# Threat Intel Brief — June 14, 2026

TL;DR

  • Critical vulnerabilities in Splunk Enterprise (CVE-2026-20253), Oracle PeopleSoft, and Ivanti Sentry are under active exploitation; immediate patching required.
  • Supply chain compromise: Over 400 Arch User Repository packages backdoored with credential-stealing malware and eBPF rootkit targeting Linux developers.
  • Decade-long espionage: Chinese APT group Velvet Ant maintained persistent access via backdoored Linux authentication components (PAM/OpenSSH) for nearly 10 years.
  • Geopolitical tensions: U.S. government ordered Anthropic to restrict foreign national access to advanced AI models citing national security concerns.
  • Law enforcement wins: INTERPOL dismantled Sniper Dz phishing platform (201 arrests); Europol disrupted AudiA6 crypto-laundering service (€336M processed); Conti ransomware operator pleads guilty.

---

Critical Threats

Splunk Enterprise Unauthenticated RCE (CVE-2026-20253)

What happened: Splunk disclosed a critical vulnerability (CVSS 9.8) in Splunk Enterprise versions below 10.2.4 and 10.0.7 allowing unauthenticated attackers to perform arbitrary file operations leading to remote code execution. No active exploitation or public proof-of-concept has been reported, but the severity warrants immediate action.

Impact: Organizations using Splunk for security monitoring face severe risk. Attackers can execute arbitrary code without authentication, potentially accessing all indexed data, credentials, and using compromised systems as pivot points into broader networks. The irony of security infrastructure becoming an attack vector amplifies the business impact.

Recommendations:

  • Upgrade to Splunk Enterprise 10.2.4, 10.0.7, or later immediately
  • Restrict network access to Splunk management interfaces to trusted networks only
  • Review access logs for unusual unauthenticated connection attempts or file operation anomalies
  • If immediate patching is impossible, isolate affected instances behind strict firewall rules

---

Oracle PeopleSoft RCE Under Active Exploitation

What happened: CERT.BE issued a critical warning regarding an actively exploited remote code execution vulnerability in Oracle PeopleSoft. Specific CVE not yet publicly assigned. Threat actors are targeting vulnerable internet-facing PeopleSoft deployments in the wild.

Impact: Critical risk for organizations running PeopleSoft HR and finance systems. Successful exploitation enables arbitrary code execution, potentially leading to full system compromise, data exfiltration, lateral movement, and business disruption. The lack of CVE assignment limits threat intelligence correlation but does not reduce urgency.

Recommendations:

  • Identify all PeopleSoft instances immediately, prioritizing internet-facing systems
  • Apply Oracle security patches per vendor guidance (check Oracle Critical Patch Update advisories)
  • Review PeopleSoft access logs for suspicious authentication attempts or unexpected code execution patterns
  • Restrict network access using firewall rules or VPN requirements until patching is complete
  • Monitor Oracle security bulletins for CVE assignment and additional technical details

---

Ivanti Sentry Flaw Exploited in the Wild (BOD 26-04)

What happened: CISA issued Binding Operational Directive 26-04 ordering U.S. federal agencies to patch an actively exploited Ivanti Sentry vulnerability within three days. CVE not yet assigned. Active exploitation confirmed.

Impact: Federal agencies face a Sunday deadline, but all Ivanti Sentry deployments are at immediate risk. The three-day remediation window signals CISA possesses threat intelligence indicating sophisticated adversary involvement. Potential for unauthorized access, lateral movement, or data exfiltration.

Recommendations:

  • Identify all Ivanti Sentry instances using asset inventory and network scanning
  • Apply Ivanti security patches immediately when released; monitor vendor advisories continuously
  • Implement network segmentation to isolate Ivanti Sentry systems until patching is complete
  • Review authentication logs and access patterns for indicators of compromise
  • If patching cannot be completed within 24-48 hours, consider temporarily disconnecting from network or restricting access to trusted IP ranges

---

Arch User Repository Supply Chain Attack

What happened: Attackers compromised over 400 packages in the Arch User Repository (AUR) by modifying build scripts to deploy a Rust-based infostealer and eBPF rootkit. The malware harvests developer credentials (SSH keys, Git tokens, browser credentials) and can load an eBPF rootkit when executed with root privileges to evade detection.

Impact: Developer workstations and build environments face high risk of credential theft. The eBPF rootkit enables persistent access and evades traditional detection methods. Compromised credentials could enable lateral movement to production systems, source code repositories, and CI/CD pipelines. Organizations using Arch Linux in development or infrastructure roles face immediate risk of secondary compromise.

Recommendations:

  • Audit all Arch Linux systems for AUR package installations and review recent build/install logs
  • Rotate all developer credentials on potentially affected systems including SSH keys, Git tokens, API keys, and cloud provider credentials
  • Scan for eBPF programs using bpftool prog list and bpftool map list as root
  • Isolate suspected compromised systems from production networks and source code repositories
  • Consider rebuilding affected systems from clean media rather than attempting remediation

---

Fortinet FortiSandbox Command Injection

What happened: Fortinet addressed a critical command injection vulnerability in FortiSandbox. CVE not yet assigned. Specific versions not disclosed. Patches available.

Impact: Command injection vulnerabilities typically allow attackers to execute arbitrary system commands, potentially leading to complete system compromise. FortiSandbox is used for malware analysis and threat detection, making it a high-value target. Organizations using FortiSandbox face immediate risk until patched.

Recommendations:

  • Identify all FortiSandbox instances and verify current versions
  • Apply Fortinet-provided patches immediately per vendor security advisory
  • Restrict network access to FortiSandbox management interfaces to trusted IP ranges only
  • Review FortiSandbox logs for suspicious command execution or unauthorized access attempts
  • Monitor Fortinet security advisories for CVE assignment and additional technical details

---

Threat Actor Activity

Velvet Ant: Decade-Long Linux Authentication Backdoor

Chinese APT group Velvet Ant backdoored Linux PAM and OpenSSH components to maintain persistent access for nearly a decade. By compromising foundational authentication infrastructure, the group achieved visibility into administrative activities while evading standard cleanup procedures. The operational patience and stealth demonstrate state-level resources and strategic intelligence collection priorities.

Defensive priorities:

  • Implement file integrity monitoring on PAM modules (/lib/security/, /lib64/security/) and OpenSSH components
  • Conduct cryptographic verification of critical system binaries against known-good hashes
  • Hunt for unauthorized library loads via LD_PRELOAD and LD_LIBRARY_PATH modifications
  • Monitor for unexpected outbound connections from authentication services on non-standard ports
  • Deploy endpoint detection capable of identifying anomalies in authentication traffic patterns

---

UNC1151/Ghostwriter Targets Polish Gmail Accounts

Belarus-linked threat group UNC1151 (Ghostwriter) continues multi-year phishing campaign targeting Gmail accounts of Polish citizens. The group has evolved techniques while maintaining consistent strategic objectives aligned with Belarusian and Russian intelligence interests. Poland's role as a NATO frontline state and logistics hub for Ukraine support makes it a persistent espionage target.

Defensive priorities:

  • Implement advanced email security with URL rewriting and sandboxing for webmail login spoofs
  • Deploy multi-factor authentication enforcement, prioritizing hardware tokens over SMS-based methods
  • Conduct targeted security awareness training on UNC1151 phishing tactics for government, military, and civil society personnel
  • Monitor for anomalous email account access patterns including impossible travel and new device logins
  • Establish threat intelligence sharing with CERT.PL and regional partners

---

Chinese Cybercrime Network Weaponizes Google Gemini AI

Google filed legal action against a Chinese cybercrime network operating the Outsider phishing-as-a-service platform, which weaponizes Google's Gemini AI to craft SMS-based phishing attacks targeting Americans. The case highlights dual-use challenges facing AI developers and represents a notable escalation in private-sector responses to transnational cybercrime.

Defensive priorities:

  • Implement SMS filtering and mobile threat defense solutions to detect smishing attempts
  • Deploy user awareness training focused on AI-generated phishing content
  • Monitor for anomalous authentication attempts following SMS delivery
  • Enforce phishing-resistant MFA using FIDO2/WebAuthn tokens rather than SMS-based OTP
  • Establish threat intelligence sharing to identify Outsider platform indicators

---

Geopolitical Context

U.S. AI Export Controls Expand to Cloud Services

The U.S. government ordered Anthropic to restrict foreign national access to its Fable 5 and Mythos 5 AI models, citing jailbreak vulnerabilities and national security concerns. Anthropic complied but publicly disputed the technical rationale, arguing the cited vulnerability is narrow and similar capabilities exist elsewhere. The directive extends semiconductor-style export controls to cloud-based AI services, reflecting growing concern that adversaries could exploit cutting-edge AI for malicious purposes.

Implications: The measure is likely to generate friction with U.S. allies in Europe and Asia, who may view nationality-based access controls as discriminatory. For adversarial states, the measure reinforces incentives to accelerate indigenous AI development, potentially fragmenting the global AI ecosystem along geopolitical lines. If similar restrictions expand to other U.S. AI labs, international customers may increasingly turn to European or Chinese alternatives.

---

Law Enforcement Disruptions

INTERPOL Operation Ramz: Dismantled Sniper Dz phishing-as-a-service platform, resulting in 201 arrests across 13 Middle East and North Africa countries. The arrest of Guedz, the platform's primary administrator, may yield intelligence on customer bases and financial flows.

Europol AudiA6 Takedown: Disrupted cryptocurrency laundering service used by ransomware gangs, which had processed over €336 million in illicit profits. The action demonstrates maturing European capability to disrupt cryptocurrency-based money laundering at scale.

Conti Operator Guilty Plea: Ukrainian national extradited from Ireland to the United States pleaded guilty to conspiracy charges related to the Conti ransomware operation, marking a significant law enforcement milestone in transatlantic cooperation against ransomware infrastructure.

---

Recommended Actions

Immediate (0-24 hours)

  • Patch Splunk Enterprise to 10.2.4/10.0.7 or later (CVE-2026-20253)
  • Patch Oracle PeopleSoft per vendor guidance (actively exploited)
  • Patch Ivanti Sentry per CISA BOD 26-04 (actively exploited)
  • Audit Arch Linux systems for AUR package installations and rotate developer credentials
  • Patch Fortinet FortiSandbox per vendor advisory

Short-term (24-72 hours)

  • Conduct threat hunting for Velvet Ant indicators in Linux authentication infrastructure
  • Review phpBB installations and apply latest security patch (10-year-old auth bypass)
  • Patch LangGraph to latest version (RCE via SQL injection chain)
  • Implement network segmentation for AI coding agent environments

This week

  • Conduct security reviews of AI agent configurations and Sentry integrations
  • Implement file integrity monitoring on critical authentication binaries
  • Review and harden authentication infrastructure against long-term persistence techniques
  • Assess exposure to UNC1151 phishing campaigns and enhance email security controls

---

Watch List

  • CVE assignments pending: Oracle PeopleSoft RCE, Ivanti Sentry, Fortinet FortiSandbox, phpBB auth bypass, LangGraph RCE chain
  • Emerging attack techniques: Agentjacking attacks targeting AI coding agents via crafted Sentry error reports
  • Supply chain risks: Ongoing investigation into full scope of Arch User Repository compromise; watch for additional affected packages
  • Geopolitical developments: Potential expansion of U.S. AI export controls to other frontier models; allied government responses to Anthropic restrictions
  • Threat actor evolution: Velvet Ant authentication backdoor techniques may be adopted by other APT groups; monitor for similar PAM/OpenSSH compromises

---

Sources

  • CISA Binding Operational Directive 26-04
  • Splunk Security Advisory (CVE-2026-20253)
  • CERT.BE (Belgium) Security Advisories
  • CERT.PL (Poland) Threat Intelligence
  • BleepingComputer Security News
  • The Hacker News
  • Europol Press Releases
  • INTERPOL Operation Ramz Reporting
  • Google Legal Filings
  • Mandiant Threat Intelligence (UNC1151/Ghostwriter)
  • Arch Linux Security Team
  • Oracle Critical Patch Updates
  • Ivanti Security Advisories
  • Fortinet Security Advisories