BlueHammer Ransomware, CitrixBleed, and More: Daily Security Brief

CitrixBleed Vulnerability Allows Memory Overread in NetScaler SAML Configuration

A pre-authentication memory overread vulnerability tracked as CVE-2026-8451 has been disclosed in Citrix NetScaler ADC and NetScaler Gateway. Discovered by watchTowr on 28 March 2026 and patched by Citrix on 30 June 2026, the flaw carries a CVSS score of 8.8 and requires the appliance to be configured as a SAML identity provider. Affected versions include NetScaler ADC and Gateway 14.1 before 14.1-72.61, 13.1 before 13.1-63.18, and corresponding FIPS and NDcPP builds. The vulnerability resides in the XML parser handling SAML AuthnRequest messages sent to the /saml/login endpoint. By crafting a malformed attribute — for example, using a newline instead of a space after AssertionConsumerServiceURL= — an attacker can cause the parser to overread adjacent memory. The leaked data is reflected in the NSC_TASS cookie in the HTTP response, allowing remote retrieval of binary data such as fill patterns and process pointers. The overread terminates when control characters like NULL or ’>’ are encountered. A specially crafted request can also crash the nsppe process. Organizations using Citrix NetScaler as a SAML IdP should apply the available patches immediately.

CitrixBleed To Infinity And Beyond (Citrix NetScaler Pre-Auth Memory Overread CVE-2026-8451) →

Gamaredon Uses WinRAR Path-Traversal Flaw for First Destructive Wiper Attack

The Russian state-aligned hacking group Gamaredon conducted its first confirmed destructive operation in November 2025, deploying the GamaWiper malware against a Ukrainian target using a newly weaponized WinRAR vulnerability. The flaw, CVE-2025-8088, is a high-severity path-traversal bug discovered by ESET researchers during active exploitation in July 2025 and patched in WinRAR version 7.13 on July 30, 2025. It abuses NTFS Alternate Data Streams to write a hidden payload into the Windows Startup folder while the victim sees only an innocuous decoy file. Gamaredon began exploiting the vulnerability from late September to drop HTA downloaders, and later used it in November for the destructive wiper attack. ESET’s full-year 2025 report, published June 25, 2026, documented 35 distinct spear-phishing campaigns, six new PowerShell-based tools (including PteroDee, PteroCache, and PteroPaste), and the revival of older tools like PteroSetup. The group increasingly hides its infrastructure behind mainstream services such as Telegram, Dropbox, Cloudflare tunnels, and GoFile, creating a defender dilemma as blocking these services outright is impractical. ESET recommends limiting PowerShell access for non-admin users, restricting scripting tools, tightening USB controls, and updating WinRAR to version 7.13 or later.

Russian Hackers Gamaredon Weaponize WinRAR Flaw for First Destructive Strike →

Mustang Panda Espionage Targets Indian Government via Zoho Cloud Storage

The China-aligned espionage group Mustang Panda ran two simultaneous hacking campaigns against the Indian government between June 12 and June 22, 2026, using Zoho WorkDrive as a dead drop for commands and stolen data. Acronis’s Threat Research Unit observed active beaconing from compromised systems, including devices of senior administrative personnel, and shared findings with CERT-In. One campaign targeted India’s hydropower sector; the other focused on cooperation agreements with Taiwanese institutions. The attacks used a newly discovered toolkit named SHARDLOADER, MINIRECON, and ZOHOMURK. SHARDLOADER is delivered via DLL sideloading through legitimate signed applications — Solid PDF Creator or Citrix Receiver — and then deploys either MINIRECON (a Toneshell-derived backdoor) or ZOHOMURK. ZOHOMURK carries hardcoded Zoho OAuth credentials and authenticates to Zoho’s WorkDrive API as a legitimate third-party app, reading commands from an attacker-controlled inbox and writing stolen files to an outbox. No credential theft or phishing is needed because the malware holds a standing OAuth token, making the traffic appear as routine authenticated API activity. Victims were lured via emails with malicious ZIP files containing hydropower proposals or memoranda on India-Taiwan cooperation. Attribution to Mustang Panda is based on repeated misspelled strings and IP subnet overlaps with previous campaigns. No vulnerability in Zoho WorkDrive was exploited. Defenses should focus on behavioral monitoring for unexpected cloud API calls and auditing OAuth token holdings.

China-Linked Mustang Panda Hides Spy Tools Inside India’s Trusted Cloud Storage App →

SimpleHelp Authentication Bypass Leads to Cross-Platform Malware Deployment

A critical authentication bypass vulnerability in SimpleHelp remote-access software, tracked as CVE-2026-48558, is being actively exploited to deploy malware on Windows, macOS, and Linux systems. The flaw affects instances using OpenID Connect (OIDC) authentication, allowing attackers to bypass login protections and create privileged technician sessions without valid credentials. Once inside, attackers gain the trusted administrative channel used by IT teams and managed service providers, enabling file transfers, command execution, and lateral movement. Blackpoint’s Adversary Pursuit Group reported that this access was used to deploy two previously unseen malware families: TaskWeaver, a Node.js-based loader disguised as ‘jquery.js’, and Djinn Stealer, a cross-platform infostealer. Djinn Stealer harvests cloud credentials, SSH keys, Git configurations, browser data, cryptocurrency wallet files, and authentication data for AI development tools and Model Context Protocol configurations. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-48558 to its Known Exploited Vulnerabilities catalog, confirming real-world exploitation. Organizations using SimpleHelp with OIDC should immediately patch or take mitigation steps to block unauthorized technician access.

SimpleHelp Flaw Exploited to Deploy Malware Targeting Windows, macOS, and Linux →

CISA Warns Ransomware Gangs Exploit Microsoft Defender Privilege Escalation Flaw

CISA confirmed that ransomware gangs have begun exploiting BlueHammer (CVE-2026-33825), a high-severity Microsoft Defender privilege escalation vulnerability. The flaw was leaked in early April by a security researcher along with proof-of-concept exploit code, in protest at Microsoft’s disclosure handling. Microsoft described the issue as insufficient granularity of access control in Microsoft Defender that allows an authorized attacker to elevate privileges locally. According to Will Dormann, principal vulnerability analyst at Tharros, the exploit gives local attackers access to the Security Account Manager (SAM) database containing password hashes, enabling escalation to SYSTEM privileges and full system control. Microsoft patched the vulnerability on April 14 as part of the April 2026 Patch Tuesday. Days later, Huntress Labs revealed that threat actors had exploited it as a zero-day in hands-on-keyboard attacks. On April 22, CISA added the flaw to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch within two weeks. In a subsequent update, CISA flagged BlueHammer as exploited in ransomware campaigns. Organizations should apply the April 2026 Patch Tuesday updates if they have not already done so, and monitor for signs of privilege escalation activity.

CISA: Windows BlueHammer flaw now exploited by ransomware gangs →