eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Ongoing Exploitation of Cisco Catalyst SD-WAN Vulnerabilities
Bottom Line: CVE-2026-20182 is an authentication bypass vulnerability that can allow an attacker to gain administrative privileges on Cisco Catalyst SD-WAN Controller and SD-WAN Manager devices. This vulnerability is being exploited in-the-wild by UAT-8616, a sophisticated threat actor.
On May 14th, 2026, Cisco disclosed a maximum severity vulnerability in Cisco Catalyst Software-Defined Wide Area Network (SD-WAN) Controller and SD-WAN Manager. The vulnerability, tracked as CVE-2026-20182 (CVSS: 10) allows a remote, unauthenticated attacker to bypass authentication and gain administrative privileges on affected systems. The flaw resides in the vdaemon service’s Datagram Transport Layer Security (DTLS) handshake over UDP, where setting the device type to vHub during the challenge-acknowledgement phase bypasses certificate verification entirely. Cisco Catalyst SD-WAN is a software networking platform used to connect remote locations such as offices or data centers; successful exploitation of CVE-2026-20182 would grant a threat actor significant access across a vulnerable organization. The flaw was discovered by researchers from Rapid7, while investigating a similar known vulnerability.
Cisco Talos has confirmed that real-world exploitation occurred prior to the release of security patches. At this time, activity is believed to be limited to a single threat actor, tracked as UAT-8616. Cisco Talos assesses that the group is “highly sophisticated” but does not connect them to a state or established threat actor group. The group’s only prior reported activity relates to exploitation of another Cisco vulnerability, CVE-2026-20127. In the zero-day exploitation cases, UAT-8616 post-compromise activity includes attempts to add Secure Shell (SSH) keys, modify NETCONF configurations, and escalate to root privileges. The final objective of these compromises has not been established.
Cisco has released security patches to address the vulnerability. CISA added CVE-2026-20182 to the Known Exploited Vulnerabilities (KEV) catalog, giving Federal Civilian Executive Branch (FCEB) agencies a deadline of May 17th to apply relevant patches.
eSentire Threat Intelligence Analysis:
This reporting highlights the value of vulnerabilities in Internet facing applications. Sophisticated threat actors will target these devices, when possible, to achieve initial access. In this case, the vulnerability was exploited prior to patch release, indicating the responsible threat actor was sophisticated enough to identify the vulnerability, develop an exploit, and launch multiple attacks prior to discovery. It is critical that organizations apply the relevant security patches as soon as possible, to limit the likelihood of exploitation. To preserve/identify signs of compromise, Cisco recommends that organizations “issue the request admin-tech command from each of the control components in the SD-WAN deployment before upgrading”.
In the report confirming exploitation of CVE-2026-20182, Cisco Talos also disclosed multiple ongoing campaigns targeting vulnerabilities released in February 2026. Ten separate activity clusters were found to exploit the following vulnerabilities: CVE-2026-20133 (CVSS: 7.5), CVE-2026-20128 (CVSS: 7.5), and CVE-2026-20122 (CVSS: 5.4). The post exploitation actions varied by cluster, with attacks leading to the deployment of webshells (Godzilla, Behinder, XenShell), Command-and-Control (C2) frameworks (AdaptixC2, Sliver), the XMRig coin miner, and an unidentified credential stealer payload. In most cases, publicly available Proof-of-Concept (PoC) exploit code was used to exploit the vulnerabilities.
The scale of activity targeting Cisco vulnerabilities shows that multiple threat actors have familiarity with the platform and are actively investigating vulnerabilities and developing exploits for Internet facing Cisco assets. It is probable that additional threat actor groups will exploit CVE-2026-20182 in future attacks. The release of PoC exploit code is an indicator that wider adoption by adversaries will occur in the immediate future. In response to this disclosure, eSentire published an advisory on May 15th, released new MDR for Network rules to identify exploitation attempts, and performed threat hunts for known activity associated with Cisco device exploitation.
Tiflux Campaign Chains Multiple Remote Access Tools
Bottom Line: Threat actors are leveraging phishing campaigns to deploy the Tiflux Remote Monitoring and Management (RMM) tool, enabling unauthorized remote access and long-term persistence on compromised systems. eSentire’s Threat Response Unit (TRU) has identified similar activity patterns, indicating broader adoption of legitimate RMM tools for malicious operations.
On May 7th, 2026, security researchers disclosed an active campaign in which threat actors are using Tiflux, a commercially sold RMM tool, as the initial foothold before systematically layering additional remote access software to deepen persistence across compromised environments. This campaign has been active since late February 2026 and has affected multiple organizations across different sectors.
Threat actors initiate this campaign through phishing emails that masquerade as legitimate business communications, most commonly presenting themselves as “service agreement” notifications or secured document requests. These emails contain links that direct recipients to attacker-controlled websites designed to appear authentic. In several observed cases, the landing pages required the victim to complete a Cloudflare CAPTCHA. Once the CAPTCHA challenge is completed, victims are prompted to download a secured document, which is actually a Microsoft Installer (.msi) file containing the Tiflux RMM. The downloaded installer is often renamed to appear business-related (for example, “Network Solutions Agreement.msi”). After execution, the installer deploys core Tiflux components such as TiAgent and TiPeerToPeer, which provide orchestration and communication capabilities. Following installation, the attackers leverage Tiflux’s built-in management features to silently deploy additional remote access tools, including Splashtop and ScreenConnect, without notifying the end user.
Once these tools are active, the compromised system becomes persistently accessible to the threat actor. Researchers observed that the combined RMM tooling allows attackers to capture screenshots and screenshot thumbnails, execute commands, and collect detailed system profiling information from the infected host. In some cases, multiple RMMs operate simultaneously, each connecting to their own infrastructure.
There was a presence of outdated and high-risk components bundled within the Tiflux installer. The installer includes an obsolete version of UltraVNC dating back to at least 2014, which is signed with an expired certificate originally issued to the legitimate UltraVNC publisher. In addition to outdated utilities, the installer was observed dropping a known vulnerable kernel driver into the victim system and registering it as a service. Vulnerable components may be exploited by threat actors for various purposes including privilege escalation.
eSentire Threat Intelligence Analysis:
This campaign demonstrates that adversaries are crafting increasingly convincing lures, making it easier for victims to fall prey to phishing attempts. Additionally, the layering of multiple remote access tools on a single compromised host increases the likelihood of sustained access, even if one tool is detected and removed. The eSentire Threat Intelligence team observed a similar incident where threat actors leveraged the Tiflux RMM tool to gain unauthorized remote access, highlighting how increasingly convincing phishing lures can successfully deceive victims. Hence, organizations are advised to strengthen defenses through a combination of user education and technical controls. Conducting Phishing Security and Awareness Training (PSAT) can help employees recognize and avoid common phishing techniques. Enforcing Multi-Factor Authentication (MFA) across all accounts provides an additional layer of protection against credential theft.
Threat actors weaponize trusted commercial remote management products to blend in with normal IT operations. Because RMMs are commonly used by managed service providers and internal IT teams, their misuse is often difficult to distinguish from legitimate administrative behavior. Organizations can take proactive measures by implementing technical controls that restrict the use of certain tools on their systems or by blocking connections to known RMM-related infrastructure. Additionally, deploying Endpoint agents on all supported assets within the organization can significantly aid in the identification and containment of threats. In incidents where a user is tricked by an executable/msi file impersonating a legitimate file, it is important for users to learn how to recognize such deceptive tactics and have the means to report them.
For more insights into how threat actors are gaining initial access and exploiting legitimate RMM tools, eSentire’s Threat Response Unit (TRU) has published a technical TRU Positive report on an incident involving malicious ScreenConnect use in conjunction with AsyncRAT.
Device Code Phishing: Evolution in Identity Takeover
Bottom Line: Device Code Phishing has become a widely adopted technique within Phishing-as-a-Service (PhaaS) kits, used to steal victim identities. eSentire has recently observed adoption by the prolific Tycoon2FA PhaaS kit.
On May 13th, 2026, Proofpoint published an article highlighting the proliferation of a social engineering technique known as device code phishing, enabling unauthorized access to user email accounts. Device Code Authentication is a legitimate feature that utilizes the OAuth 2.0 authorization flow, designed for authenticating input-constrained devices. Threat actors abuse this legitimate feature by tricking users into entering in an attacker-generated code, granting unauthorized access to the users’ account. Proofpoint highlights that the technique is “exploding across the threat landscape”, with the spike coinciding with the techniques inclusion within Phishing-as-a-Service (PhaaS) toolkits.
Device code phishing has been adopted within various PhaaS kits, including EvilTokens, Kali365, Tycoon 2FA, FlowerStorm (ODx), and ARTokens. Proofpoint notes that EvilTokens is one of the “most prominent device code PhaaS options” and assesses that the kit was created and maintained using vibe coding AI generation techniques. Phishing emails containing URLs, attachments, or QR Codes are sent to users, which direct to landing pages that generate codes dynamically, followed by directing to the legitimate Microsoft device code authentication flow. If the malicious code is entered into the authentication flow, a threat actor can capture authentication tokens which can be used to gain access to the targets account, and other services that the compromised account has access to.
Proofpoint highlights the threat actor TA4903, who has been conducting financially motivated phishing campaigns since at least 2021, appear to have “exclusively” shifted to device code phishing tactics, sending phishing emails impersonating as small businesses, Human Resources (HR) contacts, and government entities. Proofpoint states that TA4903 utilizes a custom device code phishing kit that “looks and operates” like EvilTokens.
eSentire Threat Intelligence Analysis:
Device code phishing is not a novel technique and was first documented in 2020. In 2025, Microsoft identified the Russia-aligned threat actor Storm-2372 performing device code phishing attacks, dating back to at least August 2024. Scattered Lapsus$ Hunters have also been identified using the technique within attacks throughout 2025 and into 2026. In recent months, device code phishing has risen in popularity, with the technique being adopted within various phishing kits, likely due to its success and abuse of legitimate OAuth 2.0 device flow authorization infrastructure to evade detection. Proofpoint has identified its adoption within phishing kits, such as Tycoon2FA and FlowerStorm, with noting that FlowerStorm’s device code authentication capabilities are using the Kali365 phishing kit, stating that it is “unclear” if FlowerStorm stole, purchased, or partnered with Kali365 to integrate it into the service.
eSentire’s Threat Response Unit (TRU) published a blog on Tycoon 2FA’s adoption of device code authentication phishing, leveraging an invoice-themed lure and fake voicemail to trick the user into entering the malicious code. Since March 2026, eSentire’s Threat Intelligence team has observed an increase in phishing kits, specifically EvilTokens, Kali365, Tycoon2FA, and FlowerStorm, using device code phishing to obtain unauthorized access to victim accounts. eSentire identified that in 2025, 63% of all account compromise incidents stemmed from PhaaS kits, as these services allow for threat actors of all skill levels to conduct large scale phishing campaigns. This proliferation of device code phishing follows similar patterns with ClickFix, which eSentire observed a nearly 300% increase from 2024 to 2025 as it became widely adopted by various threat actors, including ransomware operators and APTs. Given the popularity of PhaaS kits and trends towards incorporating device code phishing into the kits, eSentire’s Threat Intelligence team assesses with high confidence that device code phishing will continue to become more popular throughout 2026.
To protect against device code phishing attacks, organizations are recommended to block the device code authentication flow, where possible. Conditional Access policies should also be implemented to restrict access only to registered and compliant devices. Organizations can also conduct Phishing and Security Awareness (PSAT) training, which can educate users on how to identify and report malicious content. eSentire MDR for Log has detections in place to identify logins from known Adversary-in-The-Middle (AiTM) and phishing kit infrastructure.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
