eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Details on Exploitation of Cisco SD-WAN Manager Zero-Day, CVE-2026-20245
Bottom Line: Details on exploitation of the high severity Cisco zero-day vulnerability CVE-2026-20245 have been released, with the campaign highlighting threat actor focus on the targeting of network management devices, from which persistence and lateral movement can be achieved.
On June 24th, 2026, Mandiant published a report on the zero-day exploitation of a high severity vulnerability impacting Cisco Catalyst SD-WAN Manager, which was identified months before the flaws’ disclosure. CVE-2026-20245 (CVSS: 7.8) was first reported by Cisco on June 4th, and involves the insufficient validation of user supplied input, which can enable an authenticated attacker to execute arbitrary commands and elevate privileges, via a specially crafted file. At the time of its disclosure, Cisco confirmed that exploitation of the flaw had been observed in the wild but provided no additional information.
Mandiant indicates that exploitation of CVE-2026-20245 was observed as early as March 2026. The threat actor established unauthorized peering connections, which were used to facilitate SSH access. With this access established, the attackers changed the password for the default admin account, used it to exfiltrate SD-WAN configuration files, and exploit CVE-2026-20245 via a malicious CSV file. The executed commands were used to create backups of configuration files that would have been overwritten by the CSV, backed up files relating to user accounts and authentication, and create a new account with full root privileges. Throughout the duration of their attack, the threat actors deleted files that they created, and restored any system or account configurations that were modified, such as reverting the changed admin password back to its previous one, in a likely attempt to evade detection and “minimize their forensic footprint”. A validation script was also run by the attackers, which was used to ensure that indicators associated with the attack were removed.
As exploitation of CVE-2026-20245 requires an attacker to have netadmin access on impacted devices, Mandiant suggests that the threat actors may have achieved initial access to the target’s environment through the exploitation of CVE-2026-20182 or CVE-2026-20127. Both vulnerabilities impact the peering authentication in Cisco Catalyst SD-WAN Manager and can allow an unauthenticated attacker to bypass authentication and achieve administrative privileges. Mandiant indicates that unauthorized peering connections were first observed on the victim’s SD-WAN Manager devices from “late 2025 to early 2026”, followed by the exploitation of CVE-2026-20245 in March 2026, but note uncertainty if the attacks were specifically related.
eSentire Threat Intelligence Analysis:
Mandiant does not provide any information on the threat actors behind the attacks, their motivations, or details on the targeted organization. They also do not specifically state if the initial access observed in early 2026 correlates with the attacks identified in March 2026, relating to the same attacker. However, Cisco notes within their advisory for CVE-2026-20245 that exploitation requires either valid credentials or exploitation of CVE-2026-20127 or CVE-2026-20182, and that they are “not aware of successful exploitation by other methods”. Cisco also thanked Mandiant for reporting the flaw, suggesting that this was the referenced in-the-wild exploitation, and that the attacks may be linked.
The report highlights the potential exploitation of three zero-day vulnerabilities by the attacker, based on the timeline provided. Within the disclosures for CVE-2026-20127 in February 2026 and CVE-2026-20182 in May 2026, Cisco stated that they were “aware of limited exploitation” of the flaws. Similarly with CVE-2026-20245, Cisco provided no additional context. Mandiant also notes the dwell time between initial access and CVE-2026-20245 exploitation, and anti-forensic measures taken by the threat actor to reduce the likelihood of detection. All these observations suggest that the attacks were likely performed by a highly skilled threat actor, with an objective of maintaining long-term persistent access.
As exploitation for all three flaws has been identified in the wild, organizations should ensure that relevant patches are applied as soon as possible. eSentire published advisories, and have MDR for Network detections in place, for both CVE-2026-20127 and CVE-2026-20182. eSentire’s Managed Vulnerability Service (MVS) has plugins in place to identify devices that are vulnerable to all three flaws. eSentire’s Threat Intelligence team covered the disclosure of CVE-2026-20245 in the June 1st - June 5th Weekly Threat Briefing, and is continuing to track this topic for additional information and detection opportunities.
macOS.Gaslight: Rust Backdoor with Embedded Prompt Injection
Bottom Line: The macOS.Gaslight backdoor malware, linked to North Korean APTs, includes an embedded prompt-injection payload that is specifically designed to hinder LLM-assisted security analysis workflows.
On June 23rd, 2026, SentinelLABS disclosed macOS.Gaslight, a North Korea-aligned implant embedding a prompt-injection payload into malware specifically designed to subvert LLM-assisted security analysis workflows. The binary surfaced following an Apple XProtect update in early June 2026. macOS.Gaslight is a Mach-O binary compiled in Rust and is ad hoc signed to reduce suspicion.
A defining characteristic of macOS.Gaslight is its embedded prompt injection payload. The malware contains a payload consisting of 38 fabricated system messages that mimic legitimate diagnostic output. These messages simulate false system conditions such as memory exhaustion, disk failures, token expiration, and repeated execution errors. The objective of this technique is to manipulate AI-assisted triage tools into aborting analysis, producing incorrect conclusions, or refusing to process the sample entirely.
macOS.Gaslight relies on the Telegram Bot API for its Command-and-Control (C2) communications. The malware uses a polling mechanism to retrieve commands from the operator and to send exfiltrated data back through the same channel. macOS.Gaslight provides an interactive shell that enables the operator to execute various commands on the compromised host. These commands include retrieving system identification information, executing arbitrary shell commands, terminating processes, exfiltrating files, and stopping the implant.
The implant also includes a Python-based data collection module that is delivered in an encoded format and executed when required. This module is capable of harvesting sensitive information, including browser data from Chrome, Safari, Firefox, and Brave, as well as terminal command histories, lists of installed applications, running processes, and detailed system information.
Based on tooling overlaps and behavioral similarities, SentinelLABS assesses with high confidence that this malware is linked to a cluster of activity attributed to North Korean (DPRK-aligned) threat actors.
eSentire Threat Intelligence Analysis:
macOS.Gaslight consolidates significant functionality within a single persistent Rust-based binary, incorporating a credential and session data stealer, an interactive remote shell, and a self-staged Python-based data collection framework. The majority of these capabilities reflect established macOS adversary tradecraft and are consistent with historical activity attributed to DPRK-aligned threat actors. While the report does not explicitly state the objective, historical DPRK activity has included both espionage and financial motivations.
The inclusion of prompt injection techniques demonstrates a deliberate effort to adapt to modern defensive environments and exploit weaknesses in AI-assisted analysis pipelines. By embedding adversarial content directly within the malware, the threat actor shifts focus from traditional evasion techniques to manipulating analytical processes themselves.
As AI becomes increasingly integrated into cybersecurity operations, defenders should anticipate a rise in adversarial techniques specifically designed to exploit these systems. In 2025, Check Point documented a Proof-of-Concept (PoC) showing that malware could include a prompt injection designed to manipulate AI-based analysis systems. The current report from SentinelLABS indicates that this malware includes fabricated system messages intended to mislead triage agents that rely on LLMs. This manipulation could cause these agents to abort or refuse analysis. As a result, automated verdicts produced by such systems may be unreliable unless they are supplemented by additional validation mechanisms and human oversight.
Following the release of this report, eSentire’s Threat Intelligence team is actively monitoring this topic for further information and detection opportunities. Organizations should implement a layered defensive strategy that addresses both malware risks and emerging threats targeting AI-assisted security workflows. eSentire AI SOC tooling was reviewed and is not at risk from prompt injection techniques described in this report.
Five Eyes Issue Statement on AI Impact to Cyber Risk
Bottom Line: The members of the Five Eyes intelligence group released a joint statement on the rapid changes AI is driving in both the offensive and defensive side of cybersecurity.
On June 22nd, 2026, intelligence agencies from Five Eyes member countries (Australia, Canada, New Zealand, the United Kingdom, and the United States) released a joint statement on the evolving risks associated with Artificial Intelligence. The agencies state that boards and executives must ensure cyber resilience performs under real incident conditions, not just in theory. Risks associated with AI adoption by threat actors include lowering the barriers of entry to cyberattacks for low-skilled actors, decreasing the time between vulnerability disclosure and active exploitation, and enabling higher-complexity attacks.
Five Eyes outlines three core principles that business leaders should consider. First, the concepts of secure-by-design and secure-by-default must be enforced as standard operating procedure. Second, defense-in-depth is a requirement, as no single solution or technology can achieve full resilience. Lastly, as AI systems improve, there will be an increase in vulnerability discovery, including zero-day vulnerabilities that are exploited prior to public disclosure.
To counter the threat of increased AI adoption by adversaries, Five Eyes recommends the following actions:
- Reduce attack surface by limiting unnecessary access and external connectivity
- Accelerate patching processes
- Address legacy systems that are no longer supported
- Review and strengthen identity and access controls
- Prepare for incidents with a tested response plan
eSentire Threat Intelligence Analysis:
AI abuse by threat actors is not a theoretical risk; there are now multiple examples of threat actors abusing AI platforms to conduct cyberattacks. Microsoft’s Defender Security Research Team recently disclosed AutoJack, a novel attack chain where an AI browsing agent is used to deliver malicious content. Threat actors have been identified tricking users into interacting with shared Claude chats, that provide malicious commands for users to run. eSentire has observed a variety of threats involving AI, including malware translated via LLMs and fake AI agent installers leading to malware deployment.
One of the most important takeaways from the Five Eyes statement is that the time to patch vulnerabilities is rapidly decreasing. While frontier AI models, like Mythos, are proven to rapidly discover new vulnerabilities, with the right prompts and guardrail bypass techniques, publicly available models have also resulted in vulnerability discovery. According to the report, this has moved the patch period from potentially years, down to months. Based on some recent examples, where exploitation followed public disclosure after only days, the patch window is likely even shorter than what Five Eyes outlines.
To minimize this risk, organizations need to maintain an asset inventory and rapidly apply relevant security patches. In the case of zero-day vulnerabilities, Endpoint agents can act as a stop gap solution until security patches are released; while endpoint protections will not stop the initial exploit, they can detect standard follow-on behaviours. Adoption of AI code review and red-teaming can also assist organizations in identifying gaps before attacks do.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
