October 12, 2026 Emerging Threats Weekly

This week’s briefing covers:

00:00 – Intro

00:54 [VULNERABILITY] Atlassian Self-Hosted Flaw Moved To Exploitation Within Hours
On 5 October, Atlassian disclosed critical vulnerability, CVE-2026-21589, giving it a CVSS score of 9.3. The arbitrary file-access vulnerability affects self-hosted Data Center deployments of Bitbucket, Confluence, Jira, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye.

03:12 [CAMPAIGN] Blinder Tunnel Uses Trojanized Coding Challenges Against Iraqi Infrastructure
Palo Alto’s Unit 42 has identified an Iranian state-aligned activity cluster tracked as CL-STA-1178 conducting operations under the campaign Blinder Tunnel. The campaign targeted Iraqi critical infrastructure in March 2026 after staging infrastructure as far back as November 2025.

06:21 [RANSOMWARE] Warlock Continues to Leverage SharePoint for Initial Access
China-linked KTA492, also known as WARLOCK, continues to gain access through on-premises SharePoint exploitation. Recent victims include a water utility, a telecom provider, a regional government body and a university. Reported targeting over the last two months has centered on Portuguese- and Spanish-speaking countries across Europe, Africa and Latin America.

08:50 [CAMPAIGN] BPFDoor And AVERAT Blend Into Telecom Network Edge Traffic
Mandiant and Google Threat Intelligence Group (GTIG) have reported on a second wave of mass exploitation of Oracle PeopleSoft by KTA223 (ShinyHunters) while expanding their targeting beyond the education-sector activity seen during the first wave we reported in June.

11:37 [MALWARE] ClingSTUN Turns Unpatched Edge Devices into Proxy Nodes
FortiGuard Labs has identified a new Linux backdoor known as ClingSTUN, which exploits known vulnerabilities in internet-facing routers, DVRs, IoT platforms and embedded systems. The campaign has used multiple download infrastructures and a growing collection of vendor-specific exploits affecting EnGenius, D-Link, Linear, Realtek, TP-Link, AVTECH, Ivanti, Hytec, Tenda, Lantronix, MeiG and other products.

Dive deeper:

Kroll’s Monthly Threat Intelligence Spotlight Report: https://www.kroll.com/en/reports/cyber/threat-intelligence-reports/cti-spotlight-trends-report

Kroll’s Cyber Threat Intelligence: https://www.kroll.com/en/services/cyber/threat-intelligence-services

Kroll’s 2025 Cyber Threat Landscape Report: Cybercrime in the Crypto Era: https://www.kroll.com/Reports/Cyber/Threat-Intelligence-Reports/Threat-Landscape-Report-Lens-on-Crypto

Playlist of Kroll's Weekly Cyber Threat Intelligence Briefings: https://www.youtube.com/playlist

Kroll Cyber Blog: https://www.kroll.com/en/insights/cyber

Kroll Threat Intelligence Reports: https://www.kroll.com/en/reports/cyber/threat-intelligence-reports

Kroll Cyber and Data Resilience: https://www.kroll.com/en/services/cyber

#krollcyber #threatintelligence #cyberthreats