

IronWorm Supply Chain Attack on npm Ecosystem

What happened: Threat actors compromised over 50 legitimate npm packages to distribute IronWorm, a Rust-based information stealer featuring eBPF kernel rootkit capabilities, alongside a new Miasma worm variant. The attack targets software developers and their build environments, enabling credential theft, source code exfiltration, and kernel-level persistence that evades traditional endpoint detection.

Impact: Organizations whose developers installed affected packages face compromise of development workstations, CI/CD pipelines, and potentially production systems. The eBPF rootkit provides kernel-level persistence, making detection and remediation significantly more complex. Stolen credentials, API keys, and SSH keys enable secondary breaches across the software supply chain. The self-replicating Miasma component enables lateral movement within development networks.

Recommendations:

  • Immediately audit all npm dependencies using npm audit and cross-reference against emerging threat intelligence on the 50+ compromised packages
  • Scan developer workstations and build servers for indicators of eBPF program loading and unusual kernel module activity
  • Rotate all credentials, API keys, SSH keys, and tokens accessible from potentially compromised development environments
  • Implement npm package integrity verification using lock files and consider migrating to a private npm registry with vetted packages
  • Deploy endpoint detection capabilities that monitor for eBPF-based rootkit behaviors on Linux development systems

---

Cisco SD-WAN Manager Zero-Day Exploitation (CVE-2026-20245)

What happened: Cisco disclosed active exploitation of CVE-2026-20245, a high-severity vulnerability (CVSS 7.8) in Catalyst SD-WAN Manager affecting all deployment types including On-Prem, Cloud-Pro, Cloud (Cisco Managed), and Government (FedRAMP) variants. No vendor patch is currently available.

Impact: Organizations using Cisco SD-WAN Manager face immediate risk from ongoing attacks with no remediation path beyond workarounds. Compromise of SD-WAN infrastructure could enable network-wide lateral movement, traffic interception, policy manipulation, or complete service disruption. The vulnerability affects government and critical infrastructure deployments, including FedRAMP-authorized environments.

Recommendations:

  • Review Cisco security advisory immediately and implement all published workarounds or compensating controls
  • Restrict network access to SD-WAN Manager interfaces to trusted management networks only; disable internet-facing access where operationally feasible
  • Enable enhanced logging and monitor for unauthorized access attempts, privilege escalation, or unexpected configuration changes
  • Audit recent administrative activity and user accounts for signs of compromise
  • Contact Cisco TAC for emergency support and guidance on defensive measures until patch release

---

WordPress Everest Forms Pro Takeover (CVE-2026-3300)

What happened: Attackers are actively exploiting CVE-2026-3300, a critical vulnerability in the Everest Forms Pro WordPress plugin, to achieve complete site takeover on affected WordPress installations.

Impact: Full site compromise enables attackers to steal user credentials, inject malicious code, deface content, establish persistent backdoors, or use compromised sites for phishing and malware distribution. Organizations running Everest Forms Pro face immediate risk of data breach, reputational damage, and potential regulatory notification requirements.

Recommendations:

  • Immediately disable or uninstall Everest Forms Pro plugin on all WordPress instances until a patched version is released
  • Audit WordPress admin user accounts for unauthorized additions or privilege escalations
  • Review WordPress and web server access logs for suspicious POST requests to admin-ajax.php or plugin endpoints
  • Implement Web Application Firewall (WAF) rules to block known exploit patterns if plugin cannot be disabled due to business requirements
  • Monitor vendor security advisories and apply patches immediately upon release

---

Miasma Worm Compromises Microsoft GitHub Repositories

What happened: The self-replicating Miasma worm compromised 73 Microsoft GitHub repositories across four organizations (Azure, Azure-Samples, Microsoft, and MicrosoftDocs). GitHub has disabled access to affected repositories in response to the active incident.

Impact: Organizations using code, packages, or dependencies from affected Microsoft repositories may have ingested malicious code into development pipelines, container images, or production systems. The supply chain risk extends to any downstream consumers of these repositories. The self-replicating nature of the worm suggests potential for continued propagation if not fully contained.

Recommendations:

  • Audit all dependencies and code sourced from Microsoft GitHub organizations (Azure, Azure-Samples, Microsoft, MicrosoftDocs) within the past 30 days
  • Review CI/CD pipeline logs for unexpected pulls or builds from affected repositories; isolate artifacts built during the compromise window
  • Scan container registries and artifact repositories for packages originating from the 73 affected repos using hash verification
  • Monitor GitHub and Microsoft Security Response Center for official list of compromised repositories and IOCs
  • Implement or verify software bill of materials (SBOM) tracking to identify transitive dependencies on affected repositories

---

Threat Actor Activity

UNC5221: Chinese APT Deploys New M365 Espionage Tools

Chinese APT group UNC5221 is conducting espionage operations targeting Microsoft 365 environments using the Brickstorm backdoor alongside two previously undocumented malware families: Plenet and AgentPSD. The group demonstrates advanced capabilities in cloud environment exploitation, deploying multiple custom tools to maintain persistent access across compromised networks. The multi-sector targeting pattern suggests broad intelligence collection requirements consistent with state-sponsored operations.

Defensive priorities: Monitor M365 audit logs for anomalous authentication patterns, impossible travel scenarios, and unusual OAuth application grants. Implement conditional access policies and enforce MFA across all accounts, particularly privileged roles. Deploy EDR solutions with behavioral analytics to identify execution of unknown binaries and suspicious process injection techniques. Conduct regular reviews of mailbox forwarding rules, inbox rules, and application permissions to identify unauthorized persistence mechanisms.

---

OP-512: New China-Linked Cluster Targets IIS Servers

ReliaQuest identified a previously unreported threat cluster, OP-512, targeting Microsoft IIS servers with a custom web shell framework. The espionage-focused activity is assessed with moderate to high confidence to be linked to China. The deployment of custom web shell frameworks indicates sophisticated development capabilities and operational security awareness consistent with state-sponsored actors. The targeting of IIS infrastructure suggests objectives focused on persistent access to enterprise environments and potential lateral movement opportunities.

Defensive priorities: Monitor IIS servers for anomalous file creation in web directories, particularly ASPX or ASP files with obfuscated code or unusual timestamps. Implement application whitelisting and integrity monitoring on IIS servers. Enable comprehensive IIS logging (W3C extended format) and monitor for unusual POST requests, abnormal user-agents, or command execution patterns. Restrict network egress from web servers and monitor for unexpected outbound connections indicating C2 communication.

---

IronWorm: npm Supply Chain Threat Actor

IronWorm represents a sophisticated threat actor conducting large-scale supply chain attacks against the npm ecosystem. The actor demonstrates advanced technical capabilities, leveraging over 50 compromised legitimate packages to distribute custom malware including a Rust-based information stealer with eBPF kernel rootkit functionality. The targeting of software developers and development environments is strategic, providing access to source code repositories, credentials, build pipelines, and downstream customers through further supply chain propagation.

Defensive priorities: Implement npm package integrity verification using lock files and regularly audit dependencies for unexpected changes. Deploy endpoint detection capabilities that monitor for eBPF program loading and unusual kernel module activity on developer workstations. Establish network segmentation and egress filtering for development environments to detect information exfiltration attempts. Monitor for suspicious post-install scripts in npm packages using tools like npm audit and socket.dev. Implement software composition analysis (SCA) tools in CI/CD pipelines to detect known malicious packages.

---

Geopolitical Context

Chinese Cyber Espionage Operations Expand Cloud Targeting

The discovery of UNC5221's M365-focused operations and OP-512's IIS server targeting reflects sustained Chinese investment in cloud infrastructure exploitation and web server persistence mechanisms. Both campaigns demonstrate the evolution of Chinese APT tradecraft toward modern cloud environments and internet-facing infrastructure, moving beyond traditional on-premises network compromise. The multi-sector targeting observed in UNC5221 operations aligns with Beijing's whole-of-nation approach to intelligence gathering in support of strategic, economic, and technological development goals. Organizations in technology, defense, telecommunications, and government sectors face elevated risk from these evolving capabilities.

U.S. Critical Infrastructure Vulnerabilities Draw Federal Attention

The exposure of over 900 automatic tank gauge systems monitoring fuel and chemical storage tanks across the United States highlights persistent operational technology (OT) security gaps in critical infrastructure. These systems lack basic network segmentation and access controls, creating potential attack surfaces for both state-sponsored actors and criminal groups. The vulnerability pattern is likely replicated globally, suggesting widespread exposure beyond U.S. borders. The incident may accelerate federal regulatory action regarding mandatory cybersecurity standards for critical infrastructure operators, particularly in light of existing executive orders addressing infrastructure protection.

Mobile Surveillance Targets Arabic-Speaking Populations

The Asin Android spyware campaign reflects ongoing targeting of Arabic-speaking populations through mobile surveillance tools, consistent with patterns observed across the Middle East and North Africa. The use of lures mimicking news sources and war-related content suggests exploitation of regional information consumption habits and heightened interest in conflict developments. Mobile spyware campaigns targeting specific linguistic communities often align with intelligence collection priorities related to regional conflicts, political movements, or diaspora monitoring. The campaign raises concerns about press freedom, activist security, and civilian privacy in conflict zones, with implications for transnational repression of diaspora communities in Europe and North America.

---

Recommended Actions

Immediate (0-24 hours)

  • Disable Everest Forms Pro on all WordPress instances until patches are available
  • Implement Cisco SD-WAN Manager workarounds per vendor advisory; restrict management interface access
  • Audit npm dependencies for compromised packages; rotate credentials accessible from development environments
  • Review Microsoft GitHub dependencies from Azure, Azure-Samples, Microsoft, and MicrosoftDocs organizations
  • Block Asin C2 domain govlens[.]net at network perimeter and DNS filtering
  • Apply PAN-OS patches for CVE-2026-0257 per Unit 42 guidance; hunt for IOCs in firewall logs
  • Patch SolarWinds Serv-U to address CVE-2026-28318 DoS vulnerability

Near-term (24-72 hours)

  • Scan development environments for eBPF rootkit indicators and unusual kernel module activity
  • Audit M365 environments for anomalous authentication patterns and unauthorized OAuth grants
  • Review IIS servers for web shell deployment indicators and anomalous file creation
  • Update Google Chrome to version 149 across all enterprise endpoints
  • Isolate ATG systems behind firewalls with strict access control lists
  • Monitor polyfill library usage in web applications; implement Subresource Integrity (SRI) hashes

This week

  • Implement SBOM tracking to identify transitive dependencies on compromised repositories
  • Deploy enhanced logging on SD-WAN Manager, IIS servers, and M365 environments
  • Conduct vulnerability assessments of internet-facing IIS and WordPress installations
  • Review third-party JavaScript libraries and Content Security Policy (CSP) headers
  • Audit GitHub Actions workflows using Claude Code for secret exposure risks
  • Monitor FFmpeg project for security advisories addressing newly discovered zero-days

---

Watch List

  • Cisco SD-WAN Manager patch release for CVE-2026-20245 — no ETA provided
  • Everest Forms Pro security update addressing CVE-2026-3300
  • Microsoft MSRC advisory on full list of compromised GitHub repositories
  • npm security advisories identifying the 50+ compromised packages in IronWorm campaign
  • FFmpeg security patches for 21 AI-discovered zero-day vulnerabilities
  • CISA KEV catalog updates for additional actively exploited vulnerabilities
  • Attribution developments for OP-512 and IronWorm threat actors
  • Polyfill supply chain incident scope and affected domains beyond Toshiba and Muji

---

Sources

  • BleepingComputer: Critical Everest Forms Pro flaw exploited to take over WordPress sites
  • The Hacker News: CISA Adds Actively Exploited SolarWinds Serv-U DoS Flaw to KEV Catalog
  • The Hacker News: AI Agent Uncovers 21 Zero-Days in FFmpeg; Chrome Patches Record 429 Bugs
  • The Hacker News: Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain Attack
  • The Hacker News: Cisco Catalyst SD-WAN Manager CVE-2026-20245 Flaw Actively Exploited – No Patch Available
  • BleepingComputer: Suspicious Polyfill login prompts pop up on Toshiba, Muji websites
  • BleepingComputer: CISA: Hackers now exploit SolarWinds Serv-U flaw to crash servers
  • BleepingComputer: Chinese APT deploys new malware to keep access to hacked networks
  • BleepingComputer: Over 900 US gas station tank gauge systems exposed to attacks
  • The Hacker News: IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks
  • The Hacker News: Android Spyware Asin Targets Arabic Users via Fake News, PDF and War Map Apps
  • The Hacker News: New Threat Cluster OP-512 Targets Microsoft IIS Servers with Custom Web Shell Framework
  • Unit 42 (Palo Alto): Threat Brief: Active Exploitation of PAN-OS CVE-2026-0257
  • Microsoft Security: Securing CI/CD in an agentic world: Claude Code Github action case