Daily Drop (1351)

Friday, Aug 21, 2026 // Buy Bob a Coffee // Ghostwire

Bottom Line Up Front (BLUF): A 2026 U.S. presidential memorandum reportedly creates a federal program allowing vetted private companies to conduct government-approved offensive cyber operations against foreign transnational cybercrime organizations. While the program introduces operational controls, including per-mission authorization, federal deconfliction, and a minimum $1 million bond, the legal foundation remains unsettled. The central issue is whether the Computer Fraud and Abuse Act’s law-enforcement exception under 18 U.S.C. § 1030(f) can lawfully extend to private contractors acting under federal direction. That theory has not been tested in court, leaving participating firms potentially exposed if judges later reject the government’s interpretation.

Analyst Comments: Traditional hack-back activity can implicate both unauthorized-access provisions under § 1030(a)(2)(C) and damage provisions under § 1030(a)(5). The new program reportedly attempts to bridge that gap by treating participating firms as delegated actors conducting authorized investigative, protective, or intelligence activity under § 1030(f). That is the weak point. Unlike the failed Active Cyber Defense Certainty Act proposals, which sought to change federal law through Congress, the memorandum relies on executive interpretation of existing law. If a court ultimately decides that § 1030(f) protects only government agencies and not private delegates, contractors could face legal exposure despite having followed the program’s procedures. The source characterizes this as a potentially retroactive risk, although that outcome remains hypothetical because the issue has not yet been litigated.

READ THE STORY: Codeby

Bottom Line Up Front (BLUF): Bitdefender researchers uncovered a long-running cyberespionage campaign dubbed SilkParasite targeting government organizations across Central Asia and the South Caucasus. Assessed with medium confidence as China-nexus activity, the operation uses multiple remote access trojans (RATs), including the newly documented DriveSilkRAT, which abuses shared Google Drive folders for command-and-control (C2). By routing tasking and exfiltration through trusted Google infrastructure, the actors can blend malicious activity into legitimate cloud traffic while reducing dependence on attacker-owned C2 servers.

Analyst Comments: The Google Drive C2 technique is the most operationally significant part of this campaign. Enterprises frequently allowlist or heavily trust Google Workspace traffic, which gives attackers a built-in camouflage layer. Rather than beaconing to an obviously malicious domain, DriveSilkRAT polls a shared Drive folder for tasking, executes downloaded .NET plugins in memory, and uploads results through the same service. The campaign also shows mature tradecraft beyond cloud C2. SilkParasite relies heavily on DLL sideloading with legitimate signed applications, modular payloads, WMI-based process execution, and password-protected archives designed to frustrate mail inspection. Those techniques reduce obvious endpoint artifacts and make the operation harder to distinguish from normal administrative activity.

READ THE STORY: GBhackers

Bottom Line Up Front (BLUF): Kaspersky’s GReAT team uncovered new Project CAV3RN components showing that the Israel-focused espionage framework now uses DNS as a control plane to dynamically select between direct HTTPS command-and-control and a Google Apps Script relay. The malware can also validate and replace its Google Apps Script deployment ID through DNS, giving operators a resilient fallback mechanism if one communications path is disrupted. Researchers also identified a local DLL broker that loads, routes, and upgrades modular components at runtime.

Analyst Comments: The framework uses DNS to decide which C2 path should handle each transaction, allowing it to fail over between attacker-controlled HTTPS infrastructure and a legitimate Google-hosted relay. That complicates blocking because defenders cannot assume disabling one endpoint or domain will sever communications. The Google Apps Script relay is especially useful for blending malicious traffic into trusted services. Organizations often permit access to script.google.com, so C2 over Apps Script can hide inside traffic that would otherwise look routine. CAV3RN adds another layer of resilience by using DNS to verify whether the stored Apps Script deployment ID is still current and retrieve a replacement if necessary.

READ THE STORY: Securelist

Bottom Line Up Front (BLUF): Silent Push researchers found that the PEER2PROFIT bandwidth-sharing application supplies residential proxy capacity to commercial provider ASTROPROXY and can expose more than a user’s public IP address. In controlled testing, researchers bypassed ASTROPROXY’s private-IP restrictions by requesting a domain that resolved to an internal address, then successfully retrieved a file from a residential router’s management interface. The finding creates particular risk for remote workers and enterprise environments where legitimate bandwidth-sharing software could unintentionally turn an internal network into reachable infrastructure for external proxy customers.

Analyst Comments: The biggest issue here is that PEER2PROFIT does not need to behave like malware to create a serious security problem. It is legitimate software installed with user consent, which means traditional antivirus and threat-intelligence controls may have little reason to flag it. From a defender’s perspective, that is exactly what makes residential proxyware dangerous: trusted software can create an externally accessible path into networks that were never intended to be exposed. Silent Push’s test is more concerning than the usual “your IP address is being resold” discussion. ASTROPROXY reportedly blocked direct requests to RFC1918-style private addresses, but researchers bypassed that control using a hostname that resolved to an internal IP. They then accessed a router management interface through an enrolled PEER2PROFIT node and downloaded a PNG file as proof of reachability.

READ THE STORY: Cyber Press

Bottom Line Up Front (BLUF): Researchers uncovered a compact 12 KB Windows backdoor that masquerades as Realtek software, persists through a permanent WMI event subscription, and reconstructs its command-and-control domain from trailing UTF-16LE spaces hidden inside C:\ProgramData\desktop.ini. The implant was found on a single domain-joined Windows 7 SP1 workstation, suggesting possible selective targeting. Its C2 domain, diagrtrack[.]com, typosquats Microsoft’s DiagTrack telemetry service and is recovered by counting whitespace on successive lines rather than storing the hostname directly in the binary.

Analyst Comments: This implant avoids packers, encrypted strings, import hashing, anti-debugging code, and other techniques that often attract attention. Instead, it hides a critical configuration value using something defenders rarely inspect closely: whitespace inside a legitimate Windows shell configuration file. That design defeats a surprisingly large class of static detections. There is no obvious domain string embedded in the executable, and even the desktop.ini filename is constructed from separate literals. The malware then abuses a legitimate-looking path and process name, RtkNGUI64.exe, to blend into expected Realtek software while using WMI for durable persistence.

READ THE STORY: Gbhackers

Bottom Line Up Front (BLUF): Security researchers identified malicious code in version 1.4.1 of the Rust crate onering, a package with more than 18,000 downloads on crates.io. The compromised release adds a build.rs script that executes automatically during compilation, collects Git commit metadata and the full diff between the latest two commits, then exfiltrates that data to a Sentry ingestion endpoint. Because Cargo build scripts run without developers explicitly invoking package functionality, simply building a project that includes the affected dependency can trigger source-code theft.

Analyst Comments: This is a strong example of why build-time execution deserves the same scrutiny as runtime execution. Rust’s build.rs mechanism is legitimate and widely used, but it gives dependencies code-execution opportunities during compilation. That makes a compromised crate capable of reaching into the consuming repository before the application ever runs. The target selection is also notable. Rather than stealing only credentials, API tokens, or wallet data, the malicious script harvests git diff HEAD^ HEAD along with commit metadata. That can expose unreleased features, proprietary implementation details, security fixes, accidentally committed secrets, and recent architectural changes. Repeated builds could effectively provide an attacker with a rolling feed of source-code changes.

READ THE STORY: Gbhackers

Bottom Line Up Front (BLUF): GitLab vulnerability CVE-2026-19478, rated CVSS 9.4, is reportedly being exploited in the wild only days after public disclosure. The unauthenticated code-injection flaw affects GitLab Community Edition (CE) and Enterprise Edition (EE) and can allow attackers, under certain conditions, to modify or delete publicly accessible projects without credentials or user interaction. watchTowr says it reproduced the vulnerability within minutes and subsequently observed exploitation attempts against its honeypot infrastructure. Internet-facing self-hosted GitLab instances should be patched immediately.

Analyst Comments: According to watchTowr, successful exploitation can allow an attacker to delete repositories, alter project data, forge merge records so malicious changes appear legitimate, and ban project maintainers. For organizations using GitLab as a source-of-truth for production code, infrastructure-as-code, CI/CD configuration, or security fixes, repository integrity is the real issue. The exploitation timeline is equally important. watchTowr says researchers reproduced the vulnerability within minutes of disclosure and observed in-the-wild activity shortly afterward. Its researchers argue that AI-assisted vulnerability analysis is helping compress the gap between publication and weaponization. Whether AI specifically drove the observed attacks is not established by the article, but the operational lesson remains: high-impact, Internet-facing vulnerabilities can no longer safely wait for routine patch cycles.

READ THE STORY: THN

Bottom Line Up Front (BLUF): The Centre for Cybersecurity Belgium (CCB) is urging organizations to immediately patch CVE-2026-53413, an out-of-bounds write vulnerability affecting Zoom Workplace, Zoom Rooms, Zoom Meeting SDK, Zoom Video SDK, and related VDI components. According to the advisory, a malicious meeting participant can send specially crafted annotation data that corrupts client memory and may lead to arbitrary code execution on another participant’s device without requiring the victim to click a link or download a file. The flaw carries a CVSS 3.1 score of 8.3 and affects supported Zoom clients across Windows, macOS, Linux, iOS, and Android.

Analyst Comments: This is a high-priority enterprise patch because Zoom sits directly on employee endpoints and routinely processes untrusted data from external meeting participants. An attacker does not need to compromise a web server or convince the victim to open an attachment; the attack surface is the meeting session itself. The vulnerability is caused by a missing bounds check in Zoom’s annotation functionality. Specially crafted annotation messages can trigger an out-of-bounds write, corrupting memory and potentially transitioning from a meeting-level interaction to code execution on the endpoint. That makes external meetings an especially relevant exposure path for organizations that regularly collaborate with customers, vendors, or other third parties.

READ THE STORY: CCB

Bottom Line Up Front (BLUF): Cisco disclosed five vulnerabilities in Secure Workload Software, formerly Tetration, including two CVSS 10.0 flaws, plus vulnerabilities rated 9.9, 9.6, and 7.5. The issues span authentication and authorization failures, command or OS injection, improper input validation, and memory-safety problems. Cisco has already remediated its SaaS infrastructure, but cloud customers still need to update associated Agent and Connector components, while on-premises deployments require upgrades to fixed releases. Cisco says it has not detected malicious exploitation.

Analyst Comments: Two perfect-score access-control vulnerabilities in a micro-segmentation platform deserve immediate attention. Secure Workload is specifically designed to restrict lateral movement, so compromise of the control or enforcement layer could undermine the defensive boundary organizations depend on to contain attackers. The combination of authentication bypass and injection vulnerabilities is particularly concerning. CVE-2026-20315 and CVE-2026-20317 involve improper access controls and authentication weaknesses, while CVE-2026-20231, rated 9.9, covers improper neutralization of special elements associated with command, OS, or argument injection. Cisco has provided limited public technical detail, so defenders should avoid assuming specific exploit prerequisites beyond what the vendor documents.

READ THE STORY: The Register

Bottom Line Up Front (BLUF): The Foundation for Defense of Democracies argues that the current U.S.-Iran confrontation in the Strait of Hormuz is as much an energy-security contest as a military one. In an August 18 discussion, FDD’s Mark Dubowitz and Richard Goldberg examine Iran’s leverage over one of the world’s most important oil transit routes, the resilience of global energy markets, alternative routes around the strait, expanding U.S. energy production, and China’s exposure to disruptions. Their central argument is that greater U.S. energy capacity has reduced Washington’s vulnerability to Iranian pressure, although the supplied excerpt does not provide detailed market data or independent evidence sufficient to validate that conclusion.

Analyst Comments: Hormuz remains a strategic chokepoint because even limited disruption can create effects far beyond the Gulf through shipping delays, insurance costs, energy-price volatility, and downstream supply-chain pressure. That makes the strait useful to Iran as a coercive lever even without a complete closure. The more important shift is structural. Higher U.S. oil and gas production gives Washington more insulation from external supply shocks than it had during earlier Gulf crises. That does not make the United States immune: crude prices are globally priced, and significant disruption in Hormuz would still affect American consumers and allies. But domestic production can reduce dependence on direct imports from the region and provide policymakers more room to absorb short-term shocks.

READ THE STORY: FDD

FROM THE MEDIA: Escalating tensions in the Gulf have intensified fears over a potential disruption at the Strait of Hormuz, a vital maritime route that carries nearly 20% of the world's oil supply. Strikes on facilities operated by Saudi Aramco and reported tanker incidents near Oman have heightened market anxiety, pushing Brent crude above $80.

FROM THE MEDIA: he CSIS Energy Security and Climate Change Program is pleased to host Jérôme Bilodeau, Head of Analysis (Energy Efficiency and Inclusive Transitions), International Energy Agency (IEA), for a discussion on the global energy implications of the Strait of Hormuz crisis and how governments have responded to disruptions in energy markets.

The selected stories cover a broad range of cyber threats and are intended to help readers frame key publicly discussed threats and improve overall situational awareness. InfoDom Securities does not endorse any third-party claims made in its original material or related links on its sites; the opinions expressed by third parties are theirs alone. For further questions, don’t hesitate to get in touch with InfoDom Securities at dominanceinformation@gmail.com.