CYBER_THREATCAST
$ briefing --date=
CYBER THREATCAST
CYBER THREAT INTELLIGENCE BRIEFING
Head Mare is actively exploiting CVE-2026-72529 and CVE-2026-72530 in TrueConf Server, gaining system-level execution and turning compromised servers into delivery points for PhantomCore. Attackers are also extracting cloud credentials from exposed MLflow servers, while Operation CameraSwarm reportedly compromised more than 14,530 Dahua cameras in Ukraine and Russia.
The TrueConf attack reaches beyond the server: compromised systems can distribute a trojanized Windows installer to meeting participants. CISA added both flaws to its Known Exploited Vulnerabilities catalog and ordered federal civilian agencies to patch by September 3.
North Korean operators linked to Contagious Interview used the malicious npm packages chalk-ultra and vitest-cli to steal source code, credentials, private keys and wallet seed phrases. Lazarus has also paired AI-generated recruitment content with Chrome zero-day abuse and the roughly $1.5 billion Bybit theft.
Editorial: Recommended Actions
01
PRIORITY
Patch TrueConf Server against CVE-2026-72529 and CVE-2026-72530 immediately, then investigate servers and meeting participants for compromise. Head Mare actively chains both KEV-listed flaws for system-level execution, and compromised servers can distribute PhantomCore through a trojanized TrueConf Windows installer.
02
PRIORITY
Apply MLflow’s fix and remove MLflow servers from unnecessary internet exposure; investigate exposed installations and replace potentially extracted cloud credentials. Attackers are actively exploiting the unauthenticated SSRF flaw, while widespread scanning and cloud credential-extraction attempts are already underway.
03
PRIORITY
Upgrade Zimbra Collaboration Suite and investigate vulnerable servers for compromise, prioritizing deployments with affected zimbra-snmp configurations. CVE-2026-73570 is actively exploited and permits unauthenticated operating-system command execution through crafted SMTP requests; mitigate or discontinue affected deployments if mitigation is unavailable.
04
PRIORITY
Audit developer systems and dependency records for chalk-ultra and vitest-cli, isolate affected environments, and replace exposed credentials, private keys, and wallet seed phrases. North Korean actors linked to Contagious Interview used these malicious npm packages to steal source code, environment files, browser credentials, keys, and cryptocurrency secrets.
05
PRIORITY
Update Coldcard Mk4 and Mk5 devices to firmware 5.6.1 and Coldcard Q devices to 1.5.1Q, then migrate funds from every previously generated seed. The emergency firmware strengthens entropy and RNG validation, but it does not protect existing weak seeds, which reportedly enabled the theft of 1,778 BTC.
ROUNDTABLE
Expert Panel Discussion
12 AI experts analyzed this briefing across 3 turns of structured debate
12Agents18Messages33mDuration
→
Field Signals
Real-time intelligence from X/Twitter
$ scanning feeds_