eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Ivanti Discloses Series of Vulnerabilities Impacting Ivanti EPMM
Bottom Line: Ivanti disclosed a series of high severity vulnerabilities impacting its Ivanti Endpoint Manager Mobile (EPMM) products, which included a zero-day vulnerability tracked as CVE-2026-6973.
On May 7th, 2026, Ivanti published a security advisory disclosing five vulnerabilities impacting its Ivanti Endpoint Manager Mobile (EPMM) products. Of the five vulnerabilities that were outlined, Ivanti stated that they had identified “a very limited number of customers” to have been targeted by one of the flaws (CVE-2026-6973), classifying it as a zero-day. CVE-2026-6973 (CVSS: 7.2) is an improper input validation vulnerability within Ivanti EPMM that can allow an authenticated attacker to achieve Remote Code Execution (RCE). Although the vulnerability has been leveraged within attacks, Ivanti confirms that successful exploitation requires attackers to have “Admin authentication”.
The other four vulnerabilities impacting Ivanti EPMM that were addressed within the security update include:
- CVE-2026-5786 (CVSS: 8.8): An improper access control flaw that can allow a remote authenticated attacker to gain administrative access
- CVE-2026-5787 (CVSS: 8.9): Improper certificate validation that can allow an unauthenticated attacker to impersonate registered Sentry hosts and obtain valid CA-signed client certificates
- CVE-2026-5788 (CVSS: 7.0): Improper access control vulnerability that can enable an unauthenticated remote attacker to invoke arbitrary methods
- CVE-2026-7821 (CVSS: 7.4): Improper certificate validation that can allow a remote unauthenticated attacker to enroll a device belonging to a restricted set of unenrolled devices, leading to information disclosure
Ivanti states that at the time of publication, they are “not aware” of any customers having been impacted by the four vulnerabilities listed above. The advisory also confirms that patches have been released for Ivanti EPMM to address the flaws, with fixed releases including versions 12.6.1.1, 12.7.0.1, and 12.8.0.1. In response to the disclosure of CVE-2026-6973, CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, giving Federal Civilian Executive Branch (FCEB) agencies until May 10th to ensure that the relevant security patches are applied.
eSentire Threat Intelligence Analysis:
Within Ivanti’s advisory, they state that if customers who had been compromised by CVE-2026-1281 and CVE-2026-1340 rotated their credentials, the risk of exploitation from CVE-2026-6973 was “significantly reduced”, but do not offer any explanation as to why. CVE-2026-1281 (CVSS: 9.8) and CVE-2026-1340 (CVSS: 9.8) are two critical zero-day vulnerabilities impacting Ivanti EPMM that were disclosed in January 2026, which led to unauthenticated RCE on impacted appliances. Following the release of Proof-of-Concept (PoC) exploit code, exploitation of these vulnerabilities surged, with attacks leading to reverse shells, web shells, reconnaissance, and malware deployment. Ivanti recommended that customers who were impacted by these flaws restore from known good backups and rotate credentials and certificates. Based on the available information for CVE-2026-6973, stating that administrative access is required for exploitation, it could be possible that credentials exposed in previous attacks were being operationalized to enable exploitation of this flaw, but this is unconfirmed.
At the time of writing, there are limited technical details available for CVE-2026-6973, and the other four vulnerabilities addressed in the release. There is also currently no additional information regarding the identified attacks that leveraged the flaw. PoC exploit code for the five vulnerabilities is also not available, but this can rapidly change. Ivanti states that the recent patches also apply permanent fixes for CVE-2026-1281 and CVE-2026-1340, where customers who apply the recent patches no longer need to apply the RPM package to address these vulnerabilities. As there is PoC exploit code available for CVE-2026-1281 and CVE-2026-1340, organizations should ensure that patches are applied as soon as possible, to mitigate the risk posed by all the vulnerabilities outlined. eSentire published an advisory for CVE-2026-1281 and CVE-2026-1340 in January 2026, and eSentire’s Threat Intelligence team is continuing to track the recently disclosed vulnerabilities for additional information and detection opportunities.
Palo Alto PAN-OS Zero-Day Vulnerability Disclosed
Bottom Line: Palo Alto has confirmed the existence of an unpatched critical vulnerability in PAN-OS software. Organizations need to apply the temporary mitigations recommended by Palo Alto until security patches are made available.
On May 5th, 2026, Palo Alto Networks disclosed CVE-2026-0300 (CVSS: 9.3), a buffer overflow vulnerability in the User-ID Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software. Exploitation of the vulnerability would enable an unauthenticated attacker to perform Remote Code Execution (RCE) with root privileges on impacted PA-series and VM-series firewalls, leading to full device takeover. In the release, it is specifically noted that the severity of the vulnerability is critical if the authentication portal is exposed to the Internet. Palo Alto confirmed “limited exploitation” against exposed devices and CISA added the vulnerability to the Known Exploited Vulnerabilities (KEV) catalog, but details on real-world attacks were not shared at the time.
On May 6th, Unit 42 disclosed that a threat cluster tracked as CL-STA-1132 is responsible for the real-world exploitation of CVE-2026-0300. Exploitation has been traced back to April 2026, with confirmed activity leading to tunneling tool deployment (EarthWorm, ReverseSocks5), Active Directory (AD) enumeration using credentials likely harvested from the firewall, and the destruction of logs to remove evidence of compromise. The threat actor’s specific goals for recent attacks are not known, but the observed activity has led Unit42 to the conclusion that it is a sophisticated group that is likely state affiliated.
Palo Alto states in the initial security advisory that patches to address vulnerable versions of PAN-OS will be released between May 13th - 28th.
eSentire Threat Intelligence Analysis:
The lack of available security patches represents a critical risk to organizations using the impacted Palo Alto products. Until security patches are made available, at-risk organizations need to perform an audit on all PA-series and VM-series firewalls to determine if the User-ID Authentication portal is configured. If the User-ID Authentication Portal is enabled, organizations should follow Palo Alto’s best practice guidelines, restricting access to trusted IP addresses.
At this time, exploitation is likely limited to a single advanced threat actor group. With the assessment that exploitation is limited to a small number of targets and associated to a state actor, it is probable that recent attacks were conducted for espionage purposes. As the vulnerability requires no authentication, is considered low complexity, does not currently have patches, and exploitation has already been identified, eSentire’s Threat Intelligence team assesses with medium confidence that widespread exploitation may be seen in the near future. If Proof-of-Concept (PoC) exploit code is released, it should be treated as an indicator of impending widespread exploitation.
In response to this disclosure, eSentire’s Threat Response Unit (TRU) created new eSentire MDR for Network detections and released a security advisory. Additionally, available Indicators of Compromise (IoCs) are being employed for threat hunts, and malicious infrastructure is blocked via the eSentire Global Block list for eSentire MDR for Network customers.
MuddyWater Poses as Chaos Ransomware Group
Bottom Line: An IT Impersonation campaign linked to the Iranian APT MuddyWater was identified, who used Chaos ransomware as cover to complicate attribution.
On May 7th, 2026, Rapid7 published a report detailing a cyber intrusion in early 2026 that initially appeared to be a Chaos Ransomware-as-a-Service (RaaS) attack but was assessed with moderate confidence to be a state-sponsored operation linked to MuddyWater (also known as Mango Sandstorm, Seedworm, and Static Kitten), an Iranian Advanced Persistent Threat (APT) group affiliated with Iran’s Ministry of Intelligence and Security (MOIS). The attackers adopted Chaos ransomware branding as a false flag to obscure attribution, while their true objectives appeared to focus on credential collection, data exfiltration, and long-term access rather than file encryption or immediate financial gain.
The attacker achieved initial access through direct user engagement via Microsoft Teams, where victims were socially engineered into participating in screen-sharing sessions. During these sessions, the threat actor executed basic discovery commands to identify system and network information and persuaded users to manually enter credentials into locally created text files. In parallel, the attacker manipulated MFA settings by instructing victims to enroll attacker-controlled devices, effectively enabling persistent authenticated access. Additional evidence indicated the use of phishing infrastructure that mimicked Microsoft Quick Assist.
Following successful credential compromise, the attacker authenticated to internal systems, including Domain Controllers (DC), using valid stolen credentials. Persistent access was established through the deployment of legitimate remote management tools such as DWAgent and AnyDesk. Lateral movement was primarily conducted through interactive RDP sessions. Throughout the intrusion, the attacker distributed emails claiming data theft and provided links to Chaos ransomware infrastructure for negotiation. The threat actor deployed an initial payload that functioned as a lightweight downloader that collected basic host information and registered the infected system with Command-and-Control infrastructure. Upon successful registration, the downloader retrieved additional components. The secondary payload was a custom Remote Access Trojan (RAT) that supports a wide range of functionality, including arbitrary command execution, interactive PowerShell, and command prompt sessions, file upload and deletion, and persistent beaconing to attacker-controlled servers. Rapid7 observed no evidence of file encryption at any point in the incident.
eSentire Threat Intelligence Analysis:
MuddyWater has been active since at least 2017 and is known for conducting cyber espionage campaigns targeting organizations worldwide. The operation highlighted by Rapid7 reflects a broader trend in which state-sponsored threat actors increasingly adopt cybercriminal tactics and branding to delay attribution and complicate defensive response. In this case, the Chaos ransomware identity functioned as a cover for espionage-driven objectives, including data theft and persistent access. The deliberate avoidance of encryption indicates that financial gain was not the primary goal, and that ransomware elements were instead leveraged as a means of coercion, distraction, and plausible deniability. eSentire’s Threat Intelligence team has been actively tracking exposed infrastructure associated with the Iranian state-sponsored APT group MuddyWater. Findings from this research were published on the eSentire TRU Positive blog in an article titled “MuddyWater APT + Tsundere Botnet: EtherHiding the C2”.
Rapid7 noted that MuddyWater previously used Qilin ransomware as cover in a late 2025 attack against an Israeli organization, indicating a recurring pattern of ransomware as a deception layer. This approach aligns with prior warnings from CISA and the FBI, which have publicly assessed that the Iranian government coordinates with ransomware groups to conduct operations against organizations in the United States, Israel, Azerbaijan, and the United Arab Emirates (UAE). eSentire continues to monitor the evolving threat landscape related to Iranian state-sponsored operations and the broader geopolitical conflict. For additional background, threat context, and recommended mitigations related to Iranian state-sponsored cyber activity, readers are encouraged to consult eSentire’s security advisory titled “Iran Conflict – Increased Likelihood of Cyberattacks”.
Organizations that rely on Microsoft Teams for external collaboration should carefully review and restrict policies governing external guest access and interactive features such as screen sharing, particularly when sessions involve unmanaged or personally owned devices. Security teams should also audit endpoint and server environments for the presence of remote management tools and investigate any unexpected or unauthorized deployments, as such tools are frequently abused to maintain persistence while blending into legitimate administrative activity. eSentire Threat Response Unit (TRU) has consistently observed similar initial access techniques across multiple engagements and has issued additional mitigation guidance in its advisory on the “Increase in Email Bombing and IT Impersonation Campaigns”.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
