eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Actively Exploited Adobe Vulnerability Patched
Bottom Line: Threat actors have targeted an Adobe Acrobat Reader zero-day vulnerability (CVE-2026-34621), initially disclosed on April 7th. Public statements indicate that real-world attacks have been ongoing since at least November 2025.
On April 11th, 2026, Adobe published a security advisory addressing a zero day vulnerability affecting multiple versions of Adobe Acrobat and Adobe Acrobat Reader. The vulnerability is tracked as CVE-2026-34621 and has a CVSS score of 8.6. The vulnerability allows for arbitrary command execution and requires user interaction, specifically the opening of a maliciously crafted PDF file.
Security researcher from EXPMON disclosed that the vulnerability was observed being exploited in the wild as early as December 2025, with additional forensic artifacts indicating exploitation activity dating back to November 2025. According to the report, the malicious PDF document contains embedded JavaScript code that executes automatically within the Acrobat Reader environment. This execution enables attackers to collect system and application level information from the victim’s device, including the installed Acrobat Reader version. The harvested information is transmitted to an attacker controlled Command and Control (C2) server, which subsequently responds with additional JavaScript payloads designed to perform advanced fingerprinting of the affected system. In later stages of exploitation, attackers may deploy further exploits that could result in Remote Code Execution and potential sandbox escape.
The vulnerability affects multiple Adobe products and versions. Impacted versions include Adobe Acrobat DC and Adobe Acrobat Reader DC version 26.001.21367 and earlier, as well as Adobe Acrobat 2024 version 24.001.30356 and earlier.
eSentire Threat Intelligence Analysis:
Given the widespread use of Adobe Acrobat Reader across enterprise environments, exploitation of this vulnerability poses a high risk of initial access for broader intrusion campaigns, including malware delivery, credential theft, or lateral movement within corporate networks. Adobe’s advisory notes that the CVSS score for CVE-2026-34621 was adjusted from 9.6 to 8.6, suggesting a re-evaluation of the flaw. Despite revisions to the vulnerability’s severity score, confirmed realworld exploitation and the potential for arbitrary command execution justify immediate remediation efforts.
Adobe has released patches to remediate CVE-2026-34621. Organizations are advised to conduct a business impact assessment and apply the relevant Adobe security patches immediately. Until patching is complete, all PDF files originating from untrusted or unknown sources should be treated as potentially malicious. Disabling or restricting JavaScript execution within PDF readers, where operationally feasible, can significantly reduce exposure to this attack vector. Security teams should also reinforce user awareness through phishing and security training, emphasizing the risks associated with opening unsolicited or unexpected PDF attachments. These measures, combined with continuous monitoring, can help mitigate the risk posed by this vulnerability.
In response to the disclosure, eSentire’s Threat Response Unit (TRU) has published an advisory on April 13th, 2026. The team has implemented new detections within eSentire MDR for Network in response to this threat. In addition, eSentire’s Managed Vulnerability Service (MVS) has plugins to identify devices vulnerable to CVE-2026-34621. Known Indicators of Compromise (IoCs) have been added to eSentire’s Threat Intelligence Platform (TIP) and are available to Threat Feed subscribers, while identified malicious infrastructure has been incorporated into eSentire’s Global Block List to protect MDR for Network customers.
Nginx-ui Authentication Bypass Vulnerability
Bottom Line: A critical vulnerability (CVE-2026-33032) impacting the web-based management tool, Nginx-ui, has been under active exploitation since March 2026. Impacted organizations should ensure that relevant patches are applied immediately.
On April 15th, 2026, Pluto Security released their research on CVE-2026-33032, a vulnerability in Nginx-ui which could allow an attacker to take control of vulnerable nginx instances. Along with technical details, it is now confirmed that threat actors are actively exploiting CVE-2026-33032 in real-world attacks.
Nginx-ui is a web-based interface designed for managing Nginx servers. It allows users to access Nginx logs, edit and reload server configuration files, and manage SSL certificates, among other administrative functions. CVE-2026-33032 (CVSS: 9.8) is an authentication bypass vulnerability due to missing authentication middleware in nginx-ui. The flaw resides in Nginx-ui's Model Context Protocol (MCP); the mcp_message endpoint lacks proper authentication checks, and when combined with an IP whitelist which is empty by default, results in a fail-open state. Successful exploitation would enable threat actors in the network to gain complete control over the Ngnix service.
According to Pluto Security, VulnCheck added CVE-2026-33032 to its Known Exploited Vulnerabilities list, and Recorded Future's Insikt Group identified it as one of 31 high-impact CVEs actively exploited in March 2026, assigning it a Risk Score of 94 out of 100. Details on actual attacks, such as actions on objectives and associated threat actors, have not been publicized at the time of writing.
eSentire Threat Intelligence Analysis:
Security patches to address CVE-2026-33032 were released in mid-March. It is critical that organizations update Ngnix-ui to versions 2.3.4 or later immediately, to reduce the likelihood of impact. The availability of Proof-of-Concept (PoC) exploit code and technical details simplifies the attack process for threat actors. While attacks have already been confirmed, this availability may result in an increase of threat actors adopting and widely exploiting the vulnerability. If immediate patching is not feasible, organizations should disable MCP in the meantime.
In response to confirmed active exploitation of CVE-2026-33032, eSentire published a security advisory, which included eSentire actions and customer recommendations. New eSentire MDR for Network detections were created to identify exploitation attempts, and eSentire’s Managed Vulnerability Service (MVS) has plugins in place to detect vulnerable devices.
Payouts King Ransomware Group Conducting Email Bombing Attacks
Bottom Line: Former affiliates of the Black Basta ransomware group, now under the moniker Payouts King, are conducting email bombing attacks to steal data and deploy ransomware.
On April 16th, 2026, Zscaler ThreatLabz published a report on the Payouts King ransomware group, which was first identified in April 2025. The group has been linked to former affiliates of the Black Basta ransomware group, and have continued to utilize the Tactics, Techniques, and Procedures (TTPs) previously associated with the group to conduct data theft and deploy ransomware. These techniques include the usage of email bombing attacks, followed by the impersonation of IT Support members through voice phishing (vishing) to trick users into granting remote access to their devices using Microsoft Teams and Quick Assist. Once access is gained, the threat actors deploy malware to the impacted host, which is used to establish persistence to the network, followed by lateral movement and post-exploitation activity.
Prior to this report, ReliaQuest identified a spike in Teams-based phishing between January 2026 and April 2026, which they attributed to former Black Basta affiliate members, based on the observed TTPs. ReliaQuest highlights that 56% of Teams-based phishing detected since early 2025 occurred in 2026, with 32% of cases occurring in March 2026 alone. The campaign appears to be targeting a high volume of senior-level employees within the manufacturing and Professional, Scientific, and Technical Services (PSTS) industries, but attacks are also being conducted against other industries and lower-level users as well. ReliaQuest suggests that automation was implemented within the attacks, as phishing messages over Teams were sent to multiple users within less than a minute. While ransomware deployment was not identified within the reviewed cases, the observed techniques were “consistent with pre-ransomware staging”.
eSentire Threat Intelligence Analysis:
ReliaQuest indicates that no ransomware deployment was identified within the investigated cases and does not mention the Payouts King ransomware group. The similarities between the activity identified by ReliaQuest and ThreatLabz suggest that they may be part of the same campaign, as both were attributed to former Black Basta affiliates and were ongoing at the same time, but this is not confirmed. Black Basta was a Ransomware-as-a-Service (RaaS) operation that was active from 2022 to 2025, created by former members of the Conti ransomware group following its collapse in 2022. In February 2025, Black Basta disbanded following internal chat logs leaking online and group conflict. The formation of Payouts King following Black Basta's downfall highlights the continued trend of ransomware operators rebranding under new names and continuing their attacks.
The continued usage of TTPs previously associated with the Black Basta ransomware group suggests that Payouts King continue to use them due to their success rates. The notion that the attacks are automated is likely done by the threat actors to increase the number of users that are impacted, to improve their chances of success. Statistics raised by ReliaQuest suggest a recent spike in Microsoft Teams-based phishing attacks, with the majority of attacks identified in the first few months of 2026. eSentire's Threat Intelligence team has identified similar trends, observing a notable increase in these types of attacks so far in 2026, when compared to the technique's usage in 2025, but have not attributed these incidents to any threat group or actor.
To protect against these threats, organizations should restrict the usage of Remote Monitoring and Management (RMM) tools that are not legitimately used within their environments, as threat actors are known to abuse these tools to establish persistent access and perform lateral movement. Organizations should also restrict external messages and calls within Microsoft Teams, if not required for legitimate business operations, to prevent threat actors from being able to contact users via this method. Policies regarding how internal support and help desk teams should also be established and reinforced, enabling users to quickly identify and report impersonation attempts. eSentire's MDR Suite has detections in place to identify email bombing, malicious Microsoft Teams messages from external senders, and ransomware activity. eSentire's Threat Intelligence team continues to track this topic for additional information and detection opportunities.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
