# Weekly threat digest (week ending 2026-06-07): PAN-OS GlobalProtect CVE-2026-0257 exploitation, React2Shell CVE-2025-55182 abuse by APT-C-26, and npm/state-actor campaigns

> Weekly roundup led by actively exploited PAN-OS GlobalProtect authentication bypass CVE-2026-0257 (exploitation from 2026-05-17, CISA KEV 2026-05-29, CVSS raised 4.7 to 7.8). Also covers APT-C-26 (Lazarus) abuse of React2Shell CVE-2025-55182, Gamaredon, APT28 PixyNetLoader, VerdantBamboo/BRICKSTORM, DriveSurge ClickFix, npm supply-chain campaigns and the CVE-2026-33829 NTLM leak.

- **Published:** 2026-10-18T08:15:19Z
- **Last reviewed:** 2026-10-18T08:15:19Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3850
- **ID:** TL-2026-3850
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Lazarus Group
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-0257, CVE-2025-55182, CVE-2026-33829, CVE-2025-8088, CVE-2026-21509

## Description

CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS (and Prisma Access). It requires authentication override cookies to be enabled and the cookie-encryption certificate to be reused for another feature such as the HTTPS service. A remote unauthenticated attacker can then retrieve the certificate's public key and forge authentication override cookies. Per Rapid7, the decrypted cookie content is trusted with no signature verification. Palo Alto published the advisory on 2026-05-13. Rapid7 MDR saw the earliest exploitation on 2026-05-17 and identified attempts across multiple customers on 2026-05-18. A second wave from a different hosting provider followed on 2026-05-21, and CISA added the CVE to KEV on 2026-05-29. Attackers established VPN tunnels after cookie authentication; Rapid7 saw no evidence of lateral movement from the devices in 8 of 10 affected customers. Palo Alto raised the score from CVSS 4.7 (Medium) to 7.8 (High) on 2026-05-29. Rapid7 Labs published a public PoC script. Exploited requests hit /ssl-vpn/login.esp, /ssl-vpn/getconfig.esp and /ssl-vpn/hipreport.esp, with client names such as GP-CLIENT, DESKTOP-GP01 and Jocker and a spoofed MAC address.

The digest (CTO at NCSC, 2026-06-06) also reports that the 360 Threat Intelligence Center attributes exploitation of React2Shell (CVE-2025-55182, CVSS 10.0, CWE-502 unsafe deserialization in React Server Components) to North Korea-linked APT-C-26 (Lazarus). The digest lists Copperhedge malware, the MultiRelay lateral-movement tool and UAC bypass utilities. Gamaredon (FSB) was documented by Sekoia: GammaPhish xHTML/HTML smuggling plus WinRAR CVE-2025-8088 path traversal, GammaLoad VBScript staging, GammaWorm USB/network propagation with ADS persistence, and GammaSteel PowerShell exfiltration to S3-compatible storage, with Telegram, Telegraph, Teletype and Cloudflare used as dead drop resolvers. ExaTrack tracked about 90 APT28 PixyNetLoader samples in four sub-families, delivered via Office documents exploiting CVE-2026-21509. They use COM-hijack persistence, LSB PNG steganography with AES/PBKDF2 and a Covenant Grunt final payload using FILEN cloud storage for C2. Volexity details VerdantBamboo (WARP PANDA / UNC5221) deploying BRICKSTORM with PLENET and AGENTPSD fallback implants on edge devices (Egnyte Storage Sync, pfSense, Synology NAS) after an MSP compromise. Silent Push documents DriveSurge, a pay-per-install initial access broker that uses zTDS, compromised websites, fake browser updates and ClickFix.

Supply-chain items: Microsoft and SafeDep report a dependency-confusion campaign with a postinstall stager that harvests environment variables and reports to oob.moika.tech (33 packages per Microsoft, 183 per SafeDep). Hunt.io reports PCPJack using Sliver and Chisel on 230 cloud servers as an SMTP relay network. Red Hat advisory RHSB-2026-006 covers a compromised GitHub account with unauthorized commits to RedHatInsights repositories. Sophos reports an undeclared me.exe miner in a Hola browser release. Huntress details CVE-2026-33829 (Snipping Tool, patched 2026-04-14, CVSS 4.3), a single-click NTLM leak via a URI handler, and an unpatched identical flaw in the search: URI handler (no CVE assigned).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1566.001 Phishing: Spearphishing Attachment
- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1606.001 Forge Web Credentials: Web Cookies
- T1187 Forced Authentication
- T1204.004 User Execution: Malicious Copy and Paste
- T1059.005 Command and Scripting Interpreter: Visual Basic
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1546.015 Event Triggered Execution: Component Object Model Hijacking
- T1053.003 Scheduled Task/Job: Cron
- T1543.002 Create or Modify System Process: Systemd Service
- T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- T1027.003 Obfuscated Files or Information: Steganography
- T1027.006 Obfuscated Files or Information: HTML Smuggling
- T1564.004 Hide Artifacts: NTFS File Attributes
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1091 Replication Through Removable Media
- T1102.001 Web Service: Dead Drop Resolver
- T1572 Protocol Tunneling
- T1090.003 Proxy: Multi-hop Proxy
- T1567 Exfiltration Over Web Service

## Sources

- [CTO at NCSC Summary: Week Ending June 7th, 2026](https://ctoatncsc.substack.com/p/cto-at-ncsc-summary-week-ending-june-574)
- [Rapid7: Observed exploitation of PAN-OS GlobalProtect authentication bypass CVE-2026-0257](https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/)
- [Palo Alto Networks Security Advisory CVE-2026-0257](https://security.paloaltonetworks.com/CVE-2026-0257)
- [Rapid7 Labs PoC for CVE-2026-0257](https://github.com/sfewer-r7/CVE-2026-0257)
- [Volexity: VerdantBamboo - Just Another BRICKSTORM in the Firewall](https://www.volexity.com/blog/2026/06/04/verdantbamboo-just-another-brickstorm-in-the-firewall/)
- [Sekoia: FSB's Matryoshka 1/3 - Gamaredon's gifts that keep unpacking (GammaPhish and GammaWorm)](https://www.sekoia.com/blog/fsbs-matryoshka-1-3-gamaredons-gifts-that-keeps-unpacking-gammaphish-and-gammaworm)
- [ExaTrack: Tracking APT28 PixyNetLoader](https://exatrack.com/publications/apt28-pixynetloader.html)
- [Silent Push: DriveSurge](https://www.silentpush.com/blog/drivesurge/)
- [Microsoft: 33 malicious npm packages abuse dependency confusion to profile developer environments](https://www.microsoft.com/en-us/security/blog/2026/05/29/33-malicious-npm-packages-abuse-dependency-confusion-profile-developer-environments/)
- [SafeDep: oob.moika.tech dependency confusion campaign](https://safedep.io/oob-moika-tech-dependency-confusion-campaign/)
- [Hunt.io: PCPJack - 230 cloud servers, SMTP proxy network, Sliver and Chisel](https://hunt.io/blog/pcpjack-230-cloud-servers-smtp-proxy-network-sliver-chisel)
- [Huntress: Unpatched NTLM leak in the Windows search URI handler](https://www.huntress.com/blog/unpatched-ntlm-leak-windows-search-uri-handler)
- [Red Hat Security Bulletin RHSB-2026-006](https://access.redhat.com/security/vulnerabilities/RHSB-2026-006)
- [Sophos: You do surprise me.exe - an unexpected executable in Hola Browser](https://www.sophos.com/en-us/blog/you-do-surprise-me-exe-an-unexpected-executable-in-hola-browser)
- [Securelist: CVE-2025-55182 exploitation](https://securelist.com/cve-2025-55182-exploitation/118331/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3850