CYBER_THREATCAST
$ briefing --date=
CYBER THREATCAST
CYBER THREAT INTELLIGENCE BRIEFING
DarkSword/Coruna operators are using watering holes to compromise iPhones and steal Keychain material, wallet data, photos and notes. Exposed infrastructure held 11 wallet recovery phrases, 179 device-loot directories and 75 control-plane accounts, and some infrastructure remained active. Attackers are also exploiting Atlassian Data Center and Citrix NetScaler vulnerabilities, gaining persistent privileged access and stealing data.
DarkSword/Coruna includes 18 modules targeting cryptocurrency applications and searching photos and Apple Notes for valid BIP39 recovery phrases. Apple has issued protective updates, including iOS 15.8.7, 16.7.15 and 18.7.7. The exposed operational records show that the platform was not merely theoretical: they contained victim data, wallet secrets and device loot.
CISA and international partners say China-based Integrity Technology Group supplies tools, hosting, VPN infrastructure and botnets to government-linked actors targeting critical infrastructure worldwide. Their guidance calls for patching listed known-exploited vulnerabilities and investigating suspicious edge-device activity. Separately, a jury convicted Jonathan Spalletta over the $53.3 million Uranium Finance exploit.
Editorial: Recommended Actions
01
PRIORITY
Investigate Citrix NetScaler ADC and Gateway appliances immediately for exploitation of CVE-2026-88771 and CVE-2026-88772, including reverse shells, web shells, persistent privileged access, and configuration theft. Organizations running NetScaler 13.1 or 14.1 should not rely solely on exact command-pattern detections: attackers are varying command syntax to evade them.
02
PRIORITY
Install Cisco’s hardening releases for Secure Firewall Management Center and investigate the specified log indicators for CVE-2026-20079 and CVE-2026-20131. Both flaws enable unauthenticated remote code execution as root; observed activity includes Interlock zero-day exploitation, web shells, command executors, reverse shells, and a Cyclops Blink variant.
03
PRIORITY
Upgrade exposed LiteLLM services to version 1.83.7 and examine affected Linux servers for XMRig or Iron miners. PoeLLM is actively exploiting CVE-2026-42271, and the campaign has reportedly compromised more than 3,400 servers.
04
PRIORITY
Block tensorlake npm version 0.5.144, identify every developer workstation, application server, and CI/CD runner that installed it, and rotate potentially exposed credentials. The malicious release executes Shai-Hulud through a preinstall hook and targets developer, cloud, GitHub, CI/CD, Vault, and cryptocurrency secrets while enabling further package poisoning.
05
PRIORITY
Update exposed iPhones to Apple’s protective releases, including iOS 15.8.7, 16.7.15, or 18.7.7 as applicable. DarkSword/Coruna operators are actively compromising devices through watering holes and can steal Keychain material, wallet data, photos, notes, application data, and files; cryptocurrency users face added risk because 18 modules target wallet applications and BIP39 recovery phrases.
ROUNDTABLE
Expert Panel Discussion
12 AI experts analyzed this briefing across 3 turns of structured debate
12Agents17Messages35mDuration
→
Field Signals
Real-time intelligence from X/Twitter
$ scanning feeds_