eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
BlueHammer Windows Privilege Escalation Vulnerability
Bottom Line: Following frustration with Microsoft's private disclosure process, a researcher released Proof-of-Concept exploit code for an unpatched Windows privilege escalation vulnerability, dubbed BlueHammer.
On April 3rd, 2026, a security researcher operating under the aliases Chaotic Eclipse and Nightmare-Eclipse, released Proof-of-Concept (PoC) exploit code for a previously undisclosed Windows vulnerability. The vulnerability and exploit are currently tracked under the name BlueHammer. At the time of writing, an official CVE number has not been assigned, and Microsoft has not released security patches to address the flaw.
BlueHammer is a local privilege escalation vulnerability. It combines a time-of-check to time-of-use (TOCTOU) race condition and a path confusion weakness to grant access to the Windows Security Account Manager (SAM) database, which contains password hashes. In an attack scenario, a threat actor that had already gained initial access to a Windows device, could exploit the flaw to access the SAM database, and use the information therein to escalate their privileges to SYSTEM-level.
According to the original disclosure, the PoC exploit contains flaws. These flaws may prevent successful exploitation, but researchers have confirmed functionality, although reliability varies by Windows edition. Real-world attacks involving the exploit have not been publicly reported.
Nightmare-Eclipse indicated that the public release of PoC exploit code for an unpatched vulnerability is in response to how Microsoft chose to address the vulnerability. Specific details on the disagreement were not publicized, but the researcher stated “I'm just really wondering what was the math behind their decision, like you knew this was going to happen and you still did whatever you did? Are they serious?" In response, Microsoft claims that the company “has a customer commitment to investigate reported security issues and update impacted devices to protect customers as soon as possible. We also support coordinated vulnerability disclosure, a widely adopted industry practice that helps ensure issues are carefully investigated and addressed before public disclosure, supporting both customer protection and the security research community."
eSentire Threat Intelligence Analysis:
BlueHammer is concerning, as security patches to address the flaw are not available, and PoC exploit code significantly reduces the barriers to exploitation. The exploit has since been removed from Github, but was copied and remains available through alternative sources. The eSentire Threat Intelligence team assesses that real-world exploitation in the near future is probable. Early exploitation would likely involve previously compromised devices, which threat actors have maintained access too. Once a security patch is released, organizations should prioritize the patching of vulnerable devices. Microsoft may release more details or security patches as part of their standard Patch Tuesday cadence; the April Patch Tuesday release is planned for April 14th.
The absence of a patch shifts the defensive burden entirely to detection and access controls. The exploit holds no value, if initial access is prevented. As such, organizations are encouraged to implement best security practices and a defence-in-depth model, with multiple security layers. Network, Endpoint, and Log monitoring is critical for defence when known exploits exist without available security patches. While zero-day exploits may not be detected, associated malicious activity is identifiable through monitoring.
eSentire's Threat Response Unit (TRU) has performed research and detection evaluations for the BlueHammer exploit. The PoC exploit was tested and validated within a dedicated lab environment. Behavioural threat hunting was performed across the customer base, and new detections were created for eSentire MDR for Endpoint and Log. TRU continues to track this threat for additional details and detection opportunities.
Fortinet Discloses FortiClient EMS Zero-Day Vulnerability
Bottom Line: Fortinet has disclosed a critical improper access control vulnerability in FortiClient EMS, tracked as CVE-2026-35616, which can allow an attacker to execute unauthorized commands or code.
On April 4th, 2026, Fortinet disclosed a critical Remote Code Execution (RCE) vulnerability within its FortiClient Endpoint Management Server (EMS). The vulnerability, identified as CVE-2026-35616 (CVSS: 9.8), is an improper access control flaw and can enable an unauthenticated attacker to execute arbitrary commands on impacted devices via specially crafted requests. Out-of-band hotfixes were released to address the flaw within versions 7.4.5 and 7.4.6 of FortiClient EMS. Within their advisory, Fortinet confirmed that exploitation had been identified in the wild prior to patch release, officially classifying CVE-2026-35616 as a zero-day vulnerability.
FortiClient EMS is a security management solution, which centralizes control over FortiClient agents that are installed on endpoints within a customer's environment, allowing for software deployment, security policy enforcement, and VPN configuration and host compliance management. Successful exploitation of CVE-2026-35616 can allow an attacker to bypass authentication and authorization protections, resulting in device takeover, enabling endpoint configuration manipulation, malicious policy pushes, and lateral movement. Both Defused and watchTowr Labs have identified in-the-wild exploitation of CVE-2026-35616 prior to Fortinet's disclosure of the vulnerability. On April 6th, CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, giving Federal Civilian Executive Branch (FCEB) agencies a deadline of April 9th to ensure that relevant patches are applied.
eSentire Threat Intelligence Analysis:
Although CVE-2026-35616 was added to CISA's KEV, no details were shared on the observed exploitation of the flaw. Neither Defused nor watchTowr Labs shared any information on the identified attacks, so it is unclear if the vulnerability's addition to the KEV is based on these reports, or if further attacks have been identified. The short patch deadline of three days provided by CISA is notable, as it suggests they see the vulnerability as posing an immediate threat to FCEB agencies. Public Proof-of-Concept (PoC) exploit code for the vulnerability was identified shortly after its disclosure but has yet to be verified. If confirmed to be legitimate, the PoC exploit code could allow threat actors of all skill levels to adopt it and begin large-scale attacks, as public PoC availability is often an early indicator of widespread exploitation.
FortiClient EMS has a history of being targeted within attacks, due to the critical nature of the appliance. In February 2026, Fortinet disclosed an SQL injection vulnerability, CVE-2026-21643 (CVSS: 9.8), within FortiClient EMS version 7.4.4, which they also confirmed was under active exploitation prior to the patch release. Another example is CVE-2023-48788 (CVSS: 9.8), where exploitation was identified shortly after PoC exploit code release, including in ransomware attacks. Regarding CVE-2026-35616, given the critical nature of the flaw, history of FortiClient EMS vulnerabilities being leveraged in attacks, and reports of ongoing exploitation, impacted organizations should ensure that relevant patches are applied as soon as possible.
eSentire's Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to CVE-2026-35616, and eSentire MDR for Network has detections in place to identify exploitation of the flaw. eSentire's Threat Intelligence team continues to track CVE-2026-35616 for additional information and detection opportunities.
U.S. Critical Infrastructure Targeted by Iranian Threat Actors
Bottom Line: U.S. government agencies have released a joint report, warning that Iranian-affiliated threat actors are targeting U.S. critical infrastructure, with attacks causing financial loss, data theft, and disruption.
On April 7th, 2026, the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Environmental Protection Agency (EPA), Department of Energy (DOE), and United States (US) Cyber Command’s Cyber National Mission Force (CNMF) issued a joint advisory warning of an ongoing cyber campaign targeting U.S. Critical Infrastructure (CI). The advisory indicates that Iran-linked threat actors have been compromising Internet-exposed Programmable Logic Controllers (PLCs) across sectors including government facilities and services, Water and Wastewater Systems (WWS), and energy, leading to operational disruptions and financial losses.
The activity has been observed since at least March 2026. The threat actors used overseas IP addresses to access PLCs manufactured by Rockwell Automation/Allen-Bradley and leveraged third-party infrastructure to host tools such as Rockwell Automation’s Studio 5000 Logix Designer for communication with these devices. They exploited CVE-2021-22681, an authentication bypass vulnerability in Rockwell Automation Logix Controllers, which enabled unauthorized access. They further deployed Dropbear Secure Shell (SSH) on compromised systems to establish Command-and-Control (C2) channels. After gaining access, the attackers extracted and modified device project files, enabling manipulation of data displayed on Human Machine Interface (HMI) and Supervisory Control and Data Acquisition (SCADA) systems.
eSentire Threat Intelligence Analysis:
Targeting publicly accessible PLC instances provides threat actors with a straightforward entry point into Operational Technology (OT) networks, which are essential for the control and management of CI sectors. These sectors have been targeted with the intent to disrupt operations and exfiltrate sensitive information, with such activity often increasing during periods of geopolitical tension.
While the joint advisory does not attribute the current campaign to a specific threat actor, it references a similar operation conducted in November 2023 by the Iran-linked group CyberAv3ngers (also known as Storm-078, UNC5691, and Hydro Kitten), which targeted U.S.-based PLCs and HMIs. Previous operations by this group indicate a pattern of targeting accessible critical assets and deploying malware to facilitate potential future attacks, a tactic also reflected in the current activity. The recent campaign is likely linked to ongoing tensions involving the U.S., Israel, and Iran.
The Center for Strategic and International Studies (CSIS) assesses that the conditional ceasefire in the ongoing conflict is shifting Iran away from conventional military engagement toward greater reliance on hybrid tactics, including cyber operations targeting countries involved in the conflict. Iran-linked threat actors ranging from state-sponsored advanced persistent threat (APT) groups such as MuddyWater to hacktivist groups like Handala Hack have been actively conducting attacks against critical infrastructure, businesses, and government organizations in the U.S., Canada, and the United Kingdom. Given Iran’s demonstrated reliance on cyber operations, such activity is likely to persist. CSIS further highlights that Iran appears to be adopting a more sustained and coordinated approach to targeting CI sectors, likely due to their importance to national stability, thereby increasing the risk to misconfigured and vulnerable OT networks.
Internet-exposed OT devices should be treated as the highest priority for remediation. PLCs should be disconnected from the internet if external access is not necessary or otherwise secured behind a firewall. It is also essential to ensure that all associated software is fully patched and up to date. Although the reported incidents involved Rockwell Automation and Allen-Bradley PLCs, devices from other vendors may also be at risk. Organizations are advised to follow manufacturer guidance to strengthen OT security.
The eSentire Threat Intelligence team continues to monitor activity associated with Iranian threat actors. eSentire’s Threat Response Unit (TRU) will address the evolving threat posed by Iranian state-sponsored APT groups, along with detection coverage within eSentire’s MDR Suite for tools and vulnerabilities exploited by these actors, in the TRU Intelligence Briefing scheduled for April 14th, 2026.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
