eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Ivanti Connect Secure Zero-Day Vulnerability
Bottom Line: Ivanti disclosed the zero-day vulnerability CVE-2026-104935 within Ivanti Connect Secure, which was exploited by UTA0576 to achieve unauthenticated root-level Remote Code Execution (RCE).
On October 13th, 2026, Ivanti disclosed a high severity zero-day vulnerability within the Ivanti Connect Secure (ICS) product. CVE-2026-104935 (CVSS: 8.6) is an authentication bypass flaw within ICS that can allow an unauthenticated, remote attacker to execute arbitrary commands on impacted devices. The flaw impacts ICS versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior; patches were released to address the flaw. At the time of disclosure, Ivanti confirmed that they were aware of in-the-wild exploitation impacting a “limited number” of customers.
Volexity published a report on the same day, providing details on attacks leveraging CVE-2026-104935, which they attributed to the threat actor UTA0576. Volexity notes that CVE-2026-104935 encompasses both an authentication bypass and Remote Code Execution (RCE) exploit, and when paired with a separate privilege escalation flaw, allowed the attacker to “achieve unauthenticated root-level code execution”. Post exploitation activity focused on credential theft, data exfiltration, log tampering, and network reconnaissance. As the operation was detected and disrupted, the ultimate objectives of the threat actor could not be determined, but Volexity assessed with “low confidence” that UTA0576’s motivations were “criminal, rather than espionage”.
eSentire Threat Intelligence Analysis:
Volexity indicates that UTA0576 chained CVE-2026-104935 with another unidentified privilege escalation flaw in order to elevate to root privileges and execute code. This is highly notable as it appears UTA0576 was able to develop two zero-day exploits impacting ICS. Volexity assessed that the attackers likely leveraged the use of Large Language Models (LLMs) to aid in exploit development and post-exploitation activity. eSentire's Threat Intelligence team assesses with high confidence that threat actors will continue to leverage AI within their attacks, lowering the barrier for threat actors of all skill levels to develop novel exploits and conduct complex attacks. Volexity states that Ivanti is “working on a fix” for the unidentified privilege escalation flaw, to be included in a “future release in the coming weeks”.
Following the vulnerability’s disclosure, CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) catalog, giving Federal Civilian Executive Branch (FCEB) agencies a deadline of October 16th to apply patches. As exploitation has been identified, and vulnerabilities impacting ICS have a history of being targeted within attacks, organizations should prioritize patching as soon as possible. In response to CVE-2026-104935, eSentire published an advisory for the vulnerability on October 14th. eSentire's Managed Vulnerability Service (MVS) has plugins in place to identify vulnerable devices. eSentire's Threat Response Unit (TRU) developed MDR for Network detections to identify exploitation attempts against CVE-2026-104935 and is continuing to track the vulnerability for additional information and detection opportunities.
October Patch Tuesday
Bottom Line: Microsoft’s October 2026 Patch Tuesday release addressed 1,411 vulnerabilities. This included three zero-day vulnerabilities, CVE-2026-96951, CVE-2026-108398, and CVE-2026-92707, of which only one has been observed in an attack.
On October 13th, 2026, Microsoft released its October Patch Tuesday updates, addressing 1,411 vulnerabilities, the largest release on record, surpassing September’s previous high of 966. Of these, 70 are rated Critical, including 57 Remote Code Execution (RCE), eleven elevation-of-privilege, and two spoofing vulnerabilities. Three zero-day vulnerabilities were addressed this month, one of which has been exploited in the wild and two of which were publicly disclosed prior to patching.
CVE-2026-96951 (CVSS: 8.8) is the actively exploited zero-day. It is a Windows Shell security feature bypass vulnerability, that allows a specially crafted file to bypass Mark of the Web (MoTW), the warning tag Windows applies to files downloaded from the Internet to alert users before risky content is opened. Exploitation requires an attacker to convince a user to open a malicious file. Microsoft credited researchers from Fujitsu Limited and Anthropic, as well as a researcher known as “yhw” with reporting the flaw. CISA added CVE-2026-96951 to its Known Exploited Vulnerabilities (KEV) catalog on October 13th, giving Federal Civilian Executive Branch (FCEB) agencies a remediation deadline of October 16th. Details on real-world attacks involving the flaw have not been publicized at the time of writing.
The zero-day vulnerabilities disclosed prior to patching but not exploited are CVE-2026-108398 (CVSS: 8.8) and CVE-2026-92707 (CVSS: 5.3). CVE-2026-108398 is a .NET Framework security feature bypass vulnerability, that allows a local, low-privileged attacker to bypass Windows Defender Application Control (WDAC) enforcement. CVE-2026-92707 is a denial-of-service vulnerability in MessagePack-CSharp, an open-source serialization library bundled with certain .NET applications.
eSentire Threat Intelligence Analysis:
Organizations are strongly encouraged to review the full October Patch Tuesday release and ensure that all vulnerabilities are mitigated. Of the three zero-days, CVE-2026-96951 should be prioritized first given its active exploitation status and KEV listing. MoTW bypasses are typically used as the final step in a delivery chain following a phishing email or drive-by download; exploitation of this flaw would indicate the delivery of a malicious payload to the host. Endpoint Detection and Response (EDR) is critical for detecting and isolating threats that are successfully deployed via similar evasion exploits.
October’s Patch Tuesday release broke the record for number of vulnerabilities addressed, previously set by the September 2026 release. As Microsoft introduced AI into its vulnerability discovery process, near term Patch Tuesday releases will almost certainly continue to contain high numbers of addressed flaws. This trend may decrease over time, as historical vulnerabilities discovered via AI are identified and remediated. Due to the increase in AI for both vulnerability discovery and exploit development, it is critical that organizations implement processes to quickly identify and patch high volumes of software flaws.
eSentire's Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to CVE-2026-96951, CVE-2026-108398, and CVE-2026-92707. The eSentire Threat Intelligence team continues to monitor for additional exploitation activity tied to this month’s release.
ARMORY CASTLE Abuses BeyondTrust Appliances
Bottom Line: A suspected Chinese APT, tracked as ARMORY CASTLE, exploited a zero-day vulnerability (CVE-2026-102764) in BeyondTrust Remote Support software, months before its disclosure. The eSentire Threat Intelligence team assesses that widespread exploitation of the vulnerability is probable in the immediate future.
On October 15th, 2026, BeyondTrust disclosed CVE-2026-102764, a vulnerability affecting BeyondTrust Remote Support appliances that allows a remote attacker to perform file operations on an affected appliance. During a recent incident response engagement, Mandiant identified evidence that the suspected People’s Republic of China (PRC) linked espionage group ARMORY CASTLE (formerly tracked as UNC5221) exploited the vulnerability as a zero-day in late August 2026. Following successful exploitation of CVE-2026-102764, ARMORY CASTLE rapidly established a foothold on compromised BeyondTrust appliances through the deployment of custom malware and abuse of native system functionality.
The threat actor initiated malicious requests that ultimately resulted in the deployment of the SAWFLY webshell within the web root directory of the compromised appliance. SAWFLY is an obfuscated PHP-based webshell that is used to facilitate bidirectional Command-and-Control communications. The malware executes attacker-supplied code through the PHP function and returns encrypted responses to the operator. To obtain elevated privileges, ARMORY CASTLE copied the system shell binary and created a malicious SUID-enabled executable owned by the root user. This technique allowed the threat actor to execute commands with root-level privileges. Once privileged access was obtained, the actor leveraged the native BeyondTrust utility (bt-secrets) in an attempt to extract credentials stored within the appliance’s credential vault.
After compromising the appliance, the threat actor leveraged stolen administrator credentials to authenticate to the BeyondTrust administrative portal. The actor subsequently modified user permissions, granting administrator access to Jump Items and Teams, which enabled unrestricted access to managed endpoints connected to the appliance. Using native BeyondTrust remote support capabilities, the actor established sessions with internal systems, conducted reconnaissance, and downloaded sensitive files from victim endpoints. To facilitate covert communications, ARMORY CASTLE deployed the custom BARECLAW tunneler. BARECLAW is a SOCKS5 proxy utility written in C that leverages WebSocket communications to relay network traffic between attacker-controlled systems and internal targets. Mandiant observed the deletion of authentication logs, web server logs, application logs, system logs, and credential access records across multiple directories. These actions were intended to remove evidence of malicious activity, complicate incident response efforts, and extend the actor’s dwell time within compromised environments.
eSentire Threat Intelligence Analysis:
The activity attributed to ARMORY CASTLE is consistent with the group’s established pattern of targeting Internet-facing edge appliances through the exploitation of zero-day vulnerabilities to obtain strategic access for espionage operations. The actor has previously exploited vulnerabilities in Citrix NetScaler appliances and Ivanti Connect Secure devices, targeting organizations across government, technology, legal, Software-as-a-Service (SaaS), and business services sectors. The latest exploitation of BeyondTrust Remote Support reinforces the group’s continued focus on high-value infrastructure that can provide privileged access into enterprise environments.
Mandiant’s findings indicate that the actor demonstrated a deep understanding of BeyondTrust appliance architecture, leveraging proprietary administrative utilities, startup configuration mechanisms, and reverse proxy services to establish persistence and maintain long-term access. This level of product-specific knowledge suggests that the actor invests considerable effort into researching targeted technologies and developing a tailored exploit before conducting operations. Both Mandiant and BeyondTrust assess that ARMORY CASTLE, as well as other threat actors, may transition to large-scale opportunistic targeting of unpatched BeyondTrust Remote Support appliances.
The successful compromise of a trusted remote support appliance can provide attackers with privileged access, credential exposure, visibility into internal networks, and opportunities for lateral movement. As a result, organizations should treat Internet-facing administrative platforms as critical assets and prioritize rapid vulnerability remediation, continuous monitoring, and centralized logging to reduce the risk. eSentire’s Threat Response Unit (TRU) has released a security advisory related to this vulnerability and is actively tracking this topic for additional details and detection opportunities. TRU has developed both Network and Log detections to identify traffic associated with the SAWFLY webshell, BARECLAW SOCKS5 proxy, and post-compromise activity.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
