PROVINTELL Cyber Security

04/08/2026

A sophisticated software supply chain attack has been discovered targeting developer tools through 18 malicious packages including lib-mtop, aone-kit, and local-config-parser that impersonate legitimate private packages from the scope. The malicious packages contain loaders that fetch remote JavaScript payloads via curl and execute them, establishing a cross-platform remote access trojan on infected systems. The attack chain employs a multi-stage dependency tree where top-layer packages act as decoys to trigger installation of malicious dependencies, with a rule engine executing final payloads that contact command-and-control infrastructure masquerading as Alibaba domains to evade detection. The campaign appears focused on industrial espionage targeting Chinese-speaking developers within Alibaba Group companies, though its full impact remains difficult to assess due to targeted delivery and lateral movement capabilities. Organizations that may have installed these packages should assume compromise, immediately rotate credentials from clean systems, and conduct thorough audits of developer environments for indicators of malicious activity.



Contributed by: Anas Danial

A sophisticated software supply chain attack has been uncovered, targeting users of Alibaba developer tools with a cross-platform remote access trojan. The attack involves 18 malicious npm packages, including lib-mtop, aone-kit, and local-config-parser, which are designed to impersonate private pack...

28/07/2026

Security researchers have identified active exploitation of , a critical remote code ex*****on vulnerability with a CVSS score of 9.0 affecting hashtag versions 1.2.68 through 1.2.83. The flaw enables unauthenticated attackers to execute arbitrary code on vulnerable fat-JAR applications by sending malicious JSON payloads that abuse Fastjson's type resolution mechanism, bypassing validation through annotation-based trust without requiring AutoType enablement or classpath gadgets. Exploitation attempts have been observed targeting financial services, healthcare, retail, and technology sectors, with attacks focusing on applications exposing JSON.parse, JSON.parseObject(String), or JSON.parseObject(String, Class) methods that deserialize user-controlled data into Object or Map fields. No patched Fastjson 1.x release is currently available, prompting recommendations to enable SafeMode, deploy the restricted 1.2.83_noneautotype build as an interim measure, and prioritize migration to hashtag , which remains unaffected by this vulnerability. Organizations running affected configurations should conduct immediate assessments of exposed parsing endpoints and implement compensating controls until full remediation is achievable.



Contributed by: Fatini

28/07/2026

Attackers successfully breached Thailand's Ministry of Finance using , an open-source AI agent framework, to conduct autonomous reconnaissance and data collection in what represents one of the first documented cases of adversaries weaponizing autonomous for nation-state espionage.

Deployed in unrestricted " without safety guardrails, operated independently to navigate networks, execute lateral movement, and exfiltrate data at machine speed following initial access gained through conventional vectors like spear-phishing. The AI agent's ability to dynamically adjust to environmental feedback and bypass security controls significantly compressed typical dwell times and reduced manual operational overhead for attackers. This incident demonstrates the active deployment of AI-augmented cyber espionage that lowers the skill barrier for adversaries and enables scalable attacks across multiple targets. Organizations must now develop detection strategies focused on identifying autonomous behavior patterns such as unusually rapid enumeration and non-human API timing, while prioritizing strict network segmentation, enhanced logging, and advanced behavioral analytics to counter this emerging threat vector.



Contributed by: Anas Danial

Attackers breached Thailand's Ministry of Finance using Hermes, an open-source AI agent framework, to conduct autonomous reconnaissance and data collection. The Ministry, holding sensitive fiscal and economic intelligence, is a high-value target for nation-state espionage. This incident is one of th...

22/05/2026

Microsoft disclosed two actively exploited Defender zero-days. CVE-2026-41091 is a privilege escalation flaw in the Malware Protection Engine (v1.1.26030.3008 and earlier) that lets a local attacker elevate to SYSTEM privileges through a "link following" weakness. As it requires existing local code ex*****on, it acts as a post-compromise threat rather than an initial-access vector. CVE-2026-45498 affects the Defender Antimalware Platform (4.18.26030.3011 and earlier) and triggers denial-of-service states that can blind endpoint protection. CISA has added both to its Known Exploited Vulnerabilities catalog and requires federal agencies to patch them by June 3, 2026. Recommended actions include enabling automatic Antimalware Platform and definition updates, enforcing least-privilege access, and monitoring Defender logs for unusual link-following activity.



https://provintell.com/2026/05/22/microsoft-defender-zero-days-expose-windows-systems/

Contributed by Fatini

Microsoft recently warned of two zero-day vulnerabilities in its Defender software that have been exploited in attacks. The first vulnerability, tracked as CVE-2026-41091, is a privilege escalation security flaw affecting Microsoft Malware Protection Engine versions 1.1.26030.3008 and earlier. This....

02/04/2026

On 4 April 2026, we will be introducing our CodeRed-AI CoPilot ( ), which is integrated into our upgraded 3.0 providing our SOC analysts and customers with AI-native threat hunting capabilities on external and internal threats.

We named our AI agent "Ask SIMON", in our tribute and memory of The Late Simon Teh Seng Meng, who departed on 4 April 2022. He was our first SOC Manager, and best to be remembered as a good friend and dedicated colleague.

May his legacy and dedication to cybersecurity industry lives on.

30/03/2026

A targeted cyberattack on a South Asian financial institution used two , and , to maintain access, steal sensitive data, and monitor user activity. BRUSHWORM acted as the main backdoor by posing as a legitimate program, creating scheduled tasks for persistence, contacting a remote server to download payloads and exfiltrate documents, and spreading through USB drives with deceptive corporate-style filenames. BRUSHLOGGER operated separately by impersonating a trusted system library and silently capturing keystrokes and active window titles, allowing attackers to steal credentials, financial data, and internal communications. Although the malware was not highly sophisticated and showed weak coding practices, it still caused significant damage due to social engineering, USB propagation and limited endpoint visibility in the victim environment.



https://provintell.com/2026/03/30/malware-targets-financial-institutions-with-brushworm-and-brushlogger/

Contributed by: Fatini

A targeted cyberattack against a South Asian financial institution leveraged two custom malware tools to establish persistence, steal sensitive data, and capture user activity. Researchers said the operation relied on a modular backdoor, BRUSHWORM, and a keylogger, BRUSHLOGGER, delivered as separate...

21/03/2026

Selamat Hari Raya Aidilfitri 2026 ! Semoga Syawal ini membawa kegembiraan, kedamaian dan semangat baru kepada semua. Salam kemaafan, Maaf Zahir dan Batin atas segala silap salah.

Wishing you a blessed Hari Raya Aidilfitri 2026. May this festive season bring renewed joy, prosperity, and meaningful connections.

05/03/2026

is an AI-powered offensive security platform that has begun to be abused in real-world cyberattacks. Developed as an open-source red-team tool by a China-based coder known as , it combines over 100 security tools with generative AI services like Claude and DeepSeek to automate reconnaissance, vulnerability discovery, and attack-chain analysis. Its automated workflows and easy-to-use interface significantly lower the technical barrier for attackers, enabling large-scale campaigns such as the compromise of more than 600 Fortinet FortiGate devices across 55 countries. This highlights how AI is increasingly being integrated into offensive cyber operations, allowing attackers to scale and execute intrusions more efficiently.



https://provintell.com/2026/03/05/fortinet-infrastructure-targeted-in-campaign-using-open-source-ai-offensive-framework/

Contributed by: Thivya

CyberStrikeAI marks a new era in cyber threats, where an open-source AI-native platform designed for offensive security testing has been weaponized in real-world attacks. Developed by a China-based coder known as Ed1s0nZ, this Go-built tool integrates over 100 security tools, an intelligent orchestr...

23/02/2026

Amazon Threat Intelligence uncovered a Russian-speaking, financially motivated actor that compromised over 600 firewalls in 55+ countries by targeting exposed management interfaces and using large-scale credential stuffing instead of zero-days. After gaining access, the attacker exfiltrated configuration files with admin and VPN credentials, then moved laterally to domain controllers and backup systems like Veeam, using techniques such as DCSync, pass-the-hash, and NTLM relay in behavior aligned with ransomware staging. The campaign notably leveraged commercial generative AI to create reconnaissance tools and structured attack plans, enabling a scalable, assembly-line intrusion model despite the actor’s relatively low skill level, though poor operational security and visible AI-generated artifacts exposed weaknesses in their tradecraft.



Contributed by: Aiman

Amazon Threat Intelligence has uncovered a Russian-speaking, financially motivated threat actor that leveraged commercial generative AI services to compromise more than 600 FortiGate firewalls across 55+ countries between January 11 and February 18, 2026. Rather than exploiting zero-day vulnerabilit...

20/02/2026

In the year of the Fire Horse, may your endeavors gallop forward with unstoppable energy, turning visions into victories, challenges into breakthrough, fresh ideas into innovation.

Wishing you a year full of speed, strength and exciting leaps forward.