A BGP hijack that delivered trojanized software updates — with valid TLS certificates the victim had no reason to distrust — is the kind of supply-chain attack that breaks the assumptions most organizations build their update trust models on. That is the lead story today. Alongside it: a CVSS 10.0 zero-day chain hitting SonicWall VPN appliances already exploited in the wild, a Microsoft-documented vishing campaign that turns Teams into an initial access vector, and a court records breach that exposed sealed filings across more than a dozen U.S. states.

In the News

BGP Hijack Delivers Trojanized Hypervisor Updates With Valid TLS Certificates

Attackers executed a Border Gateway Protocol hijack to reroute traffic destined for a legitimate hypervisor vendor’s update infrastructure, serving trojanized Virtualizor packages to downstream customers. The attack is notable for what it bypassed: TLS certificate validation. Because the attacker controlled the route itself — not the certificate — the trojanized packages arrived over a properly authenticated HTTPS connection. The victim’s TLS implementation worked exactly as designed. It just validated the wrong server.

Five of 34 servers that pulled updates during the hijack window were confirmed root-compromised. The attacker held a valid TLS certificate for the update domain, likely obtained through a certificate authority that validated domain control during the period when the BGP hijack was active. This is the supply-chain trust model failure in its purest form: every layer of transport security functioned correctly, but the routing layer underneath was poisoned.

The attack leverages MITRE ATT&CK T1199 (Trusted Relationship) and T1195.002 (Compromise Software Supply Chain). Detection requires monitoring for BGP route origin changes via RPKI validation, anomalous update-server IP resolutions, and integrity verification of downloaded packages beyond transport-layer trust. RPKI (Resource Public Key Infrastructure) is the primary control that would have prevented route acceptance — but adoption remains incomplete across transit providers.

What defenders should do: Implement RPKI route origin validation on all BGP-speaking infrastructure. Deploy software integrity verification (hash or signature checks against an out-of-band published manifest) for all automated update mechanisms. Monitor DNS resolution logs for update domains resolving to unexpected prefixes.

Source: The Hacker News

Microsoft Teams Vishing Campaign Chains RMM Tool Into Full Domain Takeover

Microsoft’s threat intelligence team documented a hands-on-keyboard campaign where threat actors impersonate IT support staff via Teams external collaboration, socially engineer victims into installing a legitimate remote management tool, then deploy a Node.js-based implant for Active Directory reconnaissance and lateral movement to domain controllers. No malware delivery is required for initial access — the RMM tool itself is the vector.

The Node.js runtime abuse is a growing pattern. Because node.exe is a signed, trusted binary present on many enterprise endpoints, traditional signature-based detection does not flag it. The JavaScript C2 implant executes AD reconnaissance commands — nltest, dsquery, net group — from within the Node.js process, blending into legitimate developer tooling activity. This is living-off-the-land (T1218) applied to a runtime environment rather than a system binary.

The campaign maps to MITRE ATT&CK T1566.004 (Phishing via Service), T1219 (Remote Access Software), T1059.007 (JavaScript), and T1087.002 (Domain Account Discovery). The full chain — from initial Teams message to domain controller access — was completed in a single session.

What defenders should do: Restrict external collaboration in Teams to approved domains. Enforce application allowlisting policies that block unauthorized RMM tool installation. Deploy EDR with behavioral detection rules for AD reconnaissance commands spawned by Node.js or other developer runtimes.

Source: Microsoft Security Blog

SonicWall SMA 1000 Zero-Day Chain — CVSS 10.0, Exploited in the Wild

Two chained zero-days in SonicWall SMA 1000 series appliances — CVE-2026-83548 (pre-authentication SSRF, CVSS 10.0) and CVE-2026-83549 (sandbox escape) — enable unauthenticated remote code execution. Both are actively exploited. The SMA 1000 is a VPN concentrator commonly deployed in mid-market and branch environments, and the appliances sit directly on the internet by design.

This is the same pattern that hit Fortinet, Ivanti, and Palo Alto edge appliances over the past 18 months: internet-facing VPN boxes with pre-authentication vulnerabilities that give attackers a foothold before any credential is required. The SSRF-to-sandbox-escape chain is particularly clean — it requires no user interaction, no valid credentials, and no prior knowledge of the target environment. MITRE ATT&CK T1190 (Exploit Public-Facing Application).

What defenders should do: Patch immediately. If patching is not possible within 24 hours, take the appliance offline and move remote access to an alternative mechanism. Long-term, evaluate ZTNA architectures that eliminate the exposed appliance from the network edge entirely.

Source: The Hacker News

Thomson Reuters Court Records Breach Exposes Sealed Filings Across 12+ States

A breach of Thomson Reuters’ court records platform exposed sealed filings and personally identifiable information from government judicial systems across more than 12 U.S. states and Canada. Sealed filings carry legal protection precisely because of their sensitivity — they include records in cases involving minors, confidential informants, ongoing investigations, and trade secrets. The breach vector has not been publicly disclosed.

The incident underscores the third-party risk inherent in government SaaS dependencies. When courts entrust sealed records to a commercial platform, the security posture of that platform becomes a matter of judicial integrity, not just data protection compliance. Organizations in legal, government, and regulated industries should treat this as a prompt to review SaaS vendor security assessments, breach notification SLAs, and data classification controls for their most sensitive records.

What defenders should do: Review third-party risk assessments for SaaS platforms handling sensitive or regulated data. Verify breach notification contractual obligations. Implement DLP and CASB controls that enforce data classification policies even when data resides in third-party platforms.

Source: The Record

Today’s Deep Dive — BGP Hijacking as a Supply-Chain Weapon

The Virtualizor incident is not the first BGP hijack used for traffic interception — the 2018 Amazon Route 53 hijack redirected DNS traffic to steal cryptocurrency, and the 2022 KlaySwap incident used the same technique against a DeFi protocol. What makes this incident operationally distinct is the combination of BGP hijack with a software supply-chain delivery mechanism. The attacker did not steal credentials or cryptocurrency in transit. They served backdoored software packages that victims installed voluntarily because every trust signal — TLS certificate, domain name, HTTPS connection — validated correctly.

The core defensive gap is that most organizations treat TLS as the end of the trust verification chain for software updates. If the certificate is valid and the domain matches, the package is trusted. BGP hijacking breaks this model because the attacker can obtain a valid certificate for the target domain during the hijack window (via HTTP-01 or DNS-01 ACME challenges that resolve to attacker-controlled infrastructure) or, as in this case, present a certificate obtained through other means while controlling the route.

Three controls address this gap at different layers:

  1. RPKI (Resource Public Key Infrastructure) — Route Origin Authorizations (ROAs) allow ASN owners to cryptographically declare which prefixes they are authorized to announce. Transit providers that enforce RPKI validation would have rejected the hijacked route. Adoption is growing but incomplete — roughly 50% of IPv4 prefixes have ROAs published, and enforcement varies by provider.

  2. Code signing with out-of-band key distribution — Software packages signed with keys distributed through a channel independent of the update server (e.g., GPG keys published in vendor documentation or a separate key server) survive a BGP hijack because the attacker cannot forge the signature even if they control the delivery infrastructure.

  3. Binary transparency and reproducible builds — Systems like sigstore and Go’s checksum database provide append-only transparency logs that allow consumers to verify that the package they received matches what the vendor published. A trojanized package delivered via BGP hijack would fail verification against the transparency log.

MITRE ATT&CK mapping: T1195.002 (Compromise Software Supply Chain), T1199 (Trusted Relationship), T1557 (Adversary-in-the-Middle).

Detection Spotlight

Monitor for BGP route origin anomalies and unexpected update-server resolutions. The following Splunk SPL query detects DNS resolutions for known software update domains that resolve to IP addresses outside the expected prefix range — a high-fidelity indicator of route hijacking or DNS manipulation targeting update infrastructure:

index=dns sourcetype="stream:dns"
  query IN ("updates.virtualizor.com", "mirror.virtualizor.com", "repo.virtualizor.com")
| eval resolved_ip=answer
| lookup known_update_prefixes domain AS query OUTPUT expected_prefix
| where NOT cidrmatch(expected_prefix, resolved_ip)
| stats count by query, resolved_ip, expected_prefix, src_ip
| where count > 0

This query requires a known_update_prefixes lookup table mapping update domains to their expected IP prefixes. Populate it from vendor-published infrastructure documentation or historical DNS resolution baselines. False positive rate is low when the lookup table is accurate — any match indicates the update domain resolved to an IP outside the vendor’s declared infrastructure.

For BGP-level detection, organizations running their own routing infrastructure should monitor for unexpected origin ASN changes on prefixes belonging to critical software vendors using BGPStream or RIPE RIS data feeds.

Defender Action Items

  • Patch SonicWall SMA 1000 appliances immediately for CVE-2026-83548 and CVE-2026-83549 — or take offline within 24 hours
  • Patch JFrog Artifactory for CVE-2026-82329 and rotate all admin tokens
  • Restrict Microsoft Teams external collaboration to approved tenant domains
  • Deploy application allowlisting rules blocking unauthorized RMM tool installation
  • Implement RPKI Route Origin Validation on BGP-speaking infrastructure
  • Verify software update integrity through code-signing verification independent of TLS
  • Review third-party risk assessments for SaaS platforms holding sealed, classified, or regulated data
  • Patch Cisco IOS XR and Nexus infrastructure per SecurityWeek advisory for critical RCE and auth bypass flaws

Detection Queries

Behavioral detection for Node.js-spawned Active Directory reconnaissance (Microsoft Defender for Endpoint KQL):

DeviceProcessEvents
| where InitiatingProcessFileName == "node.exe"
| where FileName in~ ("nltest.exe", "dsquery.exe", "net.exe", "net1.exe", "csvde.exe", "ldifde.exe")
| project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| sort by Timestamp desc

This detects AD reconnaissance commands spawned by Node.js processes — the exact pattern documented in the Microsoft Teams vishing campaign. False positive rate: low in non-development environments; moderate on developer workstations running Node.js build tooling. Tune by excluding known CI/CD build agents by DeviceName.

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) — Daily cybersecurity news, SE angles, and detection queries.