eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Previously Patched Fortinet Vulnerability (CVE-2025-59718) Exploited in the Wild
Bottom Line: Fortinet has confirmed that the initial security patches for CVE-2025-59718 are ineffective and exploitation against up-to-date devices is ongoing.
On January 22nd, Fortinet confirmed that security updates for CVE-2025-59718 (CVSS: 9.8), released in December 2025, did not fully mitigate the vulnerability. CVE-2025-59718 is an authentication bypass flaw affecting multiple Fortinet products, including FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager. The vulnerability was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on December 16, confirming active exploitation in the wild.
Foritnet’s statement followed reports from several Fortinet administrators on observation of exploitation on devices patched with December 2025 security updates, specifically devices running on FortiOS 7.4.9. In these incidents, administrators identified unauthorized logins via FortiCloud SSO, followed by the creation of rogue administrative accounts. The affected organizations confirmed that their systems had been patched as part of the December security update addressing CVE-2025-59718. Security researchers reported that the campaign focused on creating generic accounts to establish persistence, making configuration changes to grant VPN access to those accounts, and exfiltrating firewall configuration data. These observations mirror those seen during the exploitation of CVE-2025-59718 in December 2025.
Fortinet confirmed the reports and stated that it is developing a fix to fully remediate the issue which will be included in FortiOS 7.4.11, 7.6.6, and 8.0 releases. While no timeline was provided, the company will release an advisory once the update is ready. In its blog, Fortinet identified two user accounts involved in the malicious activity, cloud-noc@mail[.]io and cloud-init@mail[.]io as well as IP addresses used in the login events. Secondary administrator account usernames observed included ‘audit’, ‘backup’, ‘itadmin’, ‘secadmin’, and ‘support’. Fortinet also shared logs showing malicious events such as SSO logins and the creation of unauthorized administrator accounts.
As no security updates are available yet, organizations with vulnerable instances remain at high risk of exploitation. Until the relevant updates are released, organizations are recommended to disable FortiCloud SSO login feature, if enabled.
eSentire Threat Intelligence Analysis:
CVE-2025-59718 allows an unauthenticated attacker to bypass FortiCloud SSO login, granting access to an organization’s entire Fortinet network infrastructure. Recent exploitations have included post-compromise activities such as creating secondary administrator accounts for persistence and exfiltrating firewall configurations, giving attackers a full view of the network perimeter and potential weaknesses. This represents a severe threat, as successful exploitation lays the groundwork for future attacks.
While CISA added CVE-2025-59718 to its KEV catalog in December 2025, neither CISA nor Fortinet provided detailed technical information on its exploitation. Arctic Wolf (AW) had then published a report describing intrusions involving malicious SSO logins on Fortinet devices to exfiltrate configuration data. Similarities between past and recent activity suggest threat actors have developed a new exploit to bypass Fortinet’s patch. The post-exploitation actions occurred rapidly after initial login, indicating an automated attack. Although details on the automations used remain unclear, it is possible that attackers leveraged AI given the rise of AI-driven attacks. One example is Hexstrike-AI, which can direct more than 150 specialized AI agents to autonomously scan, exploit, and maintain persistence within target environments.
Fortinet notes that FortiCloud SSO login feature is not enabled by default on Fortinet devices. It is only enabled when a device is registered to FortiCare, unless the "Allow administrative login using FortiCloud SSO" option is manually disabled during registration. Fortinet recommends that organizations disable the FortiCloud SSO login feature, if it is enabled, until patches are made available. Also, organizations are advised to restrict administrative access to network devices via the Internet and regularly monitor network traffic to identify malicious activity.
eSentire MDR for Network can identify exploitation of CVE-2025-59718 and MDR for Log can detect behaviors associated with the exploitation of Fortinet devices. eSentire's Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to the flaw. The eSentire Threat Intelligence team published security advisories addressing exploitation of the flaw in December 2025 and January 2026.
Cisco Discloses Zero-Day Vulnerability (CVE-2026-20045)
Bottom Line: Cisco disclosed a zero-day Remote Code Execution (RCE) vulnerability impacting multiple products. Given the active exploitation, organizations are advised to apply relevant security patches immediately.
On January 21st, 2026, Cisco disclosed CVE-2026-20045, a zero-day unauthenticated Remote Code Execution (RCE) vulnerability, impacting the following products:
- Cisco Unified Communications Manager (Unified CM)
- Cisco Unified Communications Manager Session Management Edition (Unified CM SME)
- Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P)
- Cisco Unity Connection
- Cisco Webex Calling Dedicated Instance
CVE-2026-20045 (CVSS: 8.2) stems from improper validation of user-supplied input within HTTP requests, that can lead to the execution of arbitrary commands. Cisco has confirmed that patches are available for the impacted products to address the flaw, but that there are no other workarounds available to mitigate risk.
Exploitation of CVE-2026-20045 involves the use of specially crafted HTTP requests being sent to the web-based management interface of vulnerable devices. Successful exploitation of CVE-2026-20045 can lead to attackers achieving user-level access to the underlying Operating System of impacted devices, which can be used to elevate privileges to root, or deploy additional payloads. Cisco has also stated that they are “aware of attempted exploitation of this vulnerability in the wild”, but no additional information is shared. Also on January 21st, CISA added CVE-2026-20045 to its Known Exploited Vulnerabilities (KEV) catalog, signaling exploitation has been observed, and providing federal agencies with the deadline of February 11th, 2026, to apply relevant patches.
eSentire Threat Intelligence Analysis:
Cisco's advisory is vague around observed exploitation in the wild, where they state that “attempted exploitation” was identified, but does not specifically indicate if attacks were confirmed to be successful. CISA's addition of CVE-2026-20045 to the KEV is notable, as the Binding Operational Directive (BOD) 22-01 requires that there be “reliable evidence” that a vulnerability has been actively exploited in the wild, prior to its addition to the catalog. Similar with Cisco, CISA also does not provide any information on observed exploitation, but its addition to the KEV does suggest that they have credible evidence to back up their claim. So, while Cisco's advisory only outlines that “attempted exploitation” was identified, the addition to the KEV offers a strong indication that the vulnerability is being actively exploited in the wild, even if the specifics are not shared.
CVE-2026-20045 was assigned a CVSS score of 8.2, which assesses the severity as high. In their advisory, Cisco indicates that they assessed its severity as critical, due to attacks potentially leading to root privilege elevation. This difference in assessment is notable, as organizations are sometimes known to downplay severity, in likely attempts to protect reputation and minimize liability. A recent example of this is CVE-2025-54236, also known as SessionReaper, a pre-authenticated RCE in Magento, which was identified by researchers as being more critical than initially reported by Adobe in its advisory. Under reporting a vulnerability’s severity can have negative impacts, as organizations may not fully understand its risk, potentially causing a delay in mitigation. Cisco indicating that CVE-2026-20045 is more critical than labelled by its CVSS score highlights their transparency regarding the severity of the vulnerability and provides organizations with accurate information regarding potential impact.
At the time of writing, there is no Proof-of-Concept (PoC) exploit code available for CVE-2026-20045, which can often be an early signal of potential widespread exploitation. However, given reports of exploitation and the heightened severity provided by Cisco, organizations should ensure that relevant patches are applied as soon as possible. Cisco has released patches for versions 14 and 15 of the impacted applications, and states that for those running versions 12.5 for all the applications, they should “migrate to a fixed release”. Organizations should also restrict access to management interfaces using firewall rules, network segmentation, or Access Control Lists (ACLs) where feasible. eSentire's Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to CVE-2026-20045, and eSentire published an advisory for the flaw on January 22nd, 2026. eSentire's Threat Response Unit (TRU) continues to track this topic for additional information and detection opportunities.
PurpleBravo’s Targeting of the IT Software Supply Chain
Bottom Line: Campaigns conducted by the North Korean-linked threat group PurpleBravo overlap with the ongoing Contagious Interview campaign, using fake job lures to deliver Remote Access Trojans (RATs) and information stealer malware.
On January 21st, 2026, Recorded Future published a report on a North Korean state-sponsored threat actor group named PurpleBravo. The group’s activities overlap with the Contagious Interview campaign, targeting software developers via fake recruitment and use of malware seen in the campaign.
PurpleBravo relies heavily on social engineering to initiate contact with prospective victims. The group uses fabricated LinkedIn personas and professional identities, often claiming to be recruiters or developers affiliated with legitimate-sounding companies. In several observed cases, these personas claimed to represent organizations based in Ukraine, although the rationale for this geographic theme remains unclear. These personas typically present fraudulent job offers, practical coding challenges, and coding tasks hosted on GitHub, which contain obfuscated, malicious code that executes when trusted by the victim.
PurpleBravo’s toolset includes a combination of custom and open-source malware families designed to collect credentials, harvest session tokens, and maintain persistence:
- BeaverTail – A JavaScript-based infostealer and loader used to extract sensitive information from victim systems
- GolangGhost and PyLangGhost – Multi-platform Remote Access Trojans (RATs) that automate browser credential theft, session cookie harvesting, and arbitrary command execution across Windows, macOS, and Linux environments
- InvisibleFerret – A RAT with cross-platform capabilities that conducts reconnaissance, remote shell execution, data exfiltration, and persistent communications with Command-and-Control (C2) infrastructure
Network Intelligence data identified more than 3,100 unique IP addresses associated with likely targets between August 2024 and September 2025, with activity concentrated in South Asia and North America. Based on these network IPs, the group was observed targeting at least twenty potential victim organizations spanning sectors such as AI, cryptocurrency, financial services, IT services, marketing, and software development located in Europe, South Asia, the Middle East, and Central America.
eSentire Threat Intelligence Analysis:
PurpleBravo presents a high risk to organizations that rely on outsourced development, contractors, or globally distributed engineering teams. The campaign’s reliance on trusted user execution, combined with its focus on developer environments, makes it particularly effective at bypassing traditional security controls. This access enables threat actors to infiltrate organizations, harvest credentials and proprietary data, and exfiltrate sensitive information that can be monetized to support and fund operations linked to the Democratic People’s Republic of Korea (DPRK) regime.
The volume of infrastructure, number of observed targets, and multi-year persistence indicate that PurpleBravo has achieved operational success. The campaign scales easily because it relies on publicly available platforms such as LinkedIn and GitHub and uses reusable recruitment lures. PurpleBravo’s abuse of fake hiring workflows highlights how effective social engineering has become against technical professionals. Organizations are recommended to implement controls that restrict untrusted code execution on endpoints, monitor for anomalous GitHub, and enforce least-privilege access for development environments. Security teams should also provide targeted security awareness training for users on recruitment-based threats, deploy behavioral detections for credential and token abuse, and establish clear reporting pathways for suspicious outreach.
For additional reading on the malware commonly used by North Korean threat actors, please see the blogs published by eSentire's Threat Response Unit (TRU) on BeaverTail and InvisibleFerret. The TRU team spoke to the North Korean Remote IT Workers campaign in the May 2025 TRU Intelligence Briefing. eSentire's Threat Intelligence team continues to track campaigns linked to North Korean threat actors for additional information and detection opportunities.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
