CYBER_THREATCAST
$ briefing --date=
CYBER THREATCAST
CYBER THREAT INTELLIGENCE BRIEFING
Medusa ransomware has breached more than 500 U.S. critical-infrastructure organizations since June 2021, according to a U.S. government warning. Meanwhile, active exploitation of TrueConf Server, MLflow and Ray vulnerabilities is creating immediate patching pressure, and a third-party software flaw may have exposed SickKids employee and applicant data.
Medusa affiliates reportedly exploit newly disclosed vulnerabilities within 24 hours—and sometimes before disclosure—then publish stolen data to pressure victims. The warning identifies CVE-2025-10035 and CVE-2026-1731 among exploited critical flaws, underscoring how quickly vulnerability exposure can become an extortion event.
CISA gave agencies until September 3 to patch two TrueConf Server flaws used by Head Mare to distribute backdoored Windows installers, and set a September 2 deadline for an MLflow SSRF flaw targeted in cloud credential-extraction attempts. CVE-2025-62593 in Ray is also under active botnet exploitation, while the SickKids incident reinforces the need to scrutinize internet-facing third-party applications.
Editorial: Recommended Actions
01
PRIORITY
Upgrade TrueConf Server immediately to a fixed release—5.3.9, 5.4.9, or 5.5.5—and investigate servers and distributed Windows clients for compromise. Head Mare is actively exploiting two CISA KEV-listed flaws and has used compromised servers to distribute trojanized Windows installers carrying PhantomCore.
02
PRIORITY
Patch exposed MLflow servers with the available fix and investigate them for cloud-metadata queries and credential-extraction attempts. Attackers are actively exploiting an unauthenticated SSRF flaw, CISA has added it to KEV, and WatchTowr observed widespread scanning.
03
PRIORITY
Remediate CVE-2025-62593 in Ray-Project Ray deployments and check affected systems for botnet activity. CISA lists the flaw in KEV, and a Mirai-inspired botnet is reportedly exploiting it in the wild.
04
PRIORITY
Upgrade qualifying Zimbra Collaboration Suite installations to 10.1.20 or later and investigate vulnerable servers for compromise; discontinue deployments that cannot be mitigated. Attackers are exploiting CVE-2026-73570 to execute operating-system commands as the zimbra user through crafted SMTP requests under specific SNMP configurations.
05
PRIORITY
Install Coldcard firmware 5.6.1 or 1.5.1Q, generate an entirely new seed, and migrate funds from wallets created with affected seeds. Upgrading alone does not protect existing seeds; weak generation reportedly reduced key strength to 40 bits and was linked to theft of 1,778 BTC.
ROUNDTABLE
Expert Panel Discussion
12 AI experts analyzed this briefing across 3 turns of structured debate
12Agents15Messages25mDuration
→
Field Signals
Real-time intelligence from X/Twitter
$ scanning feeds_