eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Xinference PyPI Package Compromised
Bottom Line: The xinference PyPI package was compromised in a supplychain attack, with trojanized releases executing malicious code to harvest and exfiltrate sensitive credentials. While the tradecraft mirrors the TeamPCP campaign, the actor has publicly denied involvement, claiming the attack may be a copycat.
On April 22nd, 2026, JFrog's security research team disclosed that the Python Package Index (PyPI) package xinference, a widely used open-source framework for running AI inference models, was compromised. The attack resulted in the publication of trojanized versions 2.6.0, 2.6.1, and 2.6.2, which executed malicious code immediately upon import.
This attack did not involve a fake or typosquatted package. Instead, the threat actor successfully hijacked the legitimate xinference release pipeline and injected malicious code directly into official package versions published on PyPI.
The malicious logic is embedded in the package’s initialization file, ensuring that the payload executes automatically upon import. Upon execution, the malicious code decodes a base64-encoded payload and launches it in a detached Python subprocess. The payload then proceeds through a two-stage execution flow that focuses on reconnaissance, credential harvesting, and data exfiltration.
The first stage functions as a wrapper responsible for orchestration and exfiltration. It creates a temporary working directory, decodes a second embedded payload, and pipes it into another Python interpreter through standard input. The output of this second-stage payload is captured into a temporary file and compressed into an archive. This archive is then exfiltrated to attacker-controlled C2 infrastructure.
The second stage is responsible for host reconnaissance and extensive credential collection. It begins by profiling the infected system, collecting information such as hostname, current user, working directory, kernel version, network configuration, and environment variables. The malware then systematically searches the filesystem for sensitive files commonly present on Linux servers, cloud virtual machines, CI/CD runners, Kubernetes nodes, and AI inference hosts. All collected information is written to standard output, which is subsequently packaged and exfiltrated by the first stage.
The malware contains logic specifically designed to target cloud environments with a focus on extracting sensitive information from the AWS platform.
At the time of publication, JFrog Security Research team linked the incident to TeamPCP, a threat actor previously associated with supply chain compromises across multiple ecosystems. Although, since then, TeamPCP has publicly denied responsibility and suggested a copycat operation.
eSentire Threat Intelligence Analysis:
The sustained targeting of PyPI packages by threat actors reflects a broader strategic shift in supply chain attacks toward high-value, credential-rich AI and cloud development environments. A single compromised AI development dependency can expose cloud provider keys, model API tokens, and internal service credentials simultaneously, amplifying the blast radius well beyond a typical developer workstation compromise.
Although TeamPCP publicly denied involvement in the xinference incident, the past week has seen multiple supply chain attacks consistent with the group’s established tradecraft, all involving the deployment of credentialstealing malware. Socket researchers reported two concurrent npm supply chain incidents; the Bitwarden CLI compromise linked to the Checkmarx campaign and CanisterWorm-style malware in Namastex.ai packages, both targeting developer credential stores and CI/CD pipeline secrets. In March 2026, TeamPCP conducted a multistage supply chain campaign that progressed across several widely used projects, including Trivy, KICS, LiteLLM, and Telnyx. TeamPCP’s financial motivations are further supported by their recent collaboration with the ransomware group Vect. Additional reporting indicates that TeamPCP may also maintain ties with the LAPSUS$ extortion group. The notoriety that TeamPCP has generated may have resulted in copy-cat activity, where other threat actors use the group’s name to add credibility to their operation or obscure accurate attribution.
Taken together, the convergence of repeatable tradecraft across PyPI and npm ecosystems, explicit code reuse between campaigns, and emerging partnerships with ransomware and extortion groups strongly suggests a deliberate strategy to scale initial access through trusted software dependencies. As dependency driven development continues to expand across AI and cloud environments, campaigns such as these demonstrate how supply chain attacks are being refined into a reliable access vector capable of enabling largescale credential abuse and downstream compromise.
Organizations using xinference are advised to immediately audit installed package versions and rotate any credentials that were present in affected environments. Any system that installed or imported the impacted xinference versions should be treated as fully compromised, as credential exfiltration occurs automatically at import time. The eSentire Threat Intelligence team has conducted threat hunts across customer endpoints and is tracking this topic for additional information and detection opportunities. The team has previously documented TeamPCP activity in the Weekly Threat Briefing - March 23–27 and has discussed direct observations in the April 2026 TRU Intelligence Briefing.
FIRESTARTER Backdoor Impacts Cisco Firepower Devices
Bottom Line: CISA, UK-NCSC and Cisco Talos have released new information on a previously unidentified malware dubbed FIRESTARTER, tied to the state-sponsored campaign ArcaneDoor. This malware was used to maintain access to patched devices.
On April 23rd, 2026, Cisco Talos published both an advisory and a report on a newly identified backdoor malware, dubbed FIRESTARTER, designed to provide persistent access to Cisco Firepower and Secure Firewall devices running Adaptive Security Appliance (ASA) or Firepower Threat Defense (FTD). The malware has been linked to the long running ArcaneDoor campaign, attributed to a suspected APT group tracked as UAT-4356. Along with Cisco's release, CISA and the UK-NCSC published a joint malware report on FIRESTARTER, indicating that the malware has gone undetected on compromised devices since September 2025.
Both CISA and Cisco indicate that the deployment of FIRESTARTER has been traced back to the exploitation of two zero-day vulnerabilities impacting Cisco Secure Firewall ASA and FTD appliances, CVE-2025-20333 (CVSS: 9.9) and CVE-2025-20362 (CVSS: 6.5). The vulnerabilities were initially disclosed in September 2025, and linked to the ArcaneDoor campaign, where the LINE VIPER malware was deployed as a “post-exploitation implant”. The FIRESTARTER backdoor was later uncovered, which was assessed to have been deployed as a persistence mechanism along with LINE VIPER within the ArcaneDoor campaign. CISA identified that in March 2026, threat actors used FIRESTARTER to “regain access” to a compromised device and deploy LINE VIPER.
FIRESTARTER is an ELF binary that provides attackers with remote access and the ability to execute arbitrary code within the LINA process, a core component of Cisco Firepower eXtensible Operating System (FXOS) in Cisco Secure Firewall ASA and FTD devices. The FIRESTARTER malware can survive reboots and patches, indicating that UAT-4356 has been able to maintain persistence on patched appliances, enabling re-access to compromised systems. To ensure that FIRESTARTER is removed, Cisco recommends reimaging and upgrading impacted devices, and reconfiguring and regenerating “all configuration elements”, such as local passwords, certificates, and keys. If immediate reimaging is not possible, Cisco states that a cold restart (disconnecting power) can remove FIRESTARTER, but that this method can “risk database or disk corruption”, so reimaging is strongly encouraged.
eSentire Threat Intelligence Analysis:
ArcaneDoor is campaign that was identified by Cisco in April 2024, with the goal of performing espionage-focused attacks. Cisco did not attribute ArcaneDoor to any known threat actor group or country and identifies the attacker as UAT-4356. The group is tracked as Storm-1849 by Microsoft, who has linked the threat actor to China, but this has not been corroborated by Cisco within their reporting on the campaign. In 2024, the ArcaneDoor campaign involved the exploitation of vulnerabilities within Cisco ASA and FTP appliances, tracked as CVE-2024-20353 (CVSS: 8.6) and CVE-2024-20359 (CVSS: 6.0), to deploy the LINE RUNNER and LINE DANCER malware. In September 2025, Cisco linked the exploitation of the zero-day vulnerabilities CVE-2025-20333 and CVE-2025-20362 to the ArcaneDoor campaign as well.
The FIRESTARTER backdoor is notable as it went undiscovered since September 2025, and enabled threat actors to re-establish access to devices that were previously believed to have been mitigated through patching. As per the findings by CISA and Cisco, FIRESTARTER persists after patching and reboots, and must be removed through a reimage or cold reboot, although this method could negatively impact the device. In response to the FIRESTARTER discovery, CISA is mandating that all Federal Civilian Executive Branch (FCEB) agencies that utilize the impacted Cisco Firepower and Secure Firewall devices provide a core dump by 11:59 pm EST on April 24th, 2026, to determine if devices have been impacted. The small timeframe for providing this data underscores the critical nature of this threat, given the type of data that threat actors may have access to and potential dwell time of attackers.
Organizations that utilize the impacted products should follow Cisco's recommendations of reimaging and reconfiguring devices as soon as possible, to mitigate the possible continued risk posed by FIRESTARTER. eSentire MDR for Network has detections in place monitoring for traffic relating to LINE VIPER, along with exploitation attempts against CVE-2025-20333 and CVE-2025-20362. Additionally, eSentire's Managed Vulnerability Service (MVS) has plugins in place to identify devices that are vulnerable to CVE-2025-20333 and CVE-2025-20362. eSentire's Threat Intelligence team published advisories in April 2024 and September 2025 on the vulnerabilities associated with the ArcaneDoor campaign. eSentire's Threat Response Unit (TRU) is continuing to track this topic for additional information and detection opportunities.
Joint Report on China-Nexus Covert Networks
Bottom Line: China-nexus APT groups have industrialized their infrastructure model, creating persistent covert networks that are difficult to attribute and disrupt, and are designed to endure beyond the detection of any single intrusion.
This week, the Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with 14 government and law enforcement agencies from nine countries, released a joint advisory detailing covert networks employed by Chinese state-affiliated APT groups to hide malicious activity. Similar to botnets, covert networks are used to route activity through various compromised assets, often Small Office Home Office (SOHO) routers and Internet-of-Things (IoT) devices. Malicious activity can be forwarded through various endpoints, referred to as traversal nodes, before reaching an exit node which is generally located in the same geographic region as the target.
Covert networks are continually modified, with patched devices being removed and newly exploited devices being added. The advisory states that new networks are also regularly developed. These two factors make blocking the activity through static Indicators of Compromise (IoCs) impossible.
Covert networks are created by APT groups, like Flax Typhoon or Volt Typhoon, and Chinese information security companies that act as supporting contractors. Devices are compromised via known exploits. While no specific vulnerabilities are mentioned in the report, it is stated that compromised devices are often End-of-Life, meaning that no security patches are produced for the impacted assets. Once a device is compromised, threat actors establish persistent remote access and use it as a relay node, making malicious traffic appear to originate from legitimate consumer or business equipment. Once a covert network is established, it will be employed by multiple threat actor groups across various campaigns.
eSentire Threat Intelligence Analysis:
Google Threat Intelligence (Mandiant) has reported on similar covert networks in the past, tracking them as Operational Relay Box (ORB) networks. The company assessed that the creation of these networks “is an effort to raise the cost of defending an enterprise’s network and shift the advantage toward espionage operators by evading detection and complicating attribution”. Covert networks limit the value of blocking malicious infrastructure for defenders, while also bypassing location-based detections, and disguising malicious traffic as common device traffic. It is almost certain that Chinese APT groups will continue to grow their covert networks and this tactic will be adopted by other state and non-state threat actors, due to their efficiency in bypassing static detections.
To combat these increasingly stealthy tactics, it is critical that organizations employ a Defence-in-Depth approach to security, that includes Network, Endpoint, and Log monitoring. Covert networks disguise where activity is coming from, but strong monitoring of various sources will still identify known malicious tools and behaviours. It should be noted that the eSentire product suite includes a wide variety of detections for tools, exploits, and behaviours associated with Chinese APT groups.
In addition to the previous recommendations, the advisory also suggests that organizations take the following actions:
- Map and understand network edge devices; baseline normal connections, to better understand unusual connects
- Implement Multi-Factor Authentication (MFA) for remote connections
- Apply IP allow lists for connections to corporate VPNs
A separate but notable aspect of this joint report is the mention of private companies that enable Chinese APT activity. The advisory specifically mentions a company known as Integrity Technology Group, that acts as an operator for a covert network. This company has previously been associated with Flax Typhoon. There is a growing pattern of Chinese commercial entities providing offensive cyber infrastructure, tooling, and expertise to APT groups. By utilizing private companies, states can quickly scale up capabilities, drawing on talent and technology that exists in the private sector. The commercialization of cyber-espionage has long-term implications for sanctions, legal attribution, and scope creep of offensive campaigns.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
