Critical Privilege Escalation Flaw Discovered in OpenVPN Connect for macOS A critical vulnerability (CVE-2026-9560) has been identified in OpenVPN Connect for macOS, allowing local attackers to execute arbitrary commands with root privileges. The flaw, rated 9.4 (Critical) on the CVSS 4.0 scale, affects versions 3.5.1 through 3.8.1 and stems from an OS command injection weakness (CWE-78) in the application’s privileged helper component. The vulnerability enables threat actors with local system access to exploit an Inter-Process Communication (IPC) channel, injecting malicious commands into OpenVPN’s background service without user interaction. Security researchers Ismael Esquilichi, Pablo Redondo, and Lê Đức Ninh were credited with the responsible disclosure. As of now, no public proof-of-concept exploits or active attacks have been reported. OpenVPN addressed the flaw in a recent update, alongside two additional fixes: a browser authentication failure triggered by malformed server URLs and a UI bug causing crashes during blank profile imports. Organizations using affected versions are advised to update immediately to mitigate potential lateral movement risks, particularly in shared macOS environments. Unpatched systems should be treated as high-risk endpoints.

GenieLocker: Toy Ghouls’ Cross-Platform Ransomware Targets Manufacturing and Virtualized Environments A newly discovered ransomware strain, GenieLocker, has emerged as a sophisticated cross-platform threat, enabling attacks on Windows, Linux, and VMware ESXi systems. Developed by the Toy Ghouls threat group, this malware marks a shift from their previous reliance on commodity ransomware like LockBit and Babuk, signaling a move toward custom-built capabilities. First detected in March 2026, GenieLocker has primarily targeted manufacturing organizations, though infections have also been observed in the construction and financial sectors, with a concentration in Russia. Unlike many ransomware families, Toy Ghouls appears to focus solely on encryption-based extortion, with no evidence of data exfiltration or double-extortion tactics. ### Infection Chain and Tactics Initial access was achieved through compromised OpenVPN connections linked to trusted third-party partners, leveraging stolen credentials to infiltrate networks. Once inside, attackers deployed a suite of post-exploitation tools, including: - OpenSSH, SoftPerfect Network Scanner, and Mimikatz for reconnaissance and credential harvesting. - KeePassXC password vaults as a target for credential extraction. - RDP (Windows) and SSH (Linux) for lateral movement. - PsExec and PAExec for payload deployment, with reverse SSH tunnels maintaining command-and-control communications. ### Technical Capabilities GenieLocker employs advanced cryptographic mechanisms, using the libsodium library with XChaCha20-Poly1305 (AEAD cipher) for file encryption and Curve25519-based public key cryptography to secure per-file keys. Key features include: - Partial file encryption, allowing attackers to specify the percentage of data encrypted an optimization for large datasets. - Cross-platform disruption: - On Windows, it terminates processes and services (e.g., databases, backup agents, VM components) to facilitate encryption. - On ESXi servers, it halts running virtual machines before encrypting their disks, crippling virtualized infrastructure. - Anti-analysis protections (Windows variant only): - A hardcoded "secret argument" required for execution. - Anti-debugging checks via Windows API functions. - CRC32 hashing for code integrity verification, hindering reverse engineering. - Stealth tactics: No ransom notes are dropped; negotiation details are delivered manually during the intrusion to evade behavioral detection. The Linux and ESXi variants are streamlined but include daemonization and ESXi system message modifications, ensuring consistency in encryption logic across platforms. ### Detection and Implications Security vendors currently detect GenieLocker under signatures such as Trojan-Ransom.Win64.Agent.genie and Trojan-Ransom.Linux.Agent.genie. Its emergence reflects a broader trend of threat actors developing bespoke, cross-platform ransomware to maximize impact while reducing dependence on public malware frameworks. The shift toward custom tooling and third-party access exploitation underscores the evolving sophistication of ransomware operations.

A critical buffer overflow vulnerability in OpenVPN’s data channel offload driver for Windows allowed local attackers to crash systems by sending maliciously crafted control messages. The vulnerability, identified as CVE-2025-50054, affects versions 1.3.0 and earlier, as well as version 2.5.8 and earlier. This denial-of-service risk could repeatedly crash Windows machines running vulnerable OpenVPN installations, impacting system availability without compromising data confidentiality or integrity. OpenVPN 2.7_alpha2 fixes the issue and improves Windows support, but users should update promptly and restrict driver access until stable patches are available.