# Threat Intel Brief — October 4, 2026

TL;DR

  • Critical zero-day exploitation: Fortinet FortiMail (CVE-2026-104286) under active attack; CISA mandates federal remediation by today. Dell Container Storage Modules flaws (CVE-2026-63688, CVE-2026-63692, four others) enable unauthenticated admin takeover of Kubernetes environments.
  • China-nexus espionage escalates: MI5 publicly warns 100+ U.K. academics received MSS funding via front company CGTRI. Separate campaign deploys Antino backdoor against Asian governments using Outlook/OneDrive for C2.
  • Warlock ransomware targets critical infrastructure: China-linked group exploits SharePoint vulnerabilities to compromise water utilities, telecom providers, and government bodies in Portuguese/Spanish-speaking regions.
  • Law enforcement gains ground: ShinyHunters member detained in Jordan, cooperating with FBI. U.S. Treasury sanctions eight Tren de Aragua members for $40M+ ATM jackpotting campaign.
  • Immediate action required: Patch FortiMail, Dell CSM, Cisco SD-WAN Manager, GitLab AI Gateway, and WatchGuard Fireware OS. Audit SharePoint deployments and academic funding sources.

---

Critical Threats

Fortinet FortiMail Zero-Day Exploitation (CVE-2026-104286)

What happened: CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities catalog following confirmed active exploitation. The vulnerability (CVSS 9.8) allows unauthenticated attackers to write arbitrary files on FortiMail servers via path traversal and null byte injection in HTTP/HTTPS handlers. Fortinet has published indicators of compromise including attacker IPs (79.141.169.187, 45.129.0.192) and modified system binaries. Patches are not yet available for any affected version (7.2.0–7.2.9, 7.4.0–7.4.8, 7.6.0–7.6.6, 8.0.0–8.0.1).

Impact: Email security gateways occupy privileged positions in enterprise networks. Arbitrary file write enables full system compromise, backdoor installation, and persistent access. Organizations exposing FortiMail management interfaces to the internet face immediate risk. The vulnerability affects multiple major version branches, suggesting a large vulnerable install base.

Recommendations:

  • 0–24h: Disable IBE feature via CLI (config system encryption ibe, set status disable, end) on all FortiMail instances immediately.
  • 0–24h: Block internet access to FortiMail management interfaces; restrict to trusted private networks via firewall ACLs.
  • 0–24h: Hunt for IOCs: check for /data/lib/liblog.so, /data/bin/webconsole, /data/bin/mailservice, /data/etc/ld.so.preload; review connections to attacker IPs; inspect modifications to /bin/smit, /data/etc/httpd.conf, /data/migadmin.tar.gz.
  • 24–72h: Prepare to upgrade to FortiMail 8.0.2, 7.6.7, or 7.4.9 when released; migrate from 7.2.x branch immediately when patches available.

---

Dell Container Storage Modules Kubernetes Takeover

What happened: Dell disclosed six critical vulnerabilities in Container Storage Modules (CSM) Authorization, all versions prior to 1.18.0. CVE-2026-63688 (CVSS 10.0) exposes storage backend admin credentials via unauthenticated gRPC access. CVE-2026-63692 bypasses authentication in authorization proxy and tenant service. Four additional flaws (CVE-2026-67269, CVE-2026-54472, CVE-2026-61421, CVE-2026-67273) enable root access on cluster nodes, token forgery, and unauthorized Kubernetes Secrets access. No workarounds exist; patching required.

Impact: Complete compromise of Dell storage infrastructure and Kubernetes orchestration layer. Attackers can retrieve admin credentials for all registered PowerStore, PowerScale, PowerFlex, PowerMax, and Unity XT arrays; escalate to root on cluster nodes; forge valid admin tokens; and access secrets across all tenants. Multi-tenant environments face cross-tenant breach risk.

Recommendations:

  • 0–24h: Upgrade Dell CSM to version 1.18.0 on all Kubernetes clusters with Dell CSI drivers.
  • 0–24h: Audit CSM Authorization logs for unauthorized gRPC access, credential retrieval, or anomalous custom resource submissions.
  • 24–72h: Rotate all storage array administrator credentials and Kubernetes service account tokens post-patching.
  • 24–72h: Review Kubernetes RBAC policies and Secret access logs for unauthorized activity across tenants.
  • This week: Isolate CSM Authorization proxy and tenant service network access to trusted management networks only.

---

Cisco SD-WAN Manager Authentication Bypass (Active Exploitation)

What happened: CERT.BE issued an urgent advisory for a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager. Unauthenticated remote attackers can gain administrative API access. Active exploitation confirmed; specific CVE and affected versions not disclosed in available reporting.

Impact: Full administrative control over SD-WAN infrastructure enables attackers to reconfigure routing, intercept traffic, deploy malicious configurations, or pivot to connected networks. Active exploitation increases immediate compromise risk for organizations with internet-exposed SD-WAN Manager interfaces.

Recommendations:

  • 0–24h: Identify all Cisco Catalyst SD-WAN Manager instances; verify patch status against Cisco Security Advisories.
  • 0–24h: Restrict network access to SD-WAN Manager interfaces using firewall rules; limit to trusted management networks only.
  • 0–24h: Review SD-WAN Manager API access logs for unauthorized administrative actions or anomalous authentication patterns.
  • 24–72h: Apply Cisco-provided patches immediately when available; monitor Cisco advisories for release information.

---

GitLab AI Gateway Remote Code Execution (CVE-2026-90970)

What happened: GitLab disclosed a critical RCE vulnerability (CVSS 9.9) in its AI Gateway service affecting self-hosted deployments running versions 18.1.6 through 19.4.0. Authenticated users with Duo Agent Platform access can execute arbitrary commands via crafted custom flow configurations. Patches released in gateway versions 19.2.4, 19.3.2, and 19.4.1. GitLab.com, GitLab Dedicated, and instances using GitLab-hosted gateways are not affected. No active exploitation reported; CISA assessment lists exploitation as "none" as of October 2.

Impact: Compromised self-hosted AI Gateways expose JWT signing keys, connections to GitLab instances, and AI model provider access. Only organizations self-hosting their own AI Gateway are at risk; GitLab-managed gateways already patched.

Recommendations:

  • 0–24h: Update self-hosted GitLab AI Gateway to version 19.2.4, 19.3.2, or 19.4.1 depending on GitLab release line.
  • 24–72h: For Docker deployments: stop/remove container, pull new image tag (e.g., self-hosted-v19.4.1-ee), redeploy.
  • 24–72h: For Helm deployments: update image tag in chart to patched version.
  • This week: Audit Duo Agent Platform access permissions; review custom flow configurations for anomalies.
  • This week: Rotate JWT signing keys on updated gateways as precautionary measure.

---

WatchGuard Fireware OS Critical Vulnerabilities

What happened: CERT.BE warned of multiple critical vulnerabilities in WatchGuard Fireware OS, including a remote code execution flaw. Specific CVE identifiers, affected versions, and CVSS scores not disclosed in available reporting. Immediate patching recommended.

Impact: RCE vulnerabilities in perimeter security devices enable attackers to compromise firewall appliances, bypass security controls, access internal networks, and establish persistent footholds. Critical infrastructure and enterprise networks face elevated risk.

Recommendations:

  • 0–24h: Identify all WatchGuard Fireware OS devices; verify current firmware versions.
  • 0–24h: Check WatchGuard security advisories portal for CVE details, affected versions, and available patches.
  • 24–72h: Apply vendor-provided Fireware OS patches immediately following change control procedures.
  • This week: Review firewall logs for suspicious authentication attempts, configuration changes, or unusual outbound connections from management interfaces.
  • This week: Restrict management interface access to trusted networks; enable multi-factor authentication where supported.

---

Threat Actor Activity

China-Nexus Espionage: Antino Backdoor Campaign

Cisco Talos tracks UAT-11587, a China-nexus threat actor conducting sustained espionage against government and policy organizations across Asia. First detected in September 2025 targeting Taiwan's academic and policy community, the campaign expanded to 16 entities across eight countries: Taiwan, India, Philippines, Cambodia, Pakistan, Thailand, Myanmar, and Syria. The actor deploys Antino, a previously undocumented backdoor that uses Microsoft Outlook and OneDrive for command-and-control via Microsoft Graph API, avoiding traditional C2 infrastructure.

TTPs: Five-stage infection chain begins with spear-phishing using spoofed sender identities and fake Gmail attachment preview widgets. HTA/WSF stagers download JavaScript payloads that trigger .NET deserialization chains, deploying Antino via DLL sideloading using legitimate Microsoft-signed binaries (GatherOsState.exe). Antino performs reconnaissance, shell/PowerShell execution, file transfer, and in-memory shellcode loading. Attribution to China assessed with high confidence based on zh-CN language artifacts, Simplified Chinese metadata, UTC+08:00 time zones, and use of rsproxy.cn Cargo registry paths (mainland China mirror service). Talos identifies tactical overlap with Jewelbug, CL-STA-0049, Earth Alux, Ink Dragon, and REF7707, though maintains separate tracking due to lack of evidence linking to Jewelbug's financially motivated operations.

Defensive priorities: Implement strict email authentication (SPF, DMARC, DKIM); monitor for Microsoft Graph API abuse patterns in Outlook/OneDrive access; detect DLL sideloading involving legitimate Microsoft-signed binaries loading unexpected DLLs; hunt for Rust-compiled executables with rsproxy.cn paths and zh-CN language artifacts.

---

Warlock Ransomware Targets Critical Infrastructure

Warlock (also tracked as Gold Salem, Longlegs, Storm-2603), a suspected China-linked threat actor, is exploiting Microsoft SharePoint vulnerabilities to deploy ransomware against critical infrastructure and public sector organizations in Portuguese- and Spanish-speaking regions. Recent victims include a water utility, telecommunications provider, regional government body, and university. The group gained prominence in mid-2025 through zero-day exploitation of "ToolShell" SharePoint vulnerabilities and maintains active operations as of July 2026.

TTPs: Initial access via SharePoint Server exploitation (web shell deployment, ASP.NET machine key extraction, forged payload execution). Uses BYOVD attacks exploiting K7RKScan.sys driver (CVE-2025-1055) to disable security software. Abuses legitimate infrastructure including Velociraptor for C2, cloud storage (catbox.moe, wasabisys.com) for payload delivery, and Microsoft Visual Studio Code tunnels for remote access. Stages ransomware in SYSVOL shares for domain-wide deployment, achieving deployment to 33+ hosts within two hours in observed intrusions. Symantec attributes overlaps with older clusters CL-CRI-1040, CamoFei, and ChamelGang.

Defensive priorities: Patch all on-premises SharePoint Server deployments immediately; monitor for web shell deployment in SharePoint directories; detect BYOVD attacks by blocking K7RKScan.sys driver loads; monitor for Visual Studio Code tunnel abuse; implement SYSVOL monitoring for unauthorized file staging.

---

MI5 Warns of China MSS Academic Funding Operation

MI5 issued a security alert on September 30, 2026, warning that over 100 U.K.-linked academics received funding from China's Ministry of State Security through the China General Technology Research Institute (CGTRI), a front organization with staffing overlaps to China's University of International Relations. The operation funds research in artificial intelligence, cybersecurity, covert communications, steganography, and signals intelligence to enhance MSS technical capabilities for espionage. MI5 invoked potential prosecution under the National Security Act 2023, framing continued collaboration as material assistance to a foreign intelligence service. China's embassy rejected the allegations as "imaginary and purely fabricated."

Implications: The operation exploits the open nature of academic collaboration, with some researchers potentially unaware of MSS backing. Research outputs support cyber-attacks previously executed by Chinese government agencies against U.K. companies, universities, public services, and critical infrastructure. The public attribution and legal threats represent a hardening of U.K. counterintelligence posture toward Chinese state-sponsored academic infiltration.

Defensive priorities: Conduct institutional reviews of all research collaborations with CGTRI/CAGT; implement mandatory funding source tracing for Chinese institutional partnerships; establish due diligence protocols to identify front organizations with intelligence service links; provide security awareness training on foreign intelligence targeting of academia; review policies for compliance with National Security Act 2023.

---

Law Enforcement Actions

ShinyHunters: A suspected member known as "Rey" was detained in Jordan and is reportedly cooperating with the FBI to locate other members of the data extortion group. ShinyHunters has conducted numerous high-profile breaches since 2020, stealing and selling databases or leveraging them for extortion.

Tren de Aragua: U.S. Treasury sanctioned eight members of the Venezuelan gang for ATM jackpotting attacks that stole over $40.73 million from U.S. financial institutions across 1,500+ incidents as of August 2025. Key figure Anibal Alexander Canelon Aguirre (alias "Prometheus"), alleged developer of Ploutus ATM malware, remains on FBI's Ten Most Wanted list. Treasury designated seven TRON blockchain addresses used for laundering approximately $6.1 million since March 2022. Justice Department has charged 98 TdA-linked suspects since October 2025.

---

Geopolitical Context

China-U.K. Academic Espionage Tensions

The MI5 alert represents an unprecedented public attribution of systematic Chinese intelligence operations targeting U.K. academia. By invoking the National Security Act 2023, the U.K. has moved from advisory warnings to legal deterrence, signaling alignment with broader Five Eyes concerns about PRC exploitation of open research ecosystems. The action follows similar U.S. Department of Justice and FBI initiatives targeting undisclosed foreign funding and "Thousand Talents" program participants, suggesting convergence in Western counterintelligence strategy. The incident risks further deterioration of U.K.-China bilateral relations, with potential spillover effects on trade, investment screening, and diplomatic engagement across Europe.

China-Nexus Targeting of Asian Governments

The Antino backdoor campaign reflects China's sustained intelligence collection priorities across the Indo-Pacific region. Taiwan emerges as a primary target, with focused collection against political, legislative, civil defense, and policy research institutions—consistent with Beijing's strategic interest in cross-Strait affairs. The expansion to India, Philippines, and Southeast Asian nations suggests broad intelligence gathering on regional government positions, maritime affairs, and diplomatic activities, likely related to South China Sea disputes and Belt and Road Initiative engagement. The concentrated attack wave in June 2026 suggests operational tempo aligned with specific geopolitical events or intelligence requirements.

Warlock's Critical Infrastructure Focus

The targeting of water utilities and telecommunications providers by a China-linked ransomware group represents a notable convergence of financially motivated cybercrime and strategic intelligence collection priorities. Critical infrastructure sectors are traditionally associated with state-sponsored espionage rather than ransomware operations. The exploitation pattern may indicate dual-use objectives: financial gain alongside intelligence collection or network mapping. The focus on Portuguese- and Spanish-speaking regions spanning Europe, Africa, and Latin America may reflect China's expanding strategic interests in regions with Belt and Road Initiative infrastructure projects and telecommunications partnerships.

U.S. Sanctions Against Transnational Cybercrime

The Treasury Department's designation of Tren de Aragua members represents an escalation in the U.S. government's use of economic statecraft against transnational criminal organizations. The action follows TdA's designation as a Transnational Criminal Organization (July 2024) and Foreign Terrorist Organization (February 2025), signaling a shift toward treating organized cybercrime as a national security threat. The whole-of-government approach—combining Treasury sanctions, FBI investigations, and Justice Department prosecutions—mirrors frameworks previously applied to state-sponsored threat actors and terrorist financing networks.

---

Recommended Actions

Immediate (0–24 hours)

1. Fortinet FortiMail: Disable IBE feature via CLI; block internet access to management interfaces; hunt for IOCs (liblog.so, webconsole, mailservice, ld.so.preload, attacker IPs 79.141.169.187 and 45.129.0.192).
2. Dell CSM: Upgrade to version 1.18.0 on all Kubernetes clusters with Dell CSI drivers; audit authorization logs for unauthorized access.
3. Cisco SD-WAN Manager: Identify all instances; restrict network access to trusted management networks; review API access logs for unauthorized activity.
4. GitLab AI Gateway: Update self-hosted gateways to patched versions (19.2.4, 19.3.2, or 19.4.1).
5. WatchGuard Fireware OS: Identify all devices; check vendor advisories for patches; restrict management interface access.

24–72 hours

6. Credential rotation: Rotate all Dell storage array admin credentials, Kubernetes service account tokens, and GitLab JWT signing keys post-patching.
7. SharePoint security: Audit all on-premises SharePoint Server deployments for ToolShell and related vulnerabilities; implement network segmentation to isolate SharePoint servers.
8. Threat hunting: Review logs for DLL sideloading involving legitimate Microsoft-signed binaries (GatherOsState.exe); monitor for Microsoft Graph API abuse patterns; detect BYOVD attacks (K7RKScan.sys driver loads).
9. Email security: Implement strict SPF, DMARC, DKIM enforcement; monitor for sender identity spoofing and fake Gmail attachment preview widgets.

This week

10. Academic partnerships: Conduct institutional reviews of all research collaborations with CGTRI/CAGT and Chinese institutions; implement mandatory funding source tracing procedures.
11. ATM security: Deploy application whitelisting and USB port controls on ATM systems; enable comprehensive logging and SIEM integration; implement physical security controls (tamper-evident seals, video surveillance).
12. Visual Studio Code monitoring: Detect abuse of VS Code tunnel feature through network traffic analysis for vscode.dev connections and remote.tunnels.api.visualstudio.com communications.
13. SYSVOL monitoring: Implement alerting for unauthorized file staging in SYSVOL shares; alert on rapid security software termination across multiple hosts as ransomware deployment indicator.

---

Watch List

  • Cisco Catalyst SD-WAN Manager: Monitor Cisco Security Advisories for CVE assignment, affected version details, and patch release information.
  • WatchGuard Fireware OS: Check WatchGuard security portal for specific CVE identifiers, CVSS scores, and affected version ranges.
  • Fortinet FortiMail patches: Prepare to upgrade to FortiMail 8.0.2, 7.6.7, or 7.4.9 when released; migrate from 7.2.x branch immediately when patches available.
  • UAT-11587 expansion: Monitor for continued targeting of Asian government and policy organizations; watch for operational security adjustments if Microsoft implements detection for Outlook/OneDrive C2 technique.
  • Warlock infrastructure: Track for additional SharePoint zero-day exploitation; monitor for pivot to alternative initial access vectors if current vulnerabilities are patched.
  • ShinyHunters disruption: Watch for additional arrests or indictments resulting from detained member's cooperation; monitor for operational security changes or group fragmentation.
  • Tren de Aragua adaptation: Monitor for shifts to privacy-focused cryptocurrencies or alternative cash-out mechanisms following sanctions; track for copycat ATM jackpotting operations by other transnational criminal groups.

---

Sources

  • BleepingComputer: ShinyHunters hacker detained in Jordan; Dell CSM flaws; Warlock ransomware; Frontline Education breach; GitLab RCE; Tren de Aragua sanctions; Microsoft X account compromise; Danish university DTU breach
  • The Hacker News: MI5 China MSS alert; Warlock SharePoint exploitation; GitLab AI Gateway patches; Antino backdoor campaign; Dell CSM vulnerabilities; FortiMail zero-day
  • CERT.BE (Belgium): Cisco SD-WAN Manager authentication bypass; WatchGuard Fireware OS vulnerabilities

---

Classification: UNCLASSIFIED
Dissemination: Approved for public release
Prepared by: Cyber Threat Intelligence Team
Date: October 4, 2026