# Threat Intel Brief — June 24, 2026

TL;DR

  • FortiBleed campaign harvests 110 million credentials from 430,000+ FortiGate firewalls globally; Russian-speaking initial access broker active since February 2026.
  • Cisco Unified Communications Manager SSRF (CVE-2026-20230) under active exploitation; immediate patching required for enterprise voice infrastructure.
  • Critical database vulnerabilities in pgAdmin 4 and ProxySQL enable RCE and credential theft; CERT.BE urges immediate remediation.
  • Supply chain attacks compromise LastPass (via Klue), ShapedPlugin WordPress plugins, npm packages, and AI marketplace skills; trust boundaries eroded across software ecosystems.
  • Scattered Spider members plead guilty to Transport for London breach; rare prosecution success against sophisticated cybercrime group.

---

Critical Threats

FortiBleed: Mass Credential Harvesting from FortiGate Devices

What happened: A Russian-speaking initial access broker has conducted a large-scale credential harvesting operation targeting over 430,000 Fortinet FortiGate firewalls globally since February 2026. The campaign, dubbed FortiBleed, deployed custom sniffers on compromised devices to capture authentication credentials, harvesting approximately 110 million credentials. The operation combines credential collection, service enumeration, brute-force attacks, and deployment of bespoke tooling.

Impact: FortiGate devices sit at network perimeters, processing VPN authentication and internal traffic. Compromised credentials enable attackers to bypass perimeter defenses, access internal networks, and establish persistent footholds. The harvested credentials are likely being monetized through underground marketplaces or sold directly to ransomware operators and espionage actors. Organizations using FortiGate infrastructure face immediate risk of follow-on intrusions, lateral movement, and data exfiltration.

Recommendations:

  • Force password resets for all FortiGate VPN and administrative accounts immediately
  • Enable multi-factor authentication on all remote access portals
  • Apply all available Fortinet security patches, particularly for SSL-VPN vulnerabilities
  • Review FortiGate access logs from February 2026 onward for anomalous authentication patterns, configuration changes, or unexpected outbound connections
  • Implement network segmentation to limit impact of credential replay attacks

---

Cisco Unified Communications Manager SSRF Under Active Exploit

What happened: CVE-2026-20230, a high-severity Server-Side Request Forgery (SSRF) vulnerability in Cisco Unified Communications Manager (CUCM), is being actively exploited in attacks. The flaw allows attackers to abuse server trust relationships to access internal resources or external systems.

Impact: SSRF exploitation in unified communications infrastructure enables attackers to pivot to internal networks, exfiltrate sensitive data, access internal APIs, or abuse backend trust relationships. Given CUCM's role in enterprise voice and video communications, successful compromise could lead to eavesdropping, service disruption, or lateral movement into critical business systems.

Recommendations:

  • Apply Cisco security patches for CVE-2026-20230 to all CUCM instances immediately
  • Restrict CUCM management interface access to trusted networks only; disable WAN-side administration
  • Review access logs for unusual outbound connection attempts or internal resource access patterns
  • Verify network segmentation between CUCM and sensitive internal resources
  • Monitor for reconnaissance activity targeting CUCM web interfaces and API endpoints

---

Critical Database Infrastructure Vulnerabilities

What happened: CERT.BE has issued urgent advisories for critical vulnerabilities in pgAdmin 4 (RCE and XSS) and ProxySQL (ACL bypass and heap memory corruption). Both flaws enable arbitrary command execution and credential exfiltration. CVE identifiers have not yet been assigned.

Impact: pgAdmin 4 is widely deployed for PostgreSQL database administration across government, enterprise, and critical infrastructure. ProxySQL manages MySQL/MariaDB traffic in high-availability architectures. Exploitation enables attackers to execute commands on database servers, steal credentials, and access sensitive data. Organizations in finance, healthcare, telecommunications, and critical infrastructure face elevated risk of data breaches and operational disruption.

Recommendations:

  • Identify all pgAdmin 4 and ProxySQL instances immediately using asset inventory tools
  • Apply vendor patches as soon as available; monitor official repositories for updates
  • Restrict network access to database management interfaces to trusted IP ranges
  • Review database access logs and application logs for suspicious activity
  • Rotate database credentials if compromise is suspected

---

Threat Actor Activity

Scattered Spider: Guilty Pleas in Transport for London Breach

Two members of the Scattered Spider cybercrime group pleaded guilty in the UK to charges stemming from an August 2024 cyberattack that disrupted Transport for London's public transport network. The group, also tracked as Roasted 0ktapus, Octo Tempest, and UNC3944, is known for sophisticated social engineering and identity-based attacks targeting cloud infrastructure. The guilty pleas represent a rare successful prosecution against this financially motivated group, which has previously deployed WarzoneRAT, Raccoon Stealer, and BlackCat ransomware in various operations.

Defensive focus: Implement phishing-resistant MFA across all accounts, particularly privileged and cloud administration roles. Monitor for suspicious authentication modifications, conditional access policy changes, and domain enumeration activity. Establish robust identity verification procedures for help desk interactions to mitigate social engineering.

---

Russian-Speaking Actors Deploy OXLOADER and CastleStealer

A new malware campaign leverages malicious Google Ads to distribute OXLOADER, a previously unreported loader, which then deploys CastleStealer information-stealing malware. Evidence suggests the threat actor is Russian-speaking and financially motivated, targeting credentials, financial data, and browser session tokens.

Defensive focus: Monitor and block suspicious ad redirects through web proxy inspection and DNS filtering. Deploy behavioral detection for loader activity including process injection and unusual parent-child process relationships. Implement credential theft detection by monitoring access to browser credential stores and Windows Credential Manager.

---

AryStinger Botnet Targets Legacy Routers for Reconnaissance

QiAnXin's XLab discovered AryStinger, a new malware family that has infected at least 4,300 legacy routers to build a distributed reconnaissance and proxy network. Unlike traditional DDoS botnets, AryStinger is designed for pre-attack intelligence gathering, targeting telecommunications and ISP infrastructure. Infection numbers continue to rise.

Defensive focus: Conduct immediate inventory and patching of legacy routers, particularly in telecom and ISP edge infrastructure. Implement network segmentation to isolate router management interfaces from public internet access. Monitor for anomalous outbound proxy traffic patterns using NetFlow analysis.

---

Supply Chain Threats

LastPass Breached via Klue Supply Chain Attack

LastPass confirmed a data breach resulting from the Klue supply chain attack, where attackers stole OAuth tokens and accessed customer data from the company's Salesforce environment. The incident demonstrates third-party OAuth integrations as a viable attack surface.

Mitigation: Audit all third-party OAuth integrations with access to Salesforce and other critical SaaS platforms; revoke unnecessary tokens. Review account activity logs for anomalous access patterns. Implement conditional access policies requiring re-authentication for sensitive data access.

---

ShapedPlugin WordPress Pro Plugins Backdoored

Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack where threat actors injected backdoor code into Pro plugin releases through the vendor's official licensed update channels. The attackers compromised the vendor's build and distribution pipeline.

Mitigation: Immediately audit all WordPress installations for ShapedPlugin Pro plugins and isolate affected systems. Review access logs and file integrity monitoring for suspicious activity. Contact ShapedPlugin for confirmation of which versions contain malicious code. Block ShapedPlugin update channels until vendor confirms infrastructure is secured.

---

Malicious npm Packages Deliver Windows RAT

Three npm packages (aes-decode-runner-pro, postcss-minify-selector, postcss-minify-selector-parser) were discovered delivering a Windows-based remote access trojan to JavaScript developers. Total downloads ranged from 145 to 615 per package.

Mitigation: Audit package.json files across all development projects for the malicious packages. Isolate and forensically examine any Windows developer workstations that installed these packages. Rotate credentials and API keys accessible from potentially compromised workstations. Implement npm package verification controls before installation.

---

Malicious AI Skills in ClawHub Marketplace

Unit 42 discovered malicious skills in ClawHub's marketplace that evade automated security scanners and deploy infostealers and agentic financial fraud capabilities. This represents an emerging AI supply chain threat where compromised AI skills can be distributed through marketplace platforms.

Mitigation: Audit all AI skills downloaded from ClawHub marketplace; remove unverified components immediately. Implement runtime monitoring for AI agent behavior, focusing on unexpected network connections and credential access. Restrict AI skill execution permissions using least-privilege principles.

---

Geopolitical Context

The FortiBleed campaign underscores the continued professionalization of Russian-language initial access brokerage, with harvested credentials likely feeding ransomware operators and state-aligned espionage actors. The guilty pleas in the Scattered Spider case demonstrate functional UK-US law enforcement cooperation, though the broader cybercrime ecosystem remains resilient.

Tata Electronics' breach highlights vulnerabilities in India's expanding electronics manufacturing base, which has strategic importance given India's ambitions to become a global electronics hub and reduce dependence on Chinese supply chains. The incident may prompt increased scrutiny of cybersecurity standards among Indian manufacturers integrated into multinational supply chains.

The targeting of Transport for London and other critical infrastructure by financially motivated actors illustrates the blurring line between cybercrime and strategic threats, particularly as geopolitical tensions elevate the risk profile of essential services.

---

Recommended Actions

Immediate (0-24 hours)

  • Patch CVE-2026-20230 in Cisco Unified Communications Manager
  • Force password resets on all FortiGate VPN and administrative accounts
  • Apply pgAdmin 4 and ProxySQL patches immediately upon availability
  • Audit WordPress installations for ShapedPlugin Pro plugins; isolate affected systems
  • Review npm dependencies for malicious packages (aes-decode-runner-pro, postcss-minify-selector, postcss-minify-selector-parser)

Short-term (24-72 hours)

  • Audit all third-party OAuth integrations; revoke unnecessary tokens
  • Review FortiGate, CUCM, and database access logs for indicators of compromise
  • Implement MFA on all remote access portals and privileged accounts
  • Conduct threat hunting for dual ransomware actor indicators in Microsoft environments
  • Audit AI skills and plugins from ClawHub marketplace

This week

  • Review and update incident response playbooks for overlapping threat actor scenarios
  • Implement GitHub Actions workflow audits for pwn request exposure (enforcement June 18, 2026)
  • Conduct user awareness training on WhatsApp-based social engineering and VBScript risks
  • Patch legacy routers and enforce credential rotation on all network devices
  • Review cloud storage bucket naming conventions to prevent hijacking attacks

---

Watch List

  • FFmpeg PixelSmash vulnerability: Monitor vendor advisories for Jellyfin, Kodi, Emby, Nextcloud, PhotoPrism, and OBS Studio for patched versions incorporating fixed FFmpeg libraries
  • Squidbleed (29-year-old Squid proxy flaw): Watch for CVE assignment and vendor patch release; prepare emergency patching window
  • DifyTap vulnerabilities in Dify platform: Monitor GitHub repository for patches addressing cross-tenant conversation theft
  • AutoJack vulnerability chain in Microsoft AutoGen Studio: Update to latest patched version via pip
  • Totolink EX1200L router (CVE-2026-44089): Monitor vendor site for firmware updates addressing stack buffer overflow
  • Cloud bucket hijacking technique: Review bucket naming practices across AWS S3, Azure Blob Storage, and GCP Cloud Storage

---

Sources

  • BleepingComputer: Cisco, Tata Electronics, Xsolis, ClickFix, Scattered Spider, LastPass, FortiBleed, WhatsApp, JaredFromSubway, FFmpeg, AutoGen Studio
  • The Hacker News: FortiBleed, GitHub Actions, npm packages, WhatsApp VBScript, ShapedPlugin, DifyTap, Squidbleed, OXLOADER, AryStinger
  • Krebs on Security: Scattered Spider prosecution
  • Unit 42 (Palo Alto): OpenClaw/ClawHub, cloud bucket hijacking
  • CERT.PL: Totolink CVE-2026-44089
  • Microsoft Security: Dual ransomware actor analysis
  • CERT.BE: pgAdmin 4, ProxySQL critical vulnerabilities