© Getty Images
© Getty Images/Iurii Motov
© Amelia Brust/Federal News Network
© Getty Images/iStockphoto/anyaberkut
© AP Photo/Carolyn Kaster
© Federal News Network
© Derace Lauderdale/Federal News Network
According to a fresh intelligence report from Proofpoint, TA419 has been systematically hunting down artificial intelligence policy experts, researchers, and legal minds across U.S. think tanks, universities, and major institutions. Their goal? Extracting deep intelligence on how the West plans to govern, regulate, and secure the next generation of AI.
TA419 doesn’t launch noisy, automated spam blasts. Instead, they play a patient, high-stakes psychological game.
The campaigns begin with a harmless-looking networking outreach designed to build trust. Attackers have been spotted impersonating prominent economists, former White House science and technology leadership, and even real employees from top-tier AI labs like Anthropic.
In one targeted strike against a U.S. think tank expert, the lure arrived with a deceptively urgent subject line: “Request for Feedback on Military Integration of Claude.”
Once a target takes the bait and replies, the trap snaps shut.
If you think you’d spot a fake login page a mile away, think again. TA419 uses a sophisticated, custom-built attack chain that bypasses traditional warning bells.
1. The Handshake: A response from the attacker delivers a shortened URL that bypasses security scanners by using a Cloudflare Turnstile human verification check.
2. The Illusion: Victims are funneled to a Microsoft OneDrive-hosted page running a stealthy technique known as “Frameless BitB” (Browser-in-the-Browser). Unlike older phishing methods that rely on obvious iframe pop-ups, this technique uses precise HTML, CSS, and JavaScript injections to paint an entirely fake login prompt over a legitimate browser session, leaving no telltale frames or strange URL bars.
3. The Silent Heist: TA419 pairs this with a custom telemetry module that monitors the user’s Microsoft sign-in flow in real-time, siphoning credentials and session cookies while instantly relaying them to the real Microsoft infrastructure in the background.
To the victim, the login succeeds seamlessly. There are no error messages, no weird redirects, and zero indication that their entire digital workspace has just been compromised.
Since at least April 2025, TA419 has cast a wide shadow over U.S. and Japanese defense, energy, and foreign policy sectors. But shifting their crosshairs directly onto the architects of U.S. AI policy marks a chilling escalation. As global superpowers race to control the technological high ground, state-sponsored espionage is no longer just about stealing source code, it’s about hijacking the minds and mailboxes of the people writing the rules.
Security analysts warn that standard user awareness isn’t enough to stop state-backed adversaries using custom adversarial-in-the-middle (AitM) infrastructure. Organizations and high-profile researchers are being urged to ditch vulnerable passwords entirely in favor of phishing-resistant authentication methods like passkeys and to treat any unsolicited, high-profile outreach with extreme skepticism.
Because in the high-stakes game of AI geopolitics, a single click on “Continue” might hand an adversary the keys to the entire kingdom.
Read the original research by Proofpoint: https://www.proofpoint.com/us/blog/threat-insight/hallucinating-credibility-china-aligned-ta419-impersonates-its-way-us-ai-policy
If you’re reading this article, use the discount code CQBLOG_AMSC27_FUTURE at checkout – a special offer created exclusively for readers of this article. The code applies to our flagship course Advanced Microsoft Security Course, which takes place only once a year, and is valid until October 25, 2026. Take advantage of this exclusive opportunity and secure your spot.
Join our FREE live webinar:
Secure Users: Designing Workstations for Threat Resistance
Workstation security depends on how privileged access, authentication, endpoint configuration, and monitoring work together.
Join Paula Januszkiewicz, Sami Laiho, and Artur Kalinowski for a practical session on designing and deploying Privileged Access Workstations (PAWs), implementing passkeys securely, and identifying workstation and identity misconfigurations that weaken security.
Through practical demonstrations, discover how to strengthen workstation defenses, identify the authentication events and security changes that matter, and connect endpoint and identity activity to actionable detections. You will also learn how to validate that security evidence is collected and alerts trigger as expected.
Leave with an actionable checklist for PAW design, passkey deployment, workstation hardening, configuration reviews, and monitoring validation.
Register for free:
https://luma.com/SecureUsers
The post The Quiet War for the Future of AI: How China-Aligned Spies Are Hunting U.S. Policy Experts appeared first on CQURE Academy.
© The Associated Press
© Getty Images/iStockphoto/Smederevac
© AP Photo/Alex Brandon
© Federal News Network
What happens when the guardian of the network, the security appliance itself gets broken into?
On September 27, 2026, an alert went out that should put every cybersecurity professional on high alert. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) urgently added two vulnerabilities in Citrix NetScaler ADC and Gateway (CVE-2026-88771 and CVE-2026-88772) to its “Known Exploited Vulnerabilities” (KEV) catalog. This isn’t routine paperwork, it’s a global threat notice backed by hard evidence: attackers are actively exploiting these flaws in real time, seizing remote code execution (RCE) on unpatched devices.
This isn’t just about two “high-severity bugs.” It’s a battle over the digital front door of the enterprise.
Citrix NetScaler (formerly NetScaler ADC and Gateway) isn’t just another server. It’s the aorta of enterprise networking – distributing traffic between applications and users and serving as the “front door” for remote work VPNs and authentication at many organizations.
Think of it as the drawbridge of a heavily fortified castle. If the drawbridge falls, an attacker doesn’t just see the moat, they walk straight across it and into the great hall. Because NetScaler appliances are typically exposed directly to the internet to deliver services, they’re naturally a high-value “crown jewel” in attackers’ eyes.
These two vulnerabilities were flagged as “critical” by CISA not just because of their staggering CVSS score of 9.5 out of 10, but because of how they’re exploited:
CVE-2026-88771 (Unauthenticated Input Validation Error): What makes this one terrifying is that it requires no preconditions. It affects NetScaler ADC and Gateway across all affected versions – even default configurations aren’t spared. That means an unauthenticated remote attacker can craft a specific request and execute arbitrary commands directly on the appliance.
CVE-2026-88772 (Memory Buffer Overflow): Exploiting this one requires DTLS (Datagram Transport Layer Security) to be enabled. But here’s the deadly trap – DTLS is on by default on VPN virtual servers. That puts the vast majority of NetScaler Gateway deployments in the danger zone. Attackers can leverage the memory overflow to achieve the same remote code execution or launch denial-of-service attacks.
Unlike the usual “patch immediately” response flow, CISA offered a critical and easily overlooked piece of guidance in this alert: If possible, check whether the device has already been compromised before patching.
This isn’t busywork. Both Citrix and CISA emphasize that patching or rebooting a device can destroy or wipe out valuable forensic evidence (such as malicious payloads in memory or access logs). If an attacker is already lurking in your network, a hasty reboot may only sever your trail of evidence, letting them hide deeper in the system.
The correct order is:
1. Forensics first: If compromise is suspected, preserve evidence first (memory dumps, logs).
2. Hunt for IoCs: Citrix has published Indicators of Compromise (IoC) through NetScaler Console to help organizations determine whether they’ve been hit.
3. Isolate and rotate: If compromise is confirmed, isolate the device immediately. But the job is far from over – NetScaler stores a wealth of sensitive credentials, session information, and SSL keys. You must rotate all related local passwords, Key Encryption Keys (KEK), and replace all recovered SSL certificates.
As Citrix advises, once compromise is suspected, the safest path may be to rebuild the appliance from a known-good backup after preserving evidence, rather than simply applying a patch on top of an infected system.
If you or your organization uses Citrix NetScaler ADC or Gateway, here’s what you should do right now:
Immediately verify your appliance version. Affected versions include:
1. NetScaler ADC and Gateway 14.1 (below 14.1-73.37)
2. NetScaler ADC and Gateway 13.1 (below 13.1-64.23)
3. NetScaler ADC FIPS 14.1 (below 14.1-73.37 FIPS)
4. NetScaler ADC FIPS and NDcPP 13.1 (below 13.1-37.279)
Watch for a critical trap: even if you installed the August 2026 fix for CVE-2026-19490, that does not mean you’re protected that build still falls below the new remediation threshold.
Move appliances to:
1. 14.1-73.37 or later
2. 13.1-64.23 or later (note: check Citrix guidance regarding potential reboot loops)
3. The corresponding FIPS/NDcPP versions
1. Verify whether DTLS is enabled (it’s on by default for VPN virtual servers).
2. For SAML authentication, validate that identity providers issue signed SAML assertions (new NetScaler versions no longer accept unsigned assertions).
3. For CVE-2026-88778 (a related vulnerability), enable enhanced initial sequence number generation under Citrix’s guidance.
Never expose the NetScaler management interface directly to the public internet. Restrict management access to a trusted management network or VPN.
The Citrix NetScaler crisis is yet another wake-up call: patching is only the baseline of security. Assuming a vulnerability may already have been exploited and that your system may already be breached is the survival rule in today’s threat landscape.
From the infamous “Citrix Bleed” (CVE-2023-4966) in 2023, which enabled the LockBit ransomware gang to launch mass intrusions, to today’s two unpatched zero-days, NetScaler has consistently been a high-value target. Attackers won’t wait for you to schedule a comfortable maintenance window. They’re out there on the network right now, testing every door that might be unlocked.
For security teams responsible for critical infrastructure, the coming hours matter enormously. This alert is not a drill. It demands immediate verification, deliberate action, and a serious embrace of the assumption that “the system may already be compromised.” In the world of cybersecurity, the most dangerous thing is rarely the vulnerability you know about it’s the one you think you’ve handled, but that’s already being exploited.
This article is based on information published in CISA’s official alert: https://www.cisa.gov/news-events/alerts/2026/09/27/critical-zero-day-vulnerabilities-exploited-citrix-netscaler-adc-gateway
If you’re reading this article, use the discount code CQBLOG_AMSC27_CITRIX at checkout – a special offer created exclusively for readers of this article. The code applies to our flagship course Advanced Microsoft Security Course, which takes place only once a year, and is valid until October 25, 2026. Take advantage of this exclusive opportunity and secure your spot.
Join our FREE live webinar:
Secure Users: Designing Workstations for Threat Resistance
Workstation security depends on how privileged access, authentication, endpoint configuration, and monitoring work together.
Join Paula Januszkiewicz, Sami Laiho, and Artur Kalinowski for a practical session on designing and deploying Privileged Access Workstations (PAWs), implementing passkeys securely, and identifying workstation and identity misconfigurations that weaken security.
Through practical demonstrations, discover how to strengthen workstation defenses, identify the authentication events and security changes that matter, and connect endpoint and identity activity to actionable detections. You will also learn how to validate that security evidence is collected and alerts trigger as expected.
Leave with an actionable checklist for PAW design, passkey deployment, workstation hardening, configuration reviews, and monitoring validation.
Register for free: https://luma.com/SecureUsers
The post Two 9.5-Rated “Digital Front Doors”: Why Attackers Are Hammering Citrix NetScaler and Why You Need to Move Now appeared first on CQURE Academy.
© Federal News Network
Have you ever wondered how easy it is to launch an attack that can take down an entire website? The answer is unsettling: all it took was a visit to the right website and a payment in cryptocurrency. NightmareStresser was the perfect example: a digital weapons shop, open to anyone, anonymous, and devastatingly effective.
The U.S. Department of Justice announced this week that the FBI has seized the internet domains associated with the notorious booter service. Visitors attempting to access sites like nightmare-stresser[.]com will now be greeted not by a tool for launching attacks, but by an official seizure banner. It’s a symbolic end to a service that authorities say was active since at least 2022, though security researchers suggest its roots go much deeper, possibly as far back as 2016.
The scale of this operation is staggering. We’re talking about hundreds of thousands of DDoS attacks launched against victims worldwide. At its peak around 2025, the service had reportedly grown to nearly 1 million users. NightmareStresser could unleash between 3,000 and 4,000 attacks per hour, accepted cryptocurrency payments, and – in a bizarre twist – avoided targeting government, education, and hospital domains.
The takedown of NightmareStresser wasn’t a stroke of luck, it was part of Operation PowerOFF, a coordinated global effort to dismantle DDoS-for-hire infrastructures worldwide and hold the individuals behind them accountable. This isn’t the first blow against the industry. Over the past eight years, U.S. authorities have charged 12 DDoS attack facilitators and seized over 100 domains linked to booter services.
For the average internet user, this is welcome news. Services like “booters” or “stressers” are considered a gateway to more serious cybercrime. They offer a low barrier to entry for “cybercriminal-wannabes,” who (with just a few clicks and a small crypto payment) can cripple someone’s website or online service.
History teaches us that nature abhors a vacuum. When rival services were disrupted in 2018, NightmareStresser only grew stronger, becoming the largest player on the market. Now that the giant has been toppled, we must ask: who will take its place?
Despite the successes of operations like PowerOFF, the fight against DDoS-for-hire is a relentless game of cat and mouse. Law enforcement is not only tracking administrators but also pursuing the users of these services. But will this be enough to deter the next wave of digital vandals?
One thing is certain: for NightmareStresser, the nightmare is finally over. For the rest of the world, it’s a reminder that even the most “nightmarish” services eventually meet their end. The only question is is the next nightmare already lurking around the corner?
Based on the official announcement by the U.S. Department of Justice: Read the original announcement
If you’re reading this article, use the discount code CQBLOG_AMSC27_DDoS at checkout – a special offer created exclusively for readers of this article. The code applies to our flagsihp course Advanced Microsoft Security Course, which takes place only once a year, and is valid until October 25, 2026. Take advantage of this exclusive opportunity and secure your spot.
Join our FREE live webinar:
Uncovering New Identity Theft Vectors and How to Mitigate Them
Discover how identity theft no longer begins and ends with a stolen password.
Paula Januszkiewicz (CEO of CQURE and CQURE Academy, Cybersecurity Expert & Red Teamer, Microsoft Regional Director, MVP, and MCT) will unveil new identity attack paths, including original research from the CQURE Team demonstrating how an attacker can move from endpoint access to cloud identity takeover, compromise sensitive user secrets, gain access to protected resources such as KeePass, and evade traditional EDR/XDR visibility.
Register for free: https://luma.com/TheftVectors
The post The Nightmare Is Over: World’s Longest-Running DDoS Service Finally Shut Down appeared first on CQURE Academy.
The vulnerability stems from an unsafe deserialization of untrusted data, a class of flaw where an application reconstructs objects from attacker-supplied input without first validating it.
Because Entra ID is a cloud-hosted service, Microsoft was able to remediate the vulnerability on the server-side, meaning customers did not need to install any patches.
The disclosure itself became an unusual story. Microsoft initially marked the vulnerability as “Exploited: Yes” in its advisory, leading to widespread reports that the flaw was under active attack. However, the company reversed this designation the following day to “No” without a detailed public explanation. Microsoft later clarified that the change was informational and that there was no confirmed exploitation in the wild.
Vulnerability: Deserialization of Untrusted Data (CWE-502) in Microsoft Entra ID.
Impact: Allows an unauthenticated attacker to execute remote code over a network, which could lead to a complete compromise of the identity service.
CVSS Score: 10.0 (Critical). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating it’s exploitable over the network with low complexity, no privileges, and no user interaction.
Status: Microsoft has fully mitigated the vulnerability on its infrastructure. No patch is required from customers. Crucially, Microsoft has corrected its initial advisory to state that there is no evidence of active exploitation in the wild. The initial “Exploited: Yes” flag was a mistake.
Takeaway for Threat Hunters: Because the vulnerability was server-side and already fixed, hunting should focus on detecting anomalous, suspicious, or unauthorized activities within Entra ID that could be indicative of an attacker leveraging this flaw before it was patched. The goal is to identify any lingering signs of compromise.
Attackers gaining code execution could manipulate service principals and their credentials to maintain persistence.
AuditLogs
| where OperationName in (“Add service principal credentials”, “Add service principal”, “Update service principal”)
| where TimeGenerated > ago(XXd) // Adjust the time range as needed
| project TimeGenerated, OperationName, ActorDisplayName, TargetDisplayName, TargetResources, Result
| order by TimeGenerated desc
This query looks for the creation or modification of service principals and their credentials. A sudden surge or creation by a non-administrative user could be a sign of compromise. This is a critical area to monitor because persistence through service principals is a common attacker technique.
In Microsoft Entra ID audit logs, operations track the creation, modification, and credential management of service principals (the local instance of an application object in a specific tenant).
A new service principal object was created in your directory.
This happens when an application from the Microsoft Entra application gallery is added, an application is registered/instantiated in the tenant, or a managed identity is created.
A new authentication credential such as a password/secret or a public certificate was added to an existing service principal.
This is often logged as part of an Update service principal activity. Attackers frequently target this operation to maintain persistent, programmatic access to a compromised environment without needing a user account.
General properties or configurations of an existing service principal were modified.
This includes changing settings like assignment requirements, homepage URLs, owners, or enabling/disabling the service principal. It also frequently acts as the parent operation category when credentials or role assignments are added
Look for sign-in events with high risk levels or from unusual locations, especially from accounts with high privileges.
Find high-risk sign-ins or sign-ins from unfamiliar locations/IPs
SigninLogs
| where TimeGenerated > ago(XXd) // Adjust the time range as needed
| where RiskLevelDuringSignIn in (“high”, “medium”) // Adjust risk level as needed
| project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress, RiskLevelDuringSignIn, RiskEventTypes
| order by TimeGenerated desc
This query identifies sign-ins that Microsoft’s risk engine has flagged as high or medium risk. While the vulnerability itself is server-side, any successful exploitation could lead to token theft or account takeover for a specific user. Investigating these risky sign-ins can uncover such activity.
Check for any unauthorized or unusual changes to privileged roles, which could be the final stage of an attack to gain control.
Detect any new additions to highly privileged roles
AuditLogs
| where OperationName == “Add member to role”
| where TimeGenerated > ago(XXd) // Adjust the time range as needed
| extend Role = tostring(parse_json(TargetResources)[0].displayName)
| where Role in (“Global Administrator”, “Privileged Role Administrator”, “Exchange Administrator”, “Conditional Access Administrator”)
| project TimeGenerated, Role, TargetUser = tostring(parse_json(TargetResources)[0].modifiedProperties[1].newValue), Result
| order by TimeGenerated desc
This query specifically monitors for membership additions to high-privilege roles within the last XX days. Any unexpected addition to these roles is a significant red flag and should be investigated immediately.
Global Administrator: Has access to all administrative features and tenant-wide settings in Microsoft Entra ID.
Privileged Role Administrator: Can manage role assignments, audit logs, and role definitions in Microsoft Entra ID.
Conditional Access Administrator: Can manage Conditional Access policies and settings within Microsoft Entra ID.
Exchange Administrator: Can manage all aspects of the Exchange organization, available as an integrated role assignable through Microsoft Entra ID or the Exchange admin center.
If you’re reading this article, use the discount code CQBLOG_AMSC27_CVE at checkout – a special offer created exclusively for readers of this article. The code applies to our flagsihp course Advanced Microsoft Security Course, which takes place only once a year, and is valid until October 25, 2026. Take advantage of this exclusive opportunity and secure your spot.
Join our FREE live webinar:
Uncovering New Identity Theft Vectors and How to Mitigate Them
Discover how identity theft no longer begins and ends with a stolen password.
Paula Januszkiewicz (CEO of CQURE and CQURE Academy, Cybersecurity Expert & Red Teamer, Microsoft Regional Director, MVP, and MCT) will unveil new identity attack paths, including original research from the CQURE Team demonstrating how an attacker can move from endpoint access to cloud identity takeover, compromise sensitive user secrets, gain access to protected resources such as KeePass, and evade traditional EDR/XDR visibility.
Register for free: https://luma.com/TheftVectors
The post CVE-2026-69836 appeared first on CQURE Academy.
In the first half of 2026, nearly 36,000 CVEs were published. That’s a 49% jump from the year before. But here’s the twist that should change your entire security strategy: Fewer than 500 were actually exploited in the wild.
We have a massive vulnerability problem, but a much smaller action problem. The traditional model of treating every “Critical” CVSS score as a five-alarm fire is broken. It’s impossible to keep up, and frankly, it’s the wrong strategy.
Why CVSS Isn’t Enough?
A CVE might affect hundreds of assets, but the impact is rarely the same. A critical flaw on an isolated, air-gapped server is a very different beast than the same flaw on a public-facing, business-critical database.
CVSS gives you a generic severity baseline, but it cannot tell you:
If the asset is actually reachable?
If your existing security controls block the exploit?
If the business relies on that specific system to function?
You need evidence from your environment, not just a global score.
The New Standard.
To cut through the noise, leading security teams are moving toward a unified validation program. It’s not about replacing one tool; it’s about combining three distinct methods to get a definitive answer on what is actually exploitable.
Exploitability Validation: This determines if an exposure is real, even for CVEs with no public exploit yet. It covers the blind spots where you can’t safely run a live test (like on critical or restricted assets).
Security Control Validation: This shows whether your firewalls, EDR, and other defenses can actually stop the attack.
Agentic Pentesting: This safely runs real exploits to chain vulnerabilities together and show you exactly how far an attacker could move through your network.
Stop Chasing Ghosts.
The gap between disclosure and exploitation is narrowing. Attackers are using AI to speed up their process, and defenders need to match that speed with precision, not panic. The goal isn’t to patch everything. The goal is to validate what matters. By integrating exploitability checks, control validation, and automated pentesting into one workflow, you stop guessing and start making decisions based on evidence.
This article is based on: AI Changed the Exposure Problem. Validation Needs to Change With It., published by The Hacker News.
Read the original article on The Hacker News
If you’re reading this article, use the discount code CQBLOG_AMSC27_CVSS at checkout – a special offer created exclusively for readers of this article. The code applies to our flagsihp course Advanced Microsoft Security Course, which takes place only once a year, and is valid until October 25, 2026. Take advantage of this exclusive opportunity and secure your spot.
Join our FREE live webinar:
Uncovering New Identity Theft Vectors and How to Mitigate Them
Discover how identity theft no longer begins and ends with a stolen password.
Paula Januszkiewicz (CEO of CQURE and CQURE Academy, Cybersecurity Expert & Red Teamer, Microsoft Regional Director, MVP, and MCT) will unveil new identity attack paths, including original research from the CQURE Team demonstrating how an attacker can move from endpoint access to cloud identity takeover, compromise sensitive user secrets, gain access to protected resources such as KeePass, and evade traditional EDR/XDR visibility.
Register for free: https://luma.com/TheftVectors
The post The Problem of 35,800 Vulnerabilities: Why Your CVSS Score is Lying to You appeared first on CQURE Academy.
Conditional Access decides which device platforms it trusts based on the User-Agent, a value the client controls. Windows, Linux, iPhone all get blocked. So, we try something the policy never accounted for: Xbox Series X. The result is a Microsoft Graph access token, issued without ever triggering MFA.
With that token we go straight to Graph, enumerating users, groups and roles with GraphRunner, completely bypassing the portal restrictions. A custom script then scans directory objects for secrets and finds a clear-text password sitting in a group description. It belongs to a break-glass account with Global Administrator.
One policy gap and one badly stored secret, chained into a full tenant compromise.
Blocking the admin portal is not enough. Conditional Access has to cover the underlying APIs and token acquisition paths, security decisions must not rely on client-controlled signals like the User-Agent, MFA belongs on every sensitive path, and secrets must never live in directory attributes a standard user can read.
Join our FREE live webinar:
Close the Attack Visibility Gap: Detecting Defense Evasion and Reconstructing Attacks in Microsoft Environments
Discover how attackers create gaps in security visibility and how defenders can reconstruct what happened from fragmented evidence across Microsoft environments.
Paula Januszkiewicz and Amr Thabet will look at the challenge from both sides, from reconstructing attacks and finding the evidence attackers leave behind to understanding how modern defense evasion techniques can make malicious activity harder to detect.
Register for free: https://luma.com/uylurofs
Want to know more?
The post CQURE Hacks #82: Microsoft Entra ID Conditional Access Bypass via User-Agent Policy Gap appeared first on CQURE Academy.
Login