eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Critical Zero-Day Vulnerability Disclosed in Cisco Catalyst Products
Bottom Line: Cisco disclosed a critical zero-day (CVE-2026-20127) affecting Catalyst SD-WAN Controller and Manager. Limited exploitation has been observed, with evidence tracing malicious activity back to 2023 and attributed to the sophisticated threat actor UAT-8616.
On February 25th, 2026, Cisco published an advisory regarding a zero-day authentication bypass vulnerability that impacts Cisco Catalyst SD-WAN Controller (formerly SD-WAN vSmart) and Cisco Catalyst SD-WAN Manager (formerly SD-WAN vManage) products. The vulnerability tracked as CVE-2026-20127 (CVSS: 10) can enable attackers to obtain administrative privileges on impacted systems. Cisco states that they are aware of “limited exploitation” of the vulnerability, which was reported to them by the Australian Signals Directorate's (ASD) Australian Cyber Security Centre (ACSC).
CVE-2026-20127 is specifically related to the peering authentication mechanism within both SD-WAN Controller and SD-WAN Manager, due to this mechanism “not working properly”. Successful exploitation of the flaw would involve threat actors sending specially crafted requests to impacted systems, resulting in an attacker being able to log in as an “internal, high-privileged, non-root user account”. Cisco has released patches to address the vulnerability, while confirming that there are no workarounds available. Along with the vulnerability disclosure, Cisco Talos published a report providing additional information on exploitation of the vulnerability, which they link to the group UAT-8616, and indicate has been ongoing for “at least three years", dating back to 2023.
The ASD's ACSC published their own findings regarding the observed attacks, which they state was abused to allow an attacker to “add a rogue peer to the Cisco SD-WAN management and control plane”; a rogue peer is an “an actor controlled, unauthorised, now trusted peer on the SD-WAN network management system”. The attacker used this access to downgrade the SD-WAN Controller to a previous version vulnerable to a privilege escalation flaw, tracked as CVE-2022-20775, which was used to elevate privileges to root. Following this exploitation, the threat actor upgraded the SD-WAN Controller back to its previous version, created local accounts for persistence, and moved laterally within the SD-WAN environment using the Network Configuration Protocol (NETCONF) and SSH. The threat actor also cleared system logs and command history, and disabled logging on the SD-WAN to cover their tracks.
eSentire Threat Intelligence Analysis:
Cisco Talos links the attacks relating to exploitation of CVE-2026-20127 to UAT-8616, which they describe with high confidence as a “highly sophisticated cyber threat actor”. Cisco Talos also highlights the continued trend of threat actors targeting edge devices as a means for initial access to “establish persistent footholds” within target environments, specifically highlighting organizations in the Critical Infrastructure sector. The ASD's ACSC report notes indicates that no “malware was discovered" during the investigation into these attacks. While Cisco does not provide specific attribution for UAT-8616 or organizations targeted within the observed attacks, exploiting a zero-day vulnerability for years before its discovery to maintain long-term persistence in target environments has been identified as a hallmark of APT activity.
Following Cisco's disclosure, the United States' Cybersecurity and Infrastructure Agency (CISA) added both CVE-2026-20127 and CVE-2022-20775 to its Known Exploited Vulnerabilities (KEV) catalog. CISA also released an Emergency Directive requiring that Federal Civilian Executive Branch (FCEB) agencies provide an inventory of SD-WAN systems to CISA and collect relevant logs by February 26th, and ensure that patches to address CVE-2026-20127 are applied by February 27th. CISA does not provide any additional context on the reported attacks, only stating that the vulnerability “presents an imminent threat to federal networks using Cisco SD-WAN systems”, adding further speculation that the flaw was being operationalized by a possible APT group for cyber-espionage.
Cisco provides temporary mitigations for organizations to implement until patching is possible, which include restricting access of On-Premises SD-WAN deployments using Access Control Lists (ACLs), security group rules, and firewall rules to only known IP addresses. Cisco indicates that these guardrails are already in place for Cisco Hosted SD-WAN Cloud, Cisco Hosted SD-WAN Cloud - Cisco Managed, and Cisco Hosted SD-WAN Cloud - FedRAMP Environment deployments. Organizations are also provided guidance on reviewing relevant logs for suspicious connections, with Cisco stating that customers can open a case with the Cisco Technical Assistance Center (TAC) for further assistance in determining if a device has been impacted. eSentire's Managed Vulnerability Service (MVS) has plugins in place to identify devices that are vulnerable to CVE-2026-20127, and eSentire published an advisory for the vulnerability on February 25th, 2026. eSentire's Threat Intelligence team is continuing to track this topic for additional information and detection opportunities.
Lazarus Group Working with Medusa Ransomware
Bottom Line: Reports have emerged that North Korean-linked threat actors are deploying Medusa ransomware within data extortion attacks against the healthcare and non-profit sectors in the United States.
On February 24th, 2026, researchers from Symantec and the Carbon Black Threat Hunter Team disclosed that North Korean state-sponsored threat actors (Lazarus Group) have incorporated the Medusa ransomware platform into their ongoing cyber operations. Historically, North Korea has relied on ransomware families, such as Maui and Play, to conduct financially motivated and disruptive attacks. During these campaigns, the threat actors compromised an organization in the Middle East and attempted, though unsuccessfully, to carry out an intrusion against a healthcare provider in the United States.
Medusa, operated by the Spearwing cybercrime group, functions as a Ransomware‑as‑a‑Service (RaaS) platform, with more than 366 claimed attacks since its introduction in 2023. Analysis of its leak site identifies multiple U.S. healthcare and non‑profit victims since November 2025, with an average ransom demand of $260,000. Symantec emphasizes the uncertainty about whether all these attacks were executed by North Korean actors or if other groups were also involved.
The campaigns leveraged a combination of custom malware and publicly available offensive security tools. Observed tooling included Comebacker, a custom backdoor and loader malware; Blindingcan, a Remote Access Trojan; ChromeStealer, an open-source password-stealing tool; Curl, an open-source command-line data transfer utility; Infohook, an information-stealing malware; Mimikatz, an open-source credential-dumping tool; and RP_Proxy, a custom proxying tool used to facilitate covert network communications.
eSentire Threat Intelligence Analysis:
The report provides an overview of the history of extortion conducted by North Korean threat actor groups. A key actor behind North Korea’s transition into ransomware-driven extortion is the Lazarus Group sub-unit known as Stonefly (also referred to as Andariel). Previously recognized primarily for espionage campaigns targeting strategic and high-value entities, the group broadened its operational scope several years ago to include financially motivated ransomware attacks. The United States Department of Justice announced charges against an alleged North Korean operative accused of conducting ransomware operations against healthcare organizations in the United States. The individual was described as being affiliated with Stonefly, a unit associated with North Korea’s military intelligence agency, the Reconnaissance General Bureau (RGB). Authorities indicated that funds generated from ransomware campaigns were allegedly redirected to support broader intelligence activities. Additionally, research from Unit 42 highlighted indications of collaboration between Stonefly and the Play ransomware group, underscoring the increasing overlap between state-aligned actors and criminal ransomware enterprises.
The Lazarus Group’s decision to incorporate the Medusa ransomware platform underscores North Korea’s increasing willingness to collaborate with established criminal ransomware ecosystems. This behavior reflects the regime’s ongoing need to generate revenue despite international sanctions and mirrors a broader pattern of state-sponsored cybercrime intended to finance intelligence and military operations. To mitigate this threat, organizations should ensure that Endpoint Detection and Response (EDR) solutions are deployed on all assets. Given that Medusa operates on a double‑extortion model and routinely exfiltrates data before encryption, organizations should deploy controls that monitor for large outbound data transfers and the use of unauthorized data transfer tools. Maintaining offline, immutable backups and regularly testing restoration procedures remains essential for resilience against destructive attacks.
As ransomware incidents increasingly combine file encryption with data theft to maximize pressure on victims, incident response teams should practice/rehearse scenarios that address data‑leak extortion, negotiation considerations, and crisis communication strategies. Finally, organizations should review and harden third‑party access pathways, assess vendor security practices, and reduce unnecessary exposure within technical support channels, as these areas continue to represent attractive vectors for ransomware affiliates and state‑aligned threat actors.
Disrupting the GRIDTIDE Global Cyber Espionage Campaign
Bottom Line: Google Threat Intelligence Group and Mandiant, along with various partners, disrupted a global cyber-espionage campaign linked to the Chinese APT UNC2814, which was identified to have impacted government and telecommunications organizations across at least 42 different countries.
On February 25th, 2026, Google’s Threat Intelligence Group (GTIG) and Mandiant disclosed a long-standing cyber espionage campaign that has impacted dozens of organizations across four continents. This activity has been attributed to UNC2814, a previously undisclosed threat group associated with the People’s Republic of China (PRC). GTIG, Mandiant, and various partners coordinated to disrupt the campaign, prior to its public disclosure.
The initial access vector for recent attacks was not identified, but GTIG notes that “UNC2814 has a history of gaining entry by exploiting and compromising web servers and edge systems”. Once inside a network, a novel backdoor named GRIDTIDE was deployed for persistent access. Notably, GRIDTIDE uses Google Sheets API as a covert Command-and-Control (C2) channel, treating spreadsheets not as documents but as communication pipes. Data exfiltration was not identified in attacks, but malware was deployed on systems that contained Personally Identifiable Information (PII).
GTIG does not state how long this campaign has been running, but UNC2814 has operated since at least 2017, and infrastructure observed in the campaign has been used by the group since 2018. In total, 53 separate victims were identified across 42 countries. Suspected but unconfirmed infections were observed in an additional 20 countries. Attacks specifically targeted international governments and global telecommunications organizations across Africa, Asia, and the Americas.
Infrastructure associated with the campaign has now been disrupted by GTIG and partners. Disruption actions taken by Google include:
- Terminating attacker-controlled Google Cloud Projects
- Disabling UNC2814 infrastructure
- Disabling accounts/revoking access to the Google Sheets API
eSentire Threat Intelligence Analysis:
The scale of this campaign is large, spanning dozens of countries and potentially running for multiple years prior to discovery. The sophistication and targeting are in-line with past campaigns attributed to PRC affiliated threat groups. Threat actors such as Volt Typhoon and Salt Typhoon, which have been directly attributed to China, are known to target telecommunication organizations due to the large amounts of customer data that they store. Targeted intrusions may allow for bulk data theft, or as is more likely in the recent campaign based on the lack of data exfiltration, the theft of targeted information for high-value persons.
The GRIDTIDE malware was notable due to its use of Google Sheets as a C2 channel. This rendered traditional network detections ineffective, as no unusual ports or domains were employed. Additionally, Google is trusted cloud infrastructure, which effectively hides the malicious actions from defenders. While abuse of Cloud services is not new, the publication of this report and information on GRIDTIDE may result in adoption of the technique by other threat actor groups.
According to Google, this campaign was “the result of years of focused effort and will not be easily re-established". It is almost certain that UNC2814 will continue to carry out cyberattacks to support PRC strategic goals. This disruption will force the actor to spend time and resources building new infrastructure and developing alternative tooling. Additionally, it is highly probable that other PRC actors are already or will carry out separate campaigns targeting telecommunication organizations.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
