ThreatsDay Roundup: Adobe RCE, DNS Wallet Theft, NVIDIA Escape, and Self-Healing Backdoor Highlighted
A weekly roundup of cybersecurity threats reveals active exploitation of PAN-OS, a novel DNS-based cryptocurrency wallet drainer, an NVIDIA container escape vulnerability, and a self-healing backdoor with psychological harassment features.
This week's security landscape is marked by a diverse array of threats, from active ransomware campaigns exploiting critical vulnerabilities to novel methods of cryptocurrency theft and sophisticated remote access trojans. The ThreatsDay roundup details these evolving tactics, underscoring the persistent challenges organizations face in defending against both established and emerging cyber risks.
One significant development is the active exploitation of CVE-2026-0257, an authentication bypass vulnerability affecting PAN-OS GlobalProtect and Prisma Access. Despite being disclosed in May 2026, ransomware groups like Qilin and Settra are actively leveraging this flaw to gain initial network access. Security researchers warn that this access, originating through a company's own VPN, can easily be mistaken for legitimate remote work, potentially allowing attackers to conduct credential theft, lateral movement, data exfiltration, and ransomware deployment undetected until significant damage has occurred. Organizations are urged to patch affected deployments immediately, disable authentication override cookies where not required, terminate active GlobalProtect sessions post-patching, and investigate any unusual connections.
A novel cryptocurrency theft technique has emerged with the discovery of a tool dubbed Noir, which utilizes DNS TXT records to locate its command-and-control infrastructure hosted on Cloudflare Pages. This drainer operates without requiring seed phrases, passwords, or private keys. Instead, it delivers tailored content after obtaining initial read permissions, devises a plan for the specific wallet, and then secures spending permissions that may appear less alarming than direct transfers. The theft is executed from attacker-controlled infrastructure, and researchers suspect AI assistance in its creation and maintenance.
Researchers have also detailed an NVIDIA container escape vulnerability, allowing potential compromise of host systems from within a virtualized environment. While specific details on exploitation remain under wraps, such vulnerabilities pose a significant risk to cloud and containerized deployments, where isolation is a key security tenet. The ability for a guest container to break out and affect the host could lead to widespread system compromise.
Adding a peculiar and concerning dimension to the threat landscape is a self-healing backdoor, KGB RAT, which combines advanced remote access trojan capabilities with psychological harassment features. Marketed on underground forums as fully undetectable, it includes a crypter, HVNC, credential theft, and ransomware functionalities. What sets it apart are its "fun settings," which include screamer functions, jump scares, and forced blue screens of death, indicating threat actors comfortable weaponizing victim anxiety alongside data theft. This RAT has been in development for years, with public references to its servers dating back to early 2022.
Further complicating defenses, a Rust-based remote access trojan named CikaBika Bot has been observed using Discord for its command-and-control (C2) infrastructure. This RAT employs a Nim loader, PowerShell UAC bypass, and DLL search-order hijacking before leveraging Discord for C2, reconnaissance, remote execution, and data exfiltration, often via ngrok. The malware also possesses capabilities for screenshot capture and file transfers, making it a versatile tool for attackers.
Another stealthy threat, codenamed BotHelper RAT, employs a multi-stage infection chain on Windows to achieve live screen surveillance. The initial stage fingerprints the host and retrieves a .NET RAT payload, which then copies itself to a hidden location, establishes persistence via scheduled tasks, patches the Antimalware Scan Interface, and registers with the delivery host for tasking. This RAT's ability to perform live screen surveillance poses a significant risk to user privacy and sensitive data.
Finally, the report touches upon the broader implications of small permissions leading to significant data theft and the continued exploitation of older vulnerabilities. It also highlights the escalating use of hybrid warfare tactics across Europe, involving a complex mix of psychological, cyber, and physical tactics aimed at degrading critical infrastructure and sowing fear. These diverse threats underscore the need for continuous vigilance and adaptive security strategies.