Cyber Threat Intelligence 21 April 2026

NCSA_THAICERT

Industrial Sector

Serial-To-IP Devices Hide Thousands Of Old And New Bugs
"Researchers have identified 20 new vulnerabilities in popular models of serial-to-IP converters — devices that sit at the heart of modern industrial networks. Even more worryingly, the same researchers counted thousands of known vulnerabilities in these very same devices' software stacks. Complex on the inside, serial-to-IP converters — also known as serial device servers, or serial-to-Ethernet converters — do a relatively straightforward job: they translate the language of old industrial machinery into Internet-speak, and vice versa. It goes without saying just how significant this job is: without it, plant operators wouldn't be able to monitor older machinery from the comfort of their newfangled computers."
https://www.darkreading.com/ics-ot-security/serial-ip-devices-thousands-of-bugs
https://www.securityweek.com/serial-to-ip-converter-flaws-expose-ot-and-healthcare-systems-to-hacking/

New Tooling

SmokedMeat: Open-Source Tool Shows What Attackers Do Inside CI/CD Pipelines
"Boost Security has released SmokedMeat, an open-source framework that runs attack chains against CI/CD infrastructure so engineering and security teams can see what an attacker would do in their specific environment. SmokedMeat takes a flagged pipeline vulnerability and executes a live demonstration against a team’s own infrastructure. Starting from a single vulnerability, it deploys a payload, compromises the runner, harvests credentials from process memory, exchanges those credentials for cloud access, exposes private repositories, and maps the blast radius of the attack."
https://www.helpnetsecurity.com/2026/04/20/smokedmeat-ci-cd-pipeline-attacks/
https://github.com/boostsecurityio/smokedmeat

Vulnerabilities

SGLang Is Vulnerable To Remote Code Execution When Rendering Chat Templates From a Model File
"A remote code execution vulnerability has been discovered in the SGLang project, specifically in the reranking endpoint (/v1/rerank). A CVE has been assigned to track the vulnerability; CVE-2026-5760. An attacker can create a malicious model for SGLang to achieve RCE. Successful exploitation could allow arbitrary code execution in the context of the SGLang service, potentially leading to host compromise, lateral movement, data exfiltration, or denial-of-service (DoS) attacks. No response was obtained from the project maintainers during coordination."
https://kb.cert.org/vuls/id/915947
https://thehackernews.com/2026/04/sglang-cve-2026-5760-cvss-98-enables.html
CISA Adds Eight Known Exploited Vulnerabilities To Catalog
"CISA has added eight new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
CVE-2023-27351 PaperCut NG/MF Improper Authentication Vulnerability
CVE-2024-27199 JetBrains TeamCity Relative Path Traversal Vulnerability
CVE-2025-2749 Kentico Xperience Path Traversal Vulnerability
CVE-2025-32975 Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability
CVE-2025-48700 Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
CVE-2026-20122 Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability
CVE-2026-20128 Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability
CVE-2026-20133 Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability"
https://www.cisa.gov/news-events/alerts/2026/04/20/cisa-adds-eight-known-exploited-vulnerabilities-catalog
Prompt Injection Leads To RCE And Sandbox Escape In Antigravity
"Pillar Security researchers have uncovered a vulnerability in Antigravity, Google's agentic IDE. This technique exploits insufficient input sanitization of the find_by_name tool's Pattern parameter, allowing attackers to inject command-line flags into the underlying fd utility, converting a file search operation into arbitrary code execution. Critically, this vulnerability bypasses Antigravity's Secure Mode, the product's most restrictive security configuration. Secure Mode is designed to restrict network access, prevent out-of-workspace writes, and ensure all command operations run strictly under a sandbox context. None of these controls prevent exploitation, because the find_by_name tool call fires before any of these restrictions are evaluated. The agent treats it as a native tool invocation, not a shell command, so it never reaches the security boundary that Secure Mode enforces."
https://www.pillar.security/blog/prompt-injection-leads-to-rce-and-sandbox-escape-in-antigravity
https://cyberscoop.com/google-antigravity-pillar-security-agent-sandbox-escape-remote-code-execution/
KLCERT-25-012: Qualcomm Chipset Series. Write-What-Where Condition Vulnerability In BootROM
"A CWE-123: Write-what-where Condition vulnerability exists in Qualcomm MDM9x07, MDM9x45, MDM9x65, MSM8909, MSM8916, MSM8952, and SDX50 chipset series that could allow an attacker with physical access to the target system to bypass the secure boot chain and execute arbitrary code on the targeted system with maximum privileges."
https://ics-cert.kaspersky.com/vulnerabilities/qualcomm-chipsets-series-write-what-where-condition-vulnerability-in-bootrom/
Fabricked: Misconfiguring Infinity Fabric To Break AMD SEV-SNP
"Confidential computing allows cloud tenants to offload sensitive computations and data to remote resources without needing to trust the cloud service provider. Hardware-based trusted execution environments, like AMD SEV-SNP, achieve this by creating Confidential Virtual Machines (CVMs). With Fabricked, we present a novel software-based attack that manipulates memory routing to compromise AMD SEV-SNP. By redirecting memory transactions, a malicious hypervisor can deceive the secure co-processor (PSP) into improperly initializing SEV-SNP. This enables the attacker to perform arbitrary read and write access within the CVM address space, thus breaking SEV-SNP core security guarantees."
https://fabricked-attack.github.io/

Malware

Supply Chain Compromise Impacts Axios Node Package Manager
"The Cybersecurity and Infrastructure Security Agency (CISA) is releasing this alert to provide guidance in response to the software supply chain compromise of the Axios node package manager (npm).1 Axios is an HTTP client for JavaScript that developers commonly use in Node.js and browser environments. On March 31, 2026, two npm packages for versions [email protected] and [email protected] of Axios npm injected the malicious dependency [email protected] that downloads multi-stage payloads from cyber threat actor infrastructure, including a remote access trojan.2"
https://www.cisa.gov/news-events/alerts/2026/04/20/supply-chain-compromise-impacts-axios-node-package-manager
FakeWallet Crypto Stealer Spreading Through iOS Apps In The App Store
"In March 2026, we uncovered more than twenty phishing apps in the Apple App Store masquerading as popular crypto wallets. Once launched, these apps redirect users to browser pages designed to look similar to the App Store and distributing trojanized versions of legitimate wallets. The infected apps are specifically engineered to hijack recovery phrases and private keys. Metadata from the malware suggests this campaign has been flying under the radar since at least the fall of 2025. We’ve seen this happen before. Back in 2022, ESET researchers spotted compromised crypto wallets distributed through phishing sites. By abusing iOS provisioning profiles to install malware, attackers were able to steal recovery phrases from major hot wallets like Metamask, Coinbase, Trust Wallet, TokenPocket, Bitpie, imToken, and OneKey."
https://securelist.com/fakewallet-cryptostealer-ios-app-store/119474/
https://www.bleepingcomputer.com/news/security/chinas-apple-app-store-infiltrated-by-crypto-stealing-wallet-apps/
Cross‑tenant Helpdesk Impersonation To Data Exfiltration: A Human-Operated Intrusion Playbook
"Threat actors are initiating cross-tenant Microsoft Teams communications while impersonating IT or helpdesk personnel to socially engineer users into granting remote desktop access. After access is established through Quick Assist or similar remote support tools, attackers often execute trusted vendor-signed applications alongside attacker-supplied modules to enable malicious code execution. This access pathway might be used to perform credential-backed lateral movement using native administrative protocols such as Windows Remote Management (WinRM), allowing threat actors to pivot toward high-value assets including domain controllers."
https://www.microsoft.com/en-us/security/blog/2026/04/18/crosstenant-helpdesk-impersonation-data-exfiltration-human-operated-intrusion-playbook/
https://www.bleepingcomputer.com/news/security/microsoft-teams-increasingly-abused-in-helpdesk-impersonation-attacks/
The Gentlemen: A New Ransomware Threat Climbing The Charts — Fast
"Most ransomware groups that emerge with fanfare are gone within months. The Gentlemen are not following that script. Since surfacing in mid-2025, the group has grown at a pace that rivals the early years of LockBit 3, a program widely considered the gold standard of ransomware operations. By April 2026, The Gentlemen have publicly listed over 320 victims on their data leak site, with 240 of those occurring in the first months of 2026 alone. That figure only reflects organizations that refused to pay; the actual number of victims is almost certainly higher. Check Point Research (CPR) has been tracking this group since its emergence, and their latest analysis, including findings from an active incident response engagement and access to a live attacker-controlled server, reveals why this operation is scaling so quickly, and what it means for enterprise security teams."
https://blog.checkpoint.com/research/the-gentlemen-a-new-ransomware-threat-climbing-the-charts-fast/
https://research.checkpoint.com/2026/dfir-report-the-gentlemen/
https://www.bleepingcomputer.com/news/security/the-gentlemen-ransomware-now-uses-systembc-for-bot-powered-attacks/
StealTok: 130k Users Compromised By Data Stealing TikTok Video “Downloaders”
"LayerX security researchers have uncovered a campaign of at least 12 interrelated browser extensions that masquerade as TikTok video downloaders but in reality track user activity and collect data. The extensions share a common codebase and are all clones or lightly modified versions of each other, indicating that this is a long-standing and persistent campaign by the same threat actors. The extensions also implement a mechanism for dynamic remote configuration, which allows them to bypass marketplace review processes. This enables the malicious extensions to modify their behavior and functionality after installation, without users or marketplaces being aware. According to LayerX research, the extensions typically operate legitimately for 6–12 months before introducing malicious features."
https://layerxsecurity.com/blog/stealtok-130k-users-compromised-by-data-stealing-tiktok-video-downloaders/
https://hackread.com/fake-tiktok-downloaders-chrome-edge-spy-users/
Bluesky Disrupted By Sophisticated DDoS Attack
"Bluesky, the decentralized microblogging social media platform, reported service outages last week due to a distributed denial-of-service (DDoS) attack aimed at its systems. The DDoS attack appears to have started late on April 15 (Pacific Time) and continued into the next day. The company described it as a sophisticated attack that caused intermittent app outages. “The attack is impacting our application, with users experiencing intermittent interruptions in service for their feeds, notifications, threads and search,” Bluesky said. “We have not seen any evidence of unauthorized access to private user data,” it added."
https://www.securityweek.com/bluesky-disrupted-by-sophisticated-ddos-attack/
https://therecord.media/bluesky-blames-app-outage-on-ddos
Formbook Malware Campaign Uses Multiple Obfuscation Techniques To Avoid Detection
"Two phishing campaigns, each using a different stealthy infection technique, are targeting organizations in attacks which aim to deliver data stealing malware to devices running on Microsoft Windows. The goal of the campaigns is to install Formbook, a notorious form of infostealer which has been available as part of malware-as-a-service schemes since 2016. The infostealer malware is designed to gather sensitive information including login credentials, browser data and screenshots. It is also equipped with advanced evasion techniques to avoid detection."
https://www.infosecurity-magazine.com/news/formbook-malware-multiple/

Breaches/Hacks/Leaks

KelpDAO Suffers $290 Million Heist Tied To Lazarus Hackers
"State-sponsored North Korean hackers are likely behind the $290 million crypto-heist that impacted the KelpDAO DeFi project on Saturday. The attack reportedly also impacted the lending protocols Compound, Euler, and Aave, with the latter announcing a freeze and blocking new deposits or borrowing using rsETH as collateral. KelpDAO is a decentralized finance (DeFi) project built around liquid restaking on the Ethereum network. It accepts user ETH deposits, restakes them, and returns a liquid token named ‘rsETH,’ that represents the restaked position."
https://www.bleepingcomputer.com/news/security/kelpdao-suffers-290-million-heist-tied-to-lazarus-hackers/
https://therecord.media/crypto-north-korea-theft-kelp
Seiko USA Website Defaced As Hacker Claims Customer Data Theft
"The Seiko USA website was defaced over the weekend, displaying a message from attackers claiming they stole its Shopify customer database and threatening to leak it unless a ransom is paid. Visitors to the "Press Lounge" section of the site were shown a page titled "HACKED," which replaced normal content with what appeared to be a ransom demand and data breach notification. The message warned that attackers had gained access to the company's Shopify backend and exfiltrated sensitive customer information."
https://www.bleepingcomputer.com/news/security/seiko-usa-website-defaced-as-hacker-claims-customer-data-theft/
WhatsApp Leaks User Metadata To Attackers
"Tal Be'ery knew that I was online the night before I called him. He knew what kind of device I was using. I didn't share this information with him. All he had was my phone number. I had no way to know that he was learning that information about me, either. Be’ery, cofounder and chief technology officer (CTO) of Zengo — whose $70 million acquisition by eToro was announced during our call — silently pried into my online habits (with my permission) using a jerry-rigged program he designed to plug into WhatsApp, and exploit the thin layer of metadata it leaks. In a presentation at Black Hat Asia 2026, he'll show that anyone can perform the same tricks, be they sophisticated nation-state advanced persistent threats (APTs) or lowly scammers. It doesn't require any kind of sophisticated zero-day; all one has to do is leverage WhatsApp's own design choices."
https://www.darkreading.com/endpoint-security/whatsapp-leaks-user-metadata
Cyberattack At French Identity Document Agency May Have Exposed Personal Data
"A cyberattack targeting a French government website used to manage identity documents and driver’s licenses may have exposed users’ personal data, the Interior Ministry said on Monday. The incident affected the website of the National Agency for Secure Documents (ANTS), a government service responsible for processing applications for passports, national identity cards, residence permits and driver’s licenses. In a statement, the Interior Ministry said a “security incident that may involve the disclosure of data from both individual and professional accounts” was detected on April 15."
https://therecord.media/france-cyberattack-agency-passports
https://securityaffairs.com/191069/data-breach/frances-ants-id-system-website-hit-by-cyberattack-possible-data-breach.html
Vibe Coding Upstart Lovable Denies Data Leak, Cites 'intentional Behavior,' Then Throws HackerOne Under The Bus
"Vibe-coding platform Lovable is pooh-poohing a researcher’s finding that anyone could open a free account on the service and read other users' sensitive info, including credentials, chat history, and source code. However, the company’s story keeps changing: First it attributed the publicly exposed info to "intentional behavior" and "unclear documentation," then threw bug-bounty service HackerOne under the bus. The drama appears to be the latest example of an AI firm, in this case a startup that claims a $6.6 billion valuation, shirking responsibility for security flaws in its products. Companies including Uber, Zendesk, and Deutsche Telekom all use Lovable's vibe coding AI tool, according to its latest funding announcement."
https://www.theregister.com/2026/04/20/lovable_denies_data_leak/

General News

Why The Axios Attack Proves AI Is Mandatory For Supply Chain Security
"Two weeks ago, a suspected North Korean threat actor slipped malicious code into a package within Axios, a widely used JavaScript library. The immediate concern was the blast radius: roughly 100 million weekly downloads spanning enterprises, startups, and government systems. But beyond the sheer scale, the attack’s speed was just as worrisome – a stark reminder of the tempo modern adversaries now operate at. The Axios compromise was identified within minutes of publication by an Elastic researcher using an AI-powered monitoring tool that analyzed package registry changes in real time. The approach was right: AI classifying code changes at machine speed, at the moment of publication, before the damage compounds. By any standard, it was a fast response. The compromised package was removed in about three hours. But even in those three hours, the widely-used package may have been downloaded over half a million times."
https://cyberscoop.com/ai-powered-security-operations-axios-supply-chain-attack/
Network ‘background Noise’ May Predict The Next Big Edge-Device Vulnerability
"Attackers rarely exploit an edge-device vulnerability indiscriminately. Typically, they first test how widely the flaw can be used and how much access it can provide, then move on to steal data or disrupt operations. Pre-attack surveillance and planning leaves a lot of noise in its wake. These signals — particularly spikes in traffic that are hitting specific vendors — can act as an early-warning system, often preceding public vulnerability disclosures, according to research GreyNoise shared exclusively with CyberScoop prior to its release. Roughly half of every activity surge GreyNoise detected during a 103-day study last winter was followed by a vulnerability disclosure from the same targeted vendor within three weeks, GreyNoise said in its report."
https://cyberscoop.com/greynoise-traffic-surge-early-warning-system-network-edge-device-vulnerabilities/
https://www.greynoise.io/resources/ten-days-before-zero
Threat Landscape March 2026: Ransomware Dominance, Access Brokers, Data Leaks, And Critical Exploitation Trends
"Cyble Research & Intelligence Labs (CRIL) in its monthly threat landscape analysis observed a highly active threat environment throughout March 2026, shaped by large-scale ransomware campaigns, persistent data breach activity, growing initial access brokerage markets, and exploitation of critical vulnerabilities affecting widely deployed enterprise systems. Threat actors continued to prioritize financial extortion, credential access, and operational disruption, while increasingly targeting sectors rich in sensitive data or dependent on business continuity."
https://cyble.com/blog/monthly-threat-landscape-march-2026/
FTP Exposure Brief: Examining The 55-Year-Old Protocol Used By Millions
"It’s the 1990s. You probably use FTP to push website files. Your users use it to grab new software releases. You run wu-ftpd or ProFTPD and think mostly about disk quotas, not encryption. AUTH TLS doesn’t exist yet (RFC 2228 wouldn’t arrive until 1997), and the concept of sending credentials or files in cleartext doesn’t matter so much since the Internet is smaller and less adversarial. FTP was designed for a world where every node on a network was probably going to be a university server or a government computer that you more or less trusted automatically."
https://censys.com/blog/ftp-exposure-brief/
https://www.securityweek.com/half-of-the-6-million-internet-facing-ftp-servers-lack-encryption/
What The Ransom Note Won't Say
"In March 2024, an affiliate of the BlackCat ransomware gang took to a cybercrime forum with a complaint. They’d carried out the attack on Change Healthcare – one of the largest healthcare data breaches in U.S. history – but never got their cut of the $22 million ransom payment. BlackCat’s operators had taken the money and vanished, putting up a fake FBI seizure notice on their leak site to cover the exit. The grievance almost feels like a contractor dispute. Strip away the criminal element along with the apparent double-cross, and what’s left is (hints of) something any company executive might recognize: business arrangements complete with supply chains, pricing, competition, and customers who expect their money’s worth. Today’s ransomware runs on this very logic."
https://www.welivesecurity.com/en/ransomware/what-ransom-note-doesnt-say/

อ้างอิง
Electronic Transactions Development Agency (ETDA)