# Threat Intel Brief — June 17, 2026

TL;DR

  • Critical vulnerabilities under active exploitation: Fortinet FortiSandbox (CVE-2026-39813, CVSS 9.1), Cisco Catalyst SD-WAN Manager (CVE-2026-20262), Palo Alto GlobalProtect (CVE-2026-0257), and LiteSpeed cPanel Plugin (CVE-2026-54420) are all being exploited in the wild—patch immediately.
  • Supply chain attacks escalate: Malicious JetBrains IDE plugins stole AI API keys from developers; WordPress plugins OptinMonster, TrustPulse, and PushEngage were compromised to inject backdoors creating rogue admin accounts.
  • China-linked espionage campaign: A sustained intrusion lasting over one year targeted North American medical, academic, and defense research networks via compromised REDCap servers and Google Workspace email forwarding rules.
  • North Korean operations intensify: ScarCruft (APT37) deployed NarwhalRAT via fake Microsoft security alerts; Contagious Interview targeted developers through recruitment-themed phishing campaigns.
  • AI/ML infrastructure at risk: Critical flaws discovered in Google Vertex AI SDK, Microsoft 365 Copilot (SearchLeak), and LiteLLM AI gateway enable data theft and privilege escalation.

---

Critical Threats

Fortinet FortiSandbox Under Active Exploitation (CVSS 9.1)

What happened: Threat intelligence firm Defused Cyber confirmed active exploitation of three vulnerabilities in Fortinet FortiSandbox within the past 24 hours: CVE-2026-39813 (CVSS 9.1 critical), CVE-2026-39808, and CVE-2026-25089. At least one vulnerability was patched recently, but exploitation is ongoing.

Impact: FortiSandbox is deployed as a security control for malware analysis in enterprise environments. Successful exploitation allows attackers to bypass sandboxing, gain unauthorized access, or pivot to internal networks. Organizations running FortiSandbox face immediate compromise risk, particularly those with internet-facing instances.

Recommendations:

  • Apply all available Fortinet security updates immediately; consult Fortinet PSIRT advisories for patch details
  • Isolate FortiSandbox instances from untrusted networks if patching cannot be completed within hours
  • Review logs for unusual authentication attempts, configuration changes, or anomalous network connections in the past 72 hours
  • Restrict management interface access to trusted IP ranges only and disable unused services as compensating controls

---

Cisco Catalyst SD-WAN Manager Zero-Day Exploitation

What happened: Cisco released emergency security updates for CVE-2026-20262, a vulnerability in Catalyst SD-WAN Manager actively exploited as a zero-day to escalate privileges to root level. Authenticated attackers can create arbitrary files and perform unauthorized actions via the web UI.

Impact: Root-level access enables complete administrative control over SD-WAN Manager instances, potentially compromising network segmentation, routing policies, and visibility across the entire SD-WAN fabric. Attackers can install persistent backdoors, tamper with configurations, and move laterally to managed edge devices.

Recommendations:

  • Apply Cisco security updates for CVE-2026-20262 immediately to all Catalyst SD-WAN Manager instances
  • Audit all administrative accounts and recent configuration changes for signs of compromise
  • Review authentication logs for unauthorized privilege escalation attempts or suspicious root-level activity
  • Restrict network access to SD-WAN Manager interfaces to trusted management networks only

---

Palo Alto GlobalProtect Authentication Bypass Exploited

What happened: Palo Alto Networks disclosed active exploitation of CVE-2026-0257, an authentication bypass vulnerability (CVSS 7.8) affecting PAN-OS GlobalProtect VPN portal and gateway components. An unknown threat actor is exploiting this flaw to gain unauthorized access without valid credentials.

Impact: Authentication bypass allows attackers to access GlobalProtect VPN infrastructure, enabling network reconnaissance, lateral movement, and data exfiltration. Organizations with internet-facing GlobalProtect portals face immediate risk of unauthorized network access and potential compromise of remote workforce VPN connections.

Recommendations:

  • Apply vendor patches for CVE-2026-0257 immediately per Palo Alto Networks security advisories
  • Monitor GlobalProtect authentication logs for anomalous successful logins without corresponding credential validation events
  • Implement additional access controls (IP allowlisting, MFA enforcement) if patching cannot be completed immediately
  • Conduct threat hunting for indicators of compromise on GlobalProtect appliances since vulnerability disclosure

---

CISA Emergency Directive: LiteSpeed cPanel Plugin (3-Day Deadline)

What happened: CISA added CVE-2026-54420, a privilege escalation vulnerability in LiteSpeed cPanel Plugin (CVSS 8.5), to its Known Exploited Vulnerabilities catalog. Federal agencies must apply fixes by June 18, 2026. Active exploitation is confirmed.

Impact: Privilege escalation allows attackers to gain elevated access on cPanel hosting systems, potentially leading to full server compromise, data theft, website defacement, or lateral movement across multi-tenant hosting environments. Hosting providers face risk of customer data exposure and service disruption.

Recommendations:

  • Update LiteSpeed cPanel Plugin immediately via WHM or LiteSpeed repository
  • Audit cPanel access logs and LiteSpeed error logs for suspicious privilege escalation attempts
  • Review user accounts and privileges for unauthorized elevation or new administrative accounts
  • Temporarily disable the plugin and revert to alternative web server configurations if immediate patching is not possible

---

Supply Chain Attack: WordPress Plugin Backdoors

What happened: Attackers tampered with JavaScript files from WordPress plugins PushEngage, OptinMonster, and TrustPulse to inject backdoors that create unauthorized admin accounts and install hidden plugins when site administrators are logged in. The attack leveraged trusted third-party plugin resources served from Awesome Motive's CDN.

Impact: Potentially thousands of WordPress sites compromised. Attackers gain persistent admin-level access through backdoor accounts and hidden plugins, enabling full site takeover, data exfiltration, malware distribution, and SEO spam injection. Detection is difficult as malicious code executes only when legitimate admins are authenticated.

Recommendations:

  • Immediately audit all WordPress admin accounts for unauthorized users created recently; remove unrecognized accounts
  • Review installed plugins list for hidden or unfamiliar plugins; check wp-content/plugins directory for unauthorized files
  • Disable and remove PushEngage, OptinMonster, and TrustPulse plugins until vendors confirm clean versions are available
  • Force password resets for all WordPress administrator accounts and implement multi-factor authentication
  • Scan WordPress database for backdoor code using security tools like Wordfence or Sucuri

---

Malicious JetBrains IDE Plugins Steal AI API Keys

What happened: At least 15 malicious plugins were discovered on the official JetBrains Marketplace designed to steal AI API keys (OpenAI, Anthropic, etc.) from developers. The plugins were live on the marketplace and actively exfiltrating credentials from users who installed them.

Impact: Developers who installed affected plugins have had AI API keys compromised, leading to potential unauthorized usage charges, data exposure through compromised AI accounts, and possible intellectual property theft if API keys are linked to corporate accounts. Organizations face financial risk from API abuse and potential data leakage.

Recommendations:

  • Audit all JetBrains IDE plugins installed across developer workstations and remove unrecognized or suspicious plugins immediately
  • Rotate all AI service API keys (OpenAI, Anthropic, Google AI, etc.) used by developers, prioritizing keys created or accessed during the compromise window
  • Review API usage logs from AI service providers for anomalous activity or unauthorized consumption patterns
  • Implement policy requiring approval for IDE plugin installations and maintain an allowlist of vetted plugins

---

Threat Actor Activity

China-Linked Espionage: Year-Long Research Network Intrusion

A China-linked espionage group compromised North American medical, academic, and military research networks for over one year. The attackers deployed a backdoor on REDCap research servers to harvest credentials, then manipulated Google Workspace email forwarding rules to exfiltrate sensitive research and defense emails. The campaign demonstrates operational patience and strategic targeting of dual-use research and defense-related intellectual property. Organizations using REDCap for clinical or defense research should immediately audit email forwarding rules, implement MFA across research systems, and review access logs for unauthorized activity.

North Korean Operations: ScarCruft and Contagious Interview

ScarCruft (APT37) is conducting spear-phishing campaigns impersonating Microsoft Account security alerts to deliver NarwhalRAT malware. The North Korean state-sponsored group leverages social engineering to exploit user concern over account security.

Contagious Interview (also tracked as DeceptiveDevelopment, Famous Chollima, HexagonalRodent, Void Dokkaebi) is targeting software developers through recruitment and code review-themed phishing campaigns. Proofpoint researchers identified two malicious campaigns delivering malware through compromised developer tools. The operations reflect North Korea's dual objectives of espionage and revenue generation to circumvent international sanctions.

DragonForce Ransomware: Microsoft Teams C2 Abuse

DragonForce ransomware gang deployed custom malware called Backdoor.Turn to hide command-and-control traffic within Microsoft Teams relay infrastructure. This technique enables covert communication channels by blending malicious traffic with trusted enterprise collaboration services. Organizations should monitor Teams traffic for anomalous patterns, implement application-aware firewall rules, and audit Microsoft 365 tenant configurations for unauthorized relay configurations.

ShinyHunters: Education Sector Breach and Council of Europe Claims

The financially motivated ShinyHunters extortion gang stole personal information from over 137,000 school staff accounts through a Salesforce data theft attack targeting the Infinite Campus K-12 student information system in March. Separately, the Council of Europe is investigating ShinyHunters' claims of a data breach against the intergovernmental organization. The incidents underscore persistent threats to cloud-based platforms and third-party service providers.

---

Geopolitical Context

U.S. Government Actions

The Department of Justice seized CFAKE.com and SOCFAKE.com, websites hosting nonconsensual AI-generated nude images, marking the first publicly announced domain seizure under the TAKE IT DOWN Act. This establishes a legal precedent for cross-border domain-level intervention against AI-enabled image-based abuse and may influence allied jurisdictions considering similar legislative frameworks.

China-Linked Healthcare and Defense Targeting

The sustained intrusion against North American research networks aligns with long-standing patterns of cyber espionage attributed to China-linked APT groups targeting healthcare and life sciences sectors. Medical research data—particularly clinical trial information, genomic databases, and pharmaceutical intellectual property—represents strategic value for both economic competitiveness and national health security. The targeting of REDCap infrastructure demonstrates sophisticated understanding of research workflows and data repositories used by academic medical centers.

North Korean Sanctions Evasion

North Korean cyber operations continue to prioritize revenue generation and intellectual property theft to circumvent international sanctions. The targeting of software developers through recruitment lures and the deployment of NarwhalRAT via Microsoft-themed phishing reflect persistent efforts to acquire proprietary code, cryptocurrency infrastructure access, and strategic intelligence to support regime priorities amid economic isolation.

---

Recommended Actions

Immediate (0-24 hours)

  • Patch critical vulnerabilities: Fortinet FortiSandbox (CVE-2026-39813, CVE-2026-39808, CVE-2026-25089), Cisco SD-WAN Manager (CVE-2026-20262), Palo Alto GlobalProtect (CVE-2026-0257), LiteSpeed cPanel Plugin (CVE-2026-54420)
  • WordPress supply chain response: Audit admin accounts, remove PushEngage/OptinMonster/TrustPulse plugins, scan for backdoors
  • JetBrains plugin audit: Remove suspicious IDE plugins and rotate all AI service API keys
  • REDCap/Google Workspace: Audit email forwarding rules and review access logs for unauthorized activity

Near-term (24-72 hours)

  • Android mobile threat defense: Deploy or update MTD solutions to detect Rokarolla banking trojan across corporate and BYOD devices
  • SimpleHelp OIDC flaw: Disable OpenID Connect authentication on SimpleHelp servers until vendor patch is available
  • Microsoft 365 Copilot: Review and restrict Copilot data access permissions; implement URL filtering for phishing campaigns
  • LiteLLM AI gateway: Review user accounts and monitor for privilege escalation attempts; rotate AI provider API keys

This week

  • Google Vertex AI SDK: Update to latest patched version; review GCS bucket permissions and audit recent model uploads
  • GitLab CE/EE: Review GitLab security advisories and upgrade to latest patched version
  • Steam Workshop/Wallpaper Engine: Block or restrict downloads on corporate endpoints; monitor for suspicious child processes
  • ClickFix campaigns: Deploy email/web filtering for fake update pages; conduct user awareness training for education and finance staff

---

Watch List

  • GhostTree evasion technique: Monitor for NTFS junction creation patterns that may evade antivirus scanning (Sysmon Event ID 12/13)
  • SprySOCKS Windows variants: Hunt for unusual SOCKS proxy activity and unauthorized network tunneling on Windows and Linux endpoints
  • Jansi library (CVE-2026-8484): Monitor for patched version release; inventory applications using jansi via dependency scanning
  • Responsive FileManager (CVE-2026-5482): Disable or restrict file upload functionality until patches are available
  • Quick.CMS (CVE-2026-11860): Contact vendor for patch availability; implement network segmentation for affected systems

---

Sources

  • BleepingComputer, The Hacker News, Unit 42 (Palo Alto Networks), CISA, CERT.BE, CERT.PL
  • Fortinet PSIRT, Cisco Security Advisories, Palo Alto Networks Security Advisories
  • Proofpoint, Defused Cyber, Varonis Threat Labs, Obsidian Security