CYBER_THREATCAST
$ briefing --date=
CYBER THREATCAST
CYBER THREAT INTELLIGENCE BRIEFING
P7 DarkSword is targeting iPhones running iOS 18.4 through 18.7 with a multi-stage exploit chain and a SpringBoard implant. Multiple actors have used it against targets in Saudi Arabia, Turkey, Malaysia and Ukraine, while Qilin and Settra are exploiting CVE-2026-0257 in Palo Alto Networks remote-access products.
Researchers found P7 DarkSword while investigating an infected device at a financial institution. Its SpringBoard implant steals sensitive data and supports remote commands; Apple released iOS 15.8.7, 16.7.15 and 18.7.7 to address affected older systems.
Qilin and Settra use CVE-2026-0257 to establish unauthorized VPN sessions that may resemble legitimate remote-work traffic before credential theft, lateral movement and ransomware deployment. The FBI also seized seven domains supporting alleged Flax Typhoon operations, while Midnight Mimosa remains embedded in Android firmware distributed across thousands of devices in more than 150 countries.
Editorial: Recommended Actions
01
PRIORITY
Install fixed PAN-OS releases for GlobalProtect and Prisma Access immediately, then review authentication-override cookie and certificate configurations and investigate unauthorized VPN sessions—even those resembling normal remote-work traffic. Qilin- and Settra-associated actors are actively exploiting CVE-2026-0257 for initial access, followed by credential theft, lateral movement, data collection, offensive tooling, and ransomware deployment.
02
PRIORITY
Update eligible iPhones to Apple’s corrected releases, including iOS 15.8.7, 16.7.15, or 18.7.7, and prioritize devices used by financial institutions or personnel in Saudi Arabia, Turkey, Malaysia, and Ukraine. Multiple actors have deployed P7 DarkSword against iOS 18.4–18.7 using a multi-stage exploit chain and SpringBoard implant capable of stealing sensitive data and accepting remote commands.
03
PRIORITY
Remove or downgrade affected MemTensor and MemoryOS packages, rebuild exposed systems, rotate credentials, block the reported command-and-control endpoint, and investigate connected packages and GitHub Actions workflows for propagation. Poisoned releases—including MemoryOS 2.0.34 and specified memos-cloud-openclaw-plugin versions—allegedly stole prompts and credentials through normal application paths and contained code for infecting additional packages and workflows.
04
PRIORITY
Upgrade affected NetScaler ADC and Gateway appliances to 14.1-73.46 or later or 13.1-64.29 or later, focusing on customer-managed and hybrid appliances configured for SAML. CVE-2026-107406 is a CVSS 9.5 memory-overflow flaw that could enable remote code execution, denial of service, or appliance takeover; active exploitation has not been observed, but the potential impact warrants prompt remediation.
05
PRIORITY
Upgrade self-hosted GitLab AI Gateway deployments supporting Duo Agent Platform to 19.2.4, 19.3.2, or 19.4.1. CVE-2026-90970 lets an authenticated user with Duo Agent Platform access submit a crafted workflow configuration that escapes prompt-template isolation and executes commands on the AI Gateway host; GitLab has not reported real-world exploitation.
Field Signals
Real-time intelligence from X/Twitter
$ scanning feeds_