Palo Alto Networks PAN-OS Authentication Bypass Vulnerability Exploited in the Wild On May 29, 2026, CISA added CVE-2026-0257, a critical authentication bypass vulnerability in Palo Alto Networks’ PAN-OS and Prisma Access, to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. The flaw resides in the "authentication override" feature a non-default setting in GlobalProtect portals and gateways that issues session cookies to authenticated users, eliminating the need for repeated logins. The vulnerability is triggered when the same certificate used to encrypt and decrypt these cookies is also employed by another feature, such as the HTTPS service of the portal or gateway. Exploitation of this misconfiguration allows attackers to bypass authentication controls, potentially gaining unauthorized access to affected systems. The issue underscores the risks of improperly configured security features, even in enterprise-grade solutions. Organizations using PAN-OS or Prisma Access with the authentication override feature enabled are urged to review their deployments for shared certificate usage.

AI-Driven Cyber Attacks Accelerate Exploitation, Shrinking Defense Windows – Rapid7 Q1 2026 Report Rapid7’s Q1 2026 Threat Landscape Report reveals a sharp rise in AI-powered cyber attacks, with vulnerability exploitation now the dominant initial access vector accounting for 38% of managed detection and response (MDR) incident cases in the first quarter. This marks a shift from traditional attack methods, as threat actors increasingly bypass human targets to directly exploit internet-facing infrastructure. Key findings include: - Zero-click vulnerabilities made up half of actively exploited flaws in Q1, requiring no authentication or user interaction to compromise exposed networks. - The median time between public disclosure of high/critical-severity vulnerabilities and their inclusion in CISA’s Known Exploited Vulnerabilities (KEV) catalog dropped from 8.5 days to just five days, reflecting faster attacker adoption. - SQL injection surpassed OS command injection as the most exploited vulnerability category, targeting widely deployed web applications. - Ransomware activity remained fragmented, with Qilin leading leak-site posts (357), followed by The Gentlemen (206) and Akira (174). - Remote monitoring and management (RMM) tools were the most abused technique (22.9% of observed malicious activity), ahead of ClickFix (18.8%) and Windows native scripts (10.4%). Rapid7’s senior vice president and chief scientist, Raj Samani, noted that AI is "rewriting the security equation," as attackers prioritize direct access to exposed systems, reducing defenders' response windows. Vice president of cyber intelligence Christiaan Beek added that the speed of modern attacks leaves security teams struggling to investigate every threat, allowing risk to accumulate. The report also highlighted that exploited vulnerabilities averaged 1.8 million online mentions (blogs, forums, social media) before active exploitation, underscoring the rapid weaponization of public disclosures.

Iranian APT MuddyWater Deploys Chaos Ransomware as False Flag in Espionage Campaign In early 2026, cybersecurity firm Rapid7 uncovered a sophisticated hybrid espionage campaign orchestrated by the Iranian Advanced Persistent Threat (APT) group MuddyWater (also known as Mango Sandstorm, Seedworm, or Static Kitten), affiliated with Iran’s Ministry of Intelligence and Security (MOIS). Initially appearing as a Chaos ransomware attack a financially motivated operation the intrusion was later revealed to be a false flag designed to mask state-sponsored intelligence-gathering efforts. ### Attack Vector & Tactics The campaign began with unsolicited Microsoft Teams messages sent to employees, often impersonating IT support. Attackers engaged victims in interactive screen-sharing sessions, instructing them to: - Enter credentials into locally created files (credentials.txt, cred.txt). - Add attacker-controlled devices to their MFA configurations. - Execute discovery commands (ipconfig /all, whoami, net start). This technique exploited Teams’ trusted environment, bypassing traditional security controls a tactic observed in multiple 2026 campaigns, including a large-scale credential theft operation documented by Microsoft Defender Research in March. ### Post-Compromise Activity After harvesting credentials, the threat actor: - Authenticated to Domain Controllers using stolen accounts. - Deployed DWAgent and AnyDesk for persistent remote access. - Delivered a custom downloader (ms_upd.exe) from a command-and-control (C2) server (172.86.126[.]208:443), which registered victims with the domain moonzonet[.]com. - Installed Game.exe, a Remote Access Trojan (RAT) disguised as a legitimate Microsoft WebView2 application, enabling: - Arbitrary command execution (via cmd.exe or encoded PowerShell). - Chunked file uploads and interactive shell access. - Sandbox and virtual machine detection. - AES-256-GCM encrypted configuration storage (though critical strings remained in plaintext). ### False Flag & Attribution The use of Chaos ransomware a RaaS known for double-extortion tactics was a deliberate misdirection. MuddyWater’s true objective was data exfiltration and long-term persistence, not financial gain. Key attribution evidence included: - A code-signing certificate (Donald Gay, thumbprint B674578D4BDB24CD58BF2DC884EAA658B7AA250C) previously linked to MuddyWater’s Operation Olalampo (2026). - The C2 domain moonzonet[.]com, tied to prior MuddyWater activity targeting U.S. and MENA organizations. - Python-based process injection (pythonw.exe), a hallmark of the group’s toolkit. - Teams-based MFA harvesting, consistent with MuddyWater’s 2026 social engineering patterns. ### Impact & Targets The campaign primarily targeted Western organizations, including those in the U.S. and MENA region. By framing the attack as ransomware, MuddyWater diverted attention from its espionage objectives, allowing persistent access via DWAgent, AnyDesk, and the Game.exe RAT. Chaos ransomware, which emerged in 2025 as a successor to BlackSuit, has claimed 36 victims as of March 2026, predominantly in construction, manufacturing, and business services. MuddyWater’s adoption of this brand aligns with its 2025 use of Qilin RaaS in a similar false-flag operation. ### Key Indicators of Compromise (IOCs) - Initial access: Unsolicited Teams chats with screen-sharing requests. - Credential theft: credentials.txt or cred.txt files in user directories. - Persistence: Dual deployment of DWAgent + AnyDesk alongside RDP lateral movement. - C2 infrastructure: moonzonet[.]com, uploadfiler[.]com, adm-pulse[.]com.