Threat reportVulnerabilityTL-2026-3850
Weekly threat digest (week ending 2026-06-07): PAN-OS GlobalProtect CVE-2026-0257 exploitation, React2Shell CVE-2025-55182 abuse by APT-C-26, and npm/state-actor campaigns
Weekly threat digest (week ending 2026-06-07) (TL-2026-3850), also tracked as React2Shell, is a high-severity software vulnerability scored CVSS 7.8, first published 2026-10-18. It is attributed to Lazarus Group with medium confidence, affects Palo Alto Networks PAN-OS GlobalProtect portal/gateway and Prisma, references 5 CVEs (CVE-2026-0257, CVE-2025-55182, CVE-2026-33829), maps to 23 MITRE ATT&CK techniques (T1027.003, T1027.006, T1036.005), and is covered by 9 detection rules and 28 indicators of compromise.
- CVSS
- 7.8/10High
- CVEs
- 5Referenced vulnerabilities
- Techniques
- 23MITRE ATT&CK
- Actors
- 4Lazarus Group
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-3850
- Threat ID
- TL-2026-3850
- Also known as
- React2Shell, FSB's Matryoshka, PixyNetLoader, BRICKSTORM, DriveSurge, PCPJack
- Severity
- HIGH
- CVSS
- 7.8 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:N)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution
- Lazarus Group, APT38, Gamaredon, APT28
- Attribution confidence
- MEDIUM
- Motivation
- ESPIONAGE
- Target sectors
- technology, government administration, military, critical-infrastructure, managed-service-providers, finance, cloud, software-development
- Target regions
- Global, ukraine, North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in Weekly threat digest (week ending 2026-06-07)
Malware and tooling: BRICKSTORM - S9015, Bankshot, PixyNetLoader, Rapid7
How Weekly threat digest (week ending 2026-06-07) works
Weekly roundup led by actively exploited PAN-OS GlobalProtect authentication bypass CVE-2026-0257 (exploitation from 2026-05-17, CISA KEV 2026-05-29, CVSS raised 4.7 to 7.8). Also covers APT-C-26 (Lazarus) abuse of React2Shell CVE-2025-55182, Gamaredon, APT28 PixyNetLoader, VerdantBamboo/BRICKSTORM, DriveSurge ClickFix, npm supply-chain campaigns and the CVE-2026-33829 NTLM leak.
CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS (and Prisma Access). It requires authentication override cookies to be enabled and the cookie-encryption certificate to be reused for another feature such as the HTTPS service. A remote unauthenticated attacker can then retrieve the certificate's public key and forge authentication override cookies. Per Rapid7, the decrypted cookie content is trusted with no signature verification. Palo Alto published the advisory on 2026-05-13. Rapid7 MDR saw the earliest exploitation on 2026-05-17 and identified attempts across multiple customers on 2026-05-18. A second wave from a different hosting provider followed on 2026-05-21, and CISA added the CVE to KEV on 2026-05-29. Attackers established VPN tunnels after cookie authentication; Rapid7 saw no evidence of lateral movement from the devices in 8 of 10 affected customers. Palo Alto raised the score from CVSS 4.7 (Medium) to 7.8 (High) on 2026-05-29. Rapid7 Labs published a public PoC script. Exploited requests hit /ssl-vpn/login.esp, /ssl-vpn/getconfig.esp and /ssl-vpn/hipreport.esp, with client names such as GP-CLIENT, DESKTOP-GP01 and Jocker and a spoofed MAC address.
The digest (CTO at NCSC, 2026-06-06) also reports that the 360 Threat Intelligence Center attributes exploitation of React2Shell (CVE-2025-55182, CVSS 10.0, CWE-502 unsafe deserialization in React Server Components) to North Korea-linked APT-C-26 (Lazarus). The digest lists Copperhedge malware, the MultiRelay lateral-movement tool and UAC bypass utilities. Gamaredon (FSB) was documented by Sekoia: GammaPhish xHTML/HTML smuggling plus WinRAR CVE-2025-8088 path traversal, GammaLoad VBScript staging, GammaWorm USB/network propagation with ADS persistence, and GammaSteel PowerShell exfiltration to S3-compatible storage, with Telegram, Telegraph, Teletype and Cloudflare used as dead drop resolvers. ExaTrack tracked about 90 APT28 PixyNetLoader samples in four sub-families, delivered via Office documents exploiting CVE-2026-21509. They use COM-hijack persistence, LSB PNG steganography with AES/PBKDF2 and a Covenant Grunt final payload using FILEN cloud storage for C2. Volexity details VerdantBamboo (WARP PANDA / UNC5221) deploying BRICKSTORM with PLENET and AGENTPSD fallback implants on edge devices (Egnyte Storage Sync, pfSense, Synology NAS) after an MSP compromise. Silent Push documents DriveSurge, a pay-per-install initial access broker that uses zTDS, compromised websites, fake browser updates and ClickFix.
Supply-chain items: Microsoft and SafeDep report a dependency-confusion campaign with a postinstall stager that harvests environment variables and reports to oob.moika.tech (33 packages per Microsoft, 183 per SafeDep). Hunt.io reports PCPJack using Sliver and Chisel on 230 cloud servers as an SMTP relay network. Red Hat advisory RHSB-2026-006 covers a compromised GitHub account with unauthorized commits to RedHatInsights repositories. Sophos reports an undeclared me.exe miner in a Hola browser release. Huntress details CVE-2026-33829 (Snipping Tool, patched 2026-04-14, CVSS 4.3), a single-click NTLM leak via a URI handler, and an unpatched identical flaw in the search: URI handler (no CVE assigned).
MITRE ATT&CK techniques used in TL-2026-3850
Defense Evasion
T1027.003 Obfuscated Files or Information: Steganography; T1027.006 Obfuscated Files or Information: HTML Smuggling; T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1564.004 Hide Artifacts: NTFS File Attributes
Persistence
T1053.003 Scheduled Task/Job: Cron; T1543.002 Create or Modify System Process: Systemd Service; T1546.015 Event Triggered Execution: Component Object Model Hijacking
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1059.005 Command and Scripting Interpreter: Visual Basic; T1059.007 Command and Scripting Interpreter: JavaScript; T1204.004 User Execution: Malicious Copy and Paste
Command and Control
T1090.003 Proxy: Multi-hop Proxy; T1102.001 Web Service: Dead Drop Resolver; T1572 Protocol Tunneling
Lateral Movement
T1091 Replication Through Removable Media
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain; T1566.001 Phishing: Spearphishing Attachment
Credential Access
T1187 Forced Authentication; T1606.001 Forge Web Credentials: Web Cookies
Privilege Escalation
T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching
Exfiltration
Affected products and versions in Weekly threat digest (week ending 2026-06-07)
- Palo Alto Networks — PAN-OS GlobalProtect portal/gateway and Prisma Access
Vulnerable versions: PAN-OS 12.1 < 12.1.4-h6 / < 12.1.7; PAN-OS 11.2 < 11.2.4-h17 / < 11.2.7-h14 / < 11.2.10-h7 / < 11.2.12; PAN-OS 11.1 < 11.1.4-h33 / < 11.1.6-h32 / < 11.1.7-h6 / < 11.1.10-h25 / < 11.1.13-h5 / < 11.1.15; PAN-OS 10.2 < 10.2.7-h34 / < 10.2.10-h36 / < 10.2.13-h21 / < 10.2.16-h7 / < 10.2.18-h6; Prisma Access 11.2.0 < 11.2.7-h13; Prisma Access 10.2.0 < 10.2.10-h36
Fixed in: 12.1.4-h6; 12.1.7; 11.2.12; 11.1.15; 10.2.18-h6; Prisma Access 11.2.7-h13; Prisma Access 10.2.10-h36 - Meta / Vercel — React Server Components (react-server-dom-*) and Next.js
Vulnerable versions: React 19.0.0; React 19.1.0; React 19.1.1; React 19.2.0; Next.js 15.0.0-15.0.4; Next.js 15.1.0-15.1.8; Next.js 15.2.0-15.2.5; Next.js 16.0.0-16.0.6
Fixed in: 19.0.1; 19.1.2; 19.2.1 - Microsoft — Windows Snipping Tool and search: URI handler
Vulnerable versions: Windows 11 23H2 (build 22631.6199) and 25H2 (build 26200.8524) tested; search: handler unpatched
Fixed in: CVE-2026-33829 fixed 2026-04-14 - Egnyte — Egnyte Storage Sync
Vulnerable versions: prior to 13.13
Fixed in: 13.13
Remediation for Weekly threat digest (week ending 2026-06-07)
Patches
- PAN-OS fixed: 12.1.4-h6/12.1.7; 11.2.4-h17/11.2.7-h14/11.2.10-h7/11.2.12; 11.1.4-h33/11.1.6-h32/11.1.7-h6/11.1.10-h25/11.1.13-h5/11.1.15; 10.2.7-h34/10.2.10-h36/10.2.13-h21/10.2.16-h7/10.2.18-h6; Prisma Access 11.2.7-h13 and 10.2.10-h36
- CVE-2026-33829 patched 2026-04-14 (no patch for the search: URI handler variant)
- Egnyte Storage Sync v13.13 fixes the sudo/tee privilege escalation abused by VerdantBamboo
Immediate actions
- Patch PAN-OS/Prisma Access to the fixed releases listed in the Palo Alto advisory for CVE-2026-0257
- Hunt GlobalProtect logs for requests to /ssl-vpn/login.esp, /ssl-vpn/getconfig.esp and /ssl-vpn/hipreport.esp from the Rapid7-reported IPs and for client names GP-CLIENT, DESKTOP-GP01 and Jocker
- Block outbound SMB (TCP/445, TCP/139) from endpoints that do not need it
- Block oob.moika.tech and audit npm lockfiles and CI logs for the malicious @cloudplatform-single-spa, @t-in-one, @ce-rwb and related scoped packages
- Update React, Next.js and RSC packages to 19.0.1, 19.1.2 or 19.2.1 or later
Workarounds
- Use a dedicated certificate exclusively for GlobalProtect Authentication Override cookies
- Disable Authentication Override in the portal and gateway configuration if not required
- Disable Cloud Authentication Service (CAS) if not needed
Longer-term hardening
- Deploy EDR or monitoring on edge devices, firewalls and NAS appliances
- Enforce npm scope pinning and private-registry dependency-confusion protections
- Restrict NTLM (RestrictSendingNTLMTraffic=2) and enable SMB signing
- Alert on search: and search-ms: URIs in email and proxy logs
- Rotate credentials and secrets exposed to any host that installed the malicious packages
CVEs associated with Weekly threat digest (week ending 2026-06-07)
CVE-2026-0257, CVE-2025-55182, CVE-2026-33829, CVE-2025-8088, CVE-2026-21509
Weaknesses (CWE) in Weekly threat digest (week ending 2026-06-07)
Timeline of Weekly threat digest (week ending 2026-06-07)
- React2Shell (CVE-2025-55182) details published; exploitation attempts appeared almost immediately afterward
- Hunt.io reports PCPJack version 1 Sliver beacon deployment (50 beacons); a later March wave executed 230 beacons on cloud Linux servers
- Microsoft patches CVE-2026-33829 (Snipping Tool NTLM leak, CVSS 4.3)
- Palo Alto Networks publishes advisory for CVE-2026-0257 (GlobalProtect authentication bypass, initially CVSS 4.7)
- Earliest observed exploitation of CVE-2026-0257 (client name GP-CLIENT on Linux), four days after the advisory
- Rapid7 MDR identifies CVE-2026-0257 exploitation attempts across multiple customers
- Second CVE-2026-0257 exploitation wave from a different hosting provider (client name DESKTOP-GP01 on Windows)
- oob.moika.tech npm dependency-confusion Wave 1 published; Wave 2 followed on 2026-05-29 and Wave 3 on 2026-06-01
- CVE-2026-0257 added to CISA KEV; Palo Alto raises CVSS to 7.8; Rapid7 publishes analysis and PoC; Microsoft publishes npm dependency-confusion analysis
- Silent Push publishes DriveSurge ClickFix/FakeUpdates initial access broker research
- Sekoia publishes part 1 of its Gamaredon FSB's Matryoshka analysis (GammaPhish, GammaWorm)
- Huntress publicly discloses unpatched NTLM leak in the Windows search: URI handler after MSRC rated it below servicing threshold
- Volexity publishes VerdantBamboo / BRICKSTORM / PLENET / AGENTPSD analysis
- CTO at NCSC publishes weekly summary for the week ending 2026-06-07
Sources cited for Weekly threat digest (week ending 2026-06-07)
- CTO at NCSC Summary: Week Ending June 7th, 2026
- Rapid7: Observed exploitation of PAN-OS GlobalProtect authentication bypass CVE-2026-0257
- Palo Alto Networks Security Advisory CVE-2026-0257
- Rapid7 Labs PoC for CVE-2026-0257
- Volexity: VerdantBamboo - Just Another BRICKSTORM in the Firewall
- Sekoia: FSB's Matryoshka 1/3 - Gamaredon's gifts that keep unpacking (GammaPhish and GammaWorm)
- ExaTrack: Tracking APT28 PixyNetLoader
- Silent Push: DriveSurge
- Microsoft: 33 malicious npm packages abuse dependency confusion to profile developer environments
- SafeDep: oob.moika.tech dependency confusion campaign
- Hunt.io: PCPJack - 230 cloud servers, SMTP proxy network, Sliver and Chisel
- Huntress: Unpatched NTLM leak in the Windows search URI handler
- Red Hat Security Bulletin RHSB-2026-006
- Sophos: You do surprise me.exe - an unexpected executable in Hola Browser
- Securelist: CVE-2025-55182 exploitation
Detection coverage for TL-2026-3850
As of 2026-10-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3850 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-3850
5 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.