eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Citrix Discloses New Zero-Day Vulnerability in NetScaler ADC and NetScaler Gateway
Bottom Line: Citrix disclosed the zero-day vulnerability CVE-2026-88779, impacting its NetScaler ADC and NetScaler Gateway appliances that use SAML authentication. As in-the-wild exploitation has been confirmed, organizations should prioritize patching immediately.
On October 4th, 2026, Citrix disclosed CVE-2026-88779, a zero-day vulnerability impacting Citrix NetScaler ADC and NetScaler Gateway appliances that use SAML authentication. CVE-2026-88779 (CVSS: 8.7) is a memory overflow vulnerability, which under certain pre-configurations, can lead to Denial of Service (DoS). The specific pre-configurations required entail devices being configured as a SAML Service Provider (SP) or SAML Identity Provider (IdP). Citrix released patches to address CVE-2026-88779, and a Global Deny List feature that can be applied to “reduce exposure” while organizations “validate applicability and plan an upgrade”.
Along with the disclosure of the vulnerability, Citrix confirmed that “targeted attacks” had been observed, but limited details are shared. On October 4th, Aviatrix published findings on CVE-2026-88779, indicating that while the vulnerability was characterized as a DoS flaw, there was evidence to suggest that the memory overflow could lead to Remote Code Execution (RCE) through crafted authentication requests that contained shell commands. Citrix initially shared information on the flaw on October 2nd, noting that a “newly observed issue related to SAML authentication” was being tracked. watchTowr Labs also commented on the rumours, noting that they were monitoring honeypot activity relating to a “new vulnerability” impacting Citrix appliances, and later confirming that they were able to “successfully reproduce” it. Following CVE-2026-88779’s disclosure, CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, giving federal agencies a deadline of October 7th to apply relevant patches.
eSentire Threat Intelligence Analysis:
In their disclosure, Citrix characterizes CVE-2026-88779 as a DoS vulnerability, specifically stating that “analysis indicates that this issue affects service availability” and have not identified “impact on the integrity of customer data”. In contrast to this, Aviatrix claims how exploitation of CVE-2026-88779 enabled RCE with elevated privileges on impacted devices, “bypassing normal authentication controls”. This would significantly increase the criticality of CVE-2026-88779, if attackers could leverage it to achieve unauthenticated RCE, but as limited details are available on attacks leveraging the flaw, these claims remain unverified.
The identification of CVE-2026-88779 comes one week after Citrix disclosed two other zero-day vulnerabilities impacting NetScaler ADC and NetScaler Gateway appliances, tracked as CVE-2026-88771 and CVE-2026-88772. Following the release of Proof-of-Concept (PoC) exploit code for these zero-day flaws, widespread exploitation was identified. On October 8th, Citrix also disclosed CVE-2026-107406 (CVSS: 9.5), another memory overflow vulnerability impacting NetScaler ADC and NetScaler Gateway “under specific configuration conditions” that could lead to RCE or DoS. Although there are currently no reports of exploitation of CVE-2026-107406, given the history of Citrix NetScaler vulnerabilities being targeted within attacks, and similarities with CVE-2026-88779, it is likely that exploitation will be seen in the near future.
At the time of writing, technical details on CVE-2026-88779 are limited, and there are no reports of publicly available PoC exploit code, which would lower the barrier for attacks. However, as exploitation has been observed, and CVE-2026-107406 was also recently disclosed, organizations that utilize NetScaler ADC and NetScaler Gateway within their environment should ensure that the latest versions and security updates are applied as soon as possible. eSentire published an advisory for CVE-2026-88779 on October 5th, and eSentire Managed Vulnerability Service (MVS) has plugins in place to identify vulnerable devices. eSentire's Threat Response Unit (TRU) is continuing to track both CVE-2026-88779 and CVE-2026-107406 for additional information and detection opportunities.
Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue ScreenConnect RMMs
Bottom Line: Threat actors are abusing legitimate Microsoft Power BI domains in phishing emails to bypass email filters and lure users into installing rogue ScreenConnect RMM clients, giving them persistent control of victim endpoints.
On October 7th, 2026, Huntress reported a phishing campaign that abuses Microsoft Power BI domains to install rogue Remote Monitoring and Management (RMM) tools. The attack began with phishing emails containing embedded links that redirected victims to a fraudulent reference document hosted on a legitimate domain. When users clicked the “Download Reference” button, a new browser tab opened to an attacker-controlled website. These websites were configured to perform extensive fingerprinting of the victim’s device, collecting information such as the operating system, browser type and version, IP address, geolocation data, device characteristics, and indicators of automated analysis environments. The collected information was transmitted to the attackers through a hardcoded Telegram Bot API, allowing them to monitor victim activity in real time.
Following the fingerprinting stage, the malicious website initiated the download of a rogue installer. The download was intentionally delayed using JavaScript to hinder automated analysis. Victims were presented with a message indicating that a reference document had been downloaded successfully, when in reality they had received a malicious remote access tool.
In every observed instance, the installer established an initial rogue ScreenConnect client, which in turn established a second, separate rogue ScreenConnect client connected to different infrastructure. After establishing both clients, the attackers executed a defense evasion tool designed to hide their activity from the user and security software, and created a scheduled task to re-run the PowerShell persistence script every two minutes.
eSentire Threat Intelligence Analysis:
This campaign demonstrates how threat actors are leaning on trusted cloud platforms to improve lure credibility and slip past security controls. Hosting the lure on a high-trust Microsoft domain made it considerably more likely that both automated filters and end users would treat the content as safe. The fingerprinting and telemetry collection built into the staging pages points to a filtering strategy; before ever serving the payload, the attackers were screening out scanners, and unsuitable environments, while simultaneously gathering data that could help them prioritize which victims were worth pursuing further. Chaining two separate rogue ScreenConnect instances, rather than relying on one, reflects a clear persistence strategy, built so that removing one RMM client still leaves a second foothold intact.
Threat actors weaponize trusted commercial remote management products to blend in with normal IT operations. Based on the tradecraft, eSentire’s Threat Intelligence team has observed similar social engineering activity in the wild ultimately used to deploy RMM tools such as MeshAgent, UltraViewer, Atera Agent, FleetDeck, LevelRMM, and Splashtop. To mitigate such threats, organizations should monitor for unauthorized installations of remote management tools, investigate connections to unapproved RMM infrastructure, and review the creation of suspicious scheduled tasks or PowerShell-based persistence mechanisms. Security teams should also ensure that users understand that trusted cloud-service domains can still be abused to facilitate phishing attacks.
eSentire’s Threat Response Unit (TRU) published a technical TRU Positive report on an incident involving malicious ScreenConnect use in conjunction with AsyncRAT deployment.
U.S. and International Partners Expose Enabler of Chinese State-Sponsored Cyber Operations
Bottom Line: The Chinese state-sponsored actor ecosystem is fundamentally supported by domestic companies. US government agencies, with the support of international partners, have disclosed activity associated with the China-based Integrity Technology Group, enabling breaches and data theft across various industries.
On October 8th, 2026, CISA, the FBI, NSA, and counterpart agencies from the United Kingdom, Australia, Canada, Japan, New Zealand, and Spain published a joint advisory describing Integrity Technology Group (Integrity Tech), a People’s Republic of China (PRC)-based, for-profit company with ties to the Chinese government. Integrity Tech is described as an enabler that acquires or builds cyber tools, hosts infrastructure, and compromises networks in support of state-sponsored cyber operations. The advisory states that the observed Tactics, Techniques, and Procedures (TTPs) are consistent with activity publicly tracked as Flax Typhoon (aka Ethereal Panda, Red Juliett), while cautioning that commercial threat-actor naming does not map one-to-one onto U.S. government attribution.
On the same day, the Justice Department and FBI announced the court-authorized seizure of two tools Integrity Tech operated: Microscan, a vulnerability-scanning platform powered by a botnet of Mirai-variant-infected Internet of Things (IoT) devices, and FishHub, a spear-phishing tool used to gain initial network access before deploying follow-on malware for remote access or targeted file theft. Reported victims include a U.S. power company in South Carolina, a multinational Non-Governmental Organization (NGO), Japanese and Polish airports, Taiwanese natural gas and power companies, and approximately 20 Taiwanese universities. According to CISA, the group has also been observed targeting critical infrastructure sectors, government services, critical manufacturing, healthcare, and information technology, along with law enforcement, education, and religious organizations in North America, Southeast Asia, and Africa. Authorities seized the domain hosting Microscan along with five domains used to deliver FishHub payloads.
eSentire Threat Intelligence Analysis:
The Integrity Tech disclosure reinforces a pattern CISA has previously documented. Chinese state-sponsored actor ecosystem is fundamentally underpinned by domestic private businesses rather than operating solely through in-house government capability. In August 2025, CISA advisory AA25-239A named three China-based companies, Sichuan Juxinhe Network Technology, Beijing Huanyu Tianqiong Information Technology, and Sichuan Zhixin Ruijie Network Technology, as suppliers of cyber tools and services to the Ministry of State Security and multiple People’s Liberation Army units. Those companies’ tooling enabled Salt Typhoon-linked clusters, (aka OPERATOR PANDA, RedMike, UNC5807, GhostEmperor) to compromise telecommunications and internet service provider routers worldwide since at least 2021. These campaigns gave Chinese intelligence services the ability to track the communications and movements of surveillance targets globally. Read alongside Integrity Tech, these cases point to a recurring model in which PRC-based commercial contractors build, host, and operate offensive cyber infrastructure that is subsequently used by, or made available to, a range of distinct state-sponsored actor clusters, functioning as a shared vendor layer beneath otherwise separately tracked APT groups.
This same underlying dynamic may help explain the BlueMoon exploit kit, which chains a Chrome vulnerability and a Windows kernel local-privilege-escalation flaw (CVE-2026-85880) to achieve full code execution outside Chrome’s sandbox. BlueMoon was first observed in use by TA412 (APT31/Violet Typhoon) on August 28th, 2026, and was independently adopted within days by at least three additional threat clusters, UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket, the majority of which are suspected China-aligned groups. While the source of the exploit kit remains unconfirmed, the speed with which multiple independently operating China-aligned clusters gained access to the same novel exploit chain is consistent with the broader pattern described above. The sharing of capabilities across multiple operators, extends the practical reach of the broader state-sponsored ecosystem beyond what any single actor group could develop independently.
While recent law-enforcement action has resulted in the seizure of known malicious infrastructure, the long-term impact is expected to be minimal. In September 2024, the FBI and Justice Department disrupted a Mirai botnet that was also linked to Integrity Tech and Flax Typhoon. Integrity Tech continued operating after the 2024 botnet disruption, which suggests takedowns impose cost without eliminating capability, and will likely attempt to rebuild scanning and phishing infrastructure after these seizures. In the short term, threat actors will be forced to pivot to alternative infrastructure and tools.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
