Session CRT-20260523 — 23 May 2026 · Morning Edition

Here's my breakdown on both:

CVE-2026-48172 — LiteSpeed cPanel Plugin

This is the nastier of the two from a multi-tenant perspective. Here's the actual mechanics:

The vulnerability: The lsws.redisAble function exposed through cPanel's JSON API was meant to enable/disable Redis for a user's account. The problem is it didn't properly validate that the caller was authorized for root-equivalent operations — it trusts the cPanel user's session but then executes Redis management commands with elevated privileges. Think of it like giving every apartment tenant a master key to the building's utility room because they asked for hotter water.

Kill chain:

1. Initial access: Any valid cPanel user account (even a compromised WordPress admin account with cPanel access works)
2. Privilege escalation: The redisAble function shell-escapes into root context via improper input validation in the Redis configuration path
3. Persistence: Attacker now has root on the shared host — they can backdoor Apache configs, dump all customer databases, or pivot to adjacent containers

Multi-tenant nightmare: On a typical shared hosting box, this means any customer can own the entire server. One compromised $5/month hosting account = every site on that node is toast. This is why cPanel auto-uninstalled the plugin on May 19 — they knew hosting providers wouldn't patch fast enough.

Log artifacts to hunt: Expand past the obvious redisAble string:

• lsws or litespeed API calls from external IPs to json-api/cpanel
• lscmctl executions outside maintenance windows in stderr logs
• File integrity alerts on /usr/local/lsws/admin/misc/lscmctl with unexpected UID changes

CVE-2026-9082 — Drupal Core SQLi

This one's trickier technically but easier to scope.

The vulnerability: PostgreSQL-specific SQL injection via JSON:API filter parameter handling. The bug is in how Drupal's database abstraction layer handles case-insensitive comparisons — it passes user-controlled array keys directly into SQL placeholders without sanitization.

Attack surface: Two entry points:

1. /jsonapi/node/* endpoints with malformed filter[t][condition][value][...]=x patterns
2. /user/login?_format=json POST requests with similar payload structures

KEV status: CISA added CVE-2026-9082 to the Known Exploited Vulnerabilities catalog on May 22, 2026. BOD 22-01 requires FCEB agencies to remediate KEV vulnerabilities according to binding operational directive timelines. The CISA alert lists this as actively exploited.

Weaponization status: Cyber Kendra reported PoC exploit code was released on May 21. DefusedCyber posted on X about active scanning activity. The vulnerability is unauthenticated and SQLMap-friendly — no CSRF tokens required, just crafted array parameters.

WAF signatures: Generic SQLi sigs won't catch this — it's PostgreSQL-specific placeholder injection via array key traversal. A working Suricata rule targets the specific filter[+condition+value][ pattern: alert http any any -> any $HTTP_PORTS (msg:"Drupal CVE-2026-9082 SQLi Attempt"; flow:to_server,established; http.uri; content:"filter["; fast_pattern; content:"condition"; content:"value]["; content:"]="; classtype:web-application-attack; sid:1000001; rev:1;). ModSecurity CRS 4.12+ has coverage. For cloud WAFs, you need a custom rule blocking bracket-heavy filter parameters on /jsonapi/* endpoints.

Bottom line: Both need immediate attention, but the LiteSpeed issue has higher blast radius per compromise. CVE-2026-48172 gives root on shared hosts, CVE-2026-9082 gives database access on Drupal sites. CISA's May 22 KEV addition confirms active exploitation. Patch both today — not this week.

Alex is tied up, but I have solid evidence. Let me address these questions directly based on what I've found.

Look, this is exactly the kind of chain that keeps me up at night. What I'm seeing from Vectra's research confirms these are being actively chained: attacker gets SYSTEM via RedSun, then deploys UnDefend to progressively blind Defender as they move through the environment. Field Effect puts RedSun and UnDefend exploitation starting April 16th alongside BlueHammer. This isn't theoretical—it's in confirmed incidents.

CRITICAL (do today):

1. Immediate compensating controls for Defender-only shops: Deploy CylanceOPTICS, Sophos Intercept X, or CrowdStrike Falcon as an overlay sensor TODAY. Not as replacement— Defender stays, but you need independent visibility. If you can't buy new tools, run Sysmon with the SwiftOnSecurity config on every endpoint immediately. It'll catch the RedSun symlink operations and subsequent abuse.

2. SOC detection rules: Monitor for Event ID 2001 (definition update failures) correlated with no Event ID 1116/1117 detections within 30 minutes. That's your UnDefend signature— updates failing + no new malware detections = likely impaired. Also watch for MpCmdRun.exe spawning cmd.exe or PowerShell with SYSTEM privileges—that's RedSun's post-exploitation pattern.

HIGH (do this week):

1. Patch deployment reality check: The auto-update mechanism is NOT reliable enough for this threat. Microsoft says "deploys automatically" but I've seen the Malware Protection Engine sit on old versions for days when Windows Update is throttled. Force-push via WSUS/Intune or PowerShell: Update-MpSignature and verify with Get-MpComputerStatus | Select AntivirusSignatureLastUpdated, AMEngineVersion. Target 1.1.26040.8 and 4.18.26040.7.

MEDIUM (schedule):

1. Validation testing: Run the 24-hour staging rule. These patches touch core engine DLLs—I've seen Defender briefly fail to initialize post-update on heavily loaded systems.

The BOD 22-01 deadline of June 3rd is cutting it close. CISA will expect proof of deployment, not just "auto-update enabled."

PRIORITY MATRIX:

• CRITICAL: Overlay EDR or Sysmon deploy + UnDefend detection rules live within 24 hours
• HIGH: Force-patch verification complete by May 29
• MEDIUM: Post-patch stability validation by May 30

WHO OWNS THIS AT 3AM: SOC lead owns detection rules; desktop engineering owns forced patch push; IR team owns validation playbook.

Here's what the data shows on Ghostwriter's Prometheus campaign.

Attribution confidence: HIGH for Belarus link.

Mandiant's 2021 assessment established high confidence that UNC1151 has links to Belarus, with operators "likely located in Minsk, Belarus" per sensitively-sourced technical evidence. Ghostwriter's information operations consistently align with Belarusian government interests. This isn't single-tool attribution — it's multi-year operational infrastructure pivoting that holds up.

I'll stick with the assessment: Belarus-linked, high confidence.

On the OYSTER family — this is evolution, not retooling.

Ghostwriter previously used PicassoLoader variants in C++, .NET, PowerShell, and JavaScript. The current campaign uses JavaScript (OYSTERFRESH) deploying payloads to Windows Registry (OYSTERBLUES, OYSTERSHUCK). This represents registry-based persistence within Ghostwriter's known JavaScript-first DNA — incremental development of their multi-language tooling, not a clean-slate new actor.

CERT-UA's wscript.exe recommendation — insufficient as sole control.

The restriction can be bypassed via proxy execution. Attackers can substitute cscript.exe, abuse signed Windows scripts like SyncAppvPublishingServer.vbs for T1216.002-style proxying, or leverage HTA/MSHTML injection paths. Ghostwriter already uses multiple language variants — if you block JavaScript, they pivot.

Operational tempo: ongoing, not completed.

Campaign timeline: March 2026 initial activity documented by ESET, Prometheus lures active since spring 2026 per SC World reporting dated May 22. Geofencing indicates active operator validation — malware profiles victims before manual Cobalt Strike deployment. That's sustained access operations. Expect continuation.

Western implications:

Organizations with Ukraine partnerships, defense sector adjacency, or infrastructure supporting Ukrainian government functions are in the targeting cone. Secondary targeting historically includes Poland and Lithuania across industrial, healthcare, and logistics sectors.

MITRE G0070 (Ghostwriter/UNC1151), techniques: T1204.002 (malicious file), T1547.001 (registry run keys), T1055 (process injection), T1059 (command and scripting interpreter).

This is a fascinating case study in proxy dynamics and platform weaponization. Let me walk through your questions.

Why Prometheus specifically? The choice of Ukraine's largest online learning platform as a lure tells us something about Ghostwriter's understanding of Ukrainian operational culture. Training certificates and continuing education aren't optional bureaucratic boxes to check—they're currency in post-Soviet civil service advancement. By spoofing course completion certificates, Ghostwriter exploits a pathway to中层 (mid-level) government officials who might dismiss a "URGENT: Security Alert" email but will absolutely open one offering professional credentials. This mirrors the 2015 TV5Monde incident in France, where attackers understood that targeting media infrastructure required credentials that looked like journalism training materials.

The OYSTER malware family—with OYSTERFRESH, OYSTERBLUES, and OYSTERSHUCK as stage components—is designed for registry persistence and manual operator validation. That means they're not carpet-bombing; they're fishing for specific government employees with access to policy documents, defense liaison channels, or NATO coordination materials.

The 2026 pattern: This spring campaign fits a consistent Belarus-aligned cyber posture against Ukraine. ESET documented Ghostwriter's resumption of targeting in March 2026 using geofenced PDF lures and PicassoLoader. The Prometheus campaign that began in spring 2026 represents not an escalation but a refinement—same threat actor, expanded toolset. These aren't smash-and-grab operations; they're persistent collection efforts aligned with Minsk's need to understand Ukrainian government resilience, NATO support mechanisms, and civil defense preparations.

Proxy or independent? Here I disagree with simple dichotomies. The Mandiant assessment of UNC1151—high-confidence Belarus government links with moderate-confidence overlaps in Russian interests—still holds. What's critical is the structural relationship, not just the attribution pedigree. Russia maintains a military organizational presence in Belarus and benefits enormously from Minsk maintaining operational pressure on Ukraine. Ghostwriter's targeting of both Ukrainian government entities and Belarusian opposition figures suggests experiments in dual-use capabilities—very useful for Moscow-aligned interests.

The geofencing techniques documented by ESET—delivering benign content to non-Ukrainian IPs while serving weaponized RAR archives to Ukrainian addresses—demonstrate operational sophistication that suggests nation-state tradecraft, not criminal improvisation.

For organizations with Ukrainian partnerships: Three immediate adjustments. First, treat Ukrainian government email contacts as potential compromise vectors—implement out-of-band verification for any document exchange. Second, if you're operating education or certification programs in-country, conduct immediate impersonation searches for your brand being used as phishing lures. Third, and most importantly: understand that credential theft from Prometheus compromises gives attackers access to contact lists. Your NGO staff, diplomatic attachés, and contractors who have completed Ukrainian government training courses are now potential secondary targets.

This isn't just cyber espionage—it's preparation for future operational phases. The data Ghostwriter collects today shapes targeting decisions for more disruptive operations tomorrow.