Summary
Attackers are routing command-and-control traffic through the decentralized Yggdrasil mesh network to evade detection, as seen in the MythicRatatoskr backdoor campaign that struck a Ukrainian grain logistics firm. Cyware highlights how this operation, linked to UAC-0099 and Sandworm, escalated from stealthy access to outright data-wiping, putting both business continuity and physical exports at risk.
Critical PHP zero-days are enabling unauthenticated remote code execution and have already triggered real-world outages, including a 5-hour downtime for a major news publisher. With attackers exploiting these flaws before public disclosure, organizations face urgent patching decisions to avoid being swept up in widespread web server compromises.
A newly emerged ransomware group, n0n, is leveraging supply-chain attacks to hit over 40 maritime companies, demanding ransoms totaling $1.2 billion and leaking data when victims refuse to pay. This campaign exposes the ripple effects of a single IT provider breach, threatening global shipping operations and sensitive commercial data.
Top Malware Reported in the Last 24 Hours
MythicRatatoskr backdoor hides in Yggdrasil
MythicRatatoskr is a Go-based backdoor that stands out for routing its command-and-control traffic through the decentralized Yggdrasil mesh network, a choice that can make malicious connections harder to spot and disrupt. It arrived after attackers first planted the MATCHWOK backdoor, giving them capabilities such as file transfer, screenshot capture, and proxy management while persisting as a Windows service. ESET Research linked the operation to a collaboration between UAC-0099 and Sandworm, with a later phase escalating to a data-wiping attack that used SDelete pushed via Active Directory Group Policy. For the targeted Ukrainian grain logistics firm, this kind of access can translate into stolen data, operational disruption, and outright destruction of systems. Recommended actions in the report include blocking public peer addresses associated with the Yggdrasil network, considering the potential existence of a Linux variant, and enhancing email security to reduce spearphishing risk.
Stadia RAT rises from StealC
Stadia is a newly marketed remote access trojan (RAT) that Varonis says emerged from the remnants of the StealC infostealer, with its seller rebranding and courting former customers with a free month on the Pro tier. It is built around modular capabilities that give operators hands-on control, including hidden desktop access (HVNC), remote command execution, file management, and process manipulation—tools that can quickly turn a single infection into full device takeover. Varonis reports that it communicates with its C2 using encrypted messages disguised as JSON, adding friction for defenders trying to separate routine traffic from malicious control. For victims, the practical consequence is that attackers can quietly browse files, run commands, and deploy additional payloads without obvious on-screen signs. The report’s specific recommendations include blocking Stadia-related C2 IPs, monitoring the SHA-256 hash ea928494fd30d88b98141d39a502a4324889fb732e74b44bfee12c72137dd73e, and detecting scheduled tasks created with a 15-minute interval and hidden status.
Armorsteal lures users via SEO traps
Armorsteal is a Python-based malware family delivered through an SEO poisoning campaign that tricks people searching for common tools into running malicious PowerShell commands from convincing fake sites. Zscaler says the operation impersonates download pages for Chocolatey and Microsoft Activation Scripts, then uses the resulting foothold for remote access, surveillance, and information theft that can include browser data, Discord tokens, and cryptocurrency wallets. It also tries to dodge analysis by checking public IP and organization details before fully running, while its infrastructure shifts to stay online. For individuals and businesses, that blend of search-driven exposure and credential theft means a routine “download” can quickly become account takeover and financial loss. The report calls out blocking C2 domains such as workerstats[.]net and datamons[.]org, reviewing PowerShell logs for downloads from choclatey[.]org and massgravel[.]net, and removing unauthorized Microsoft Defender exclusions.
Top Vulnerabilities Reported in Last 24 hours
PHP zero-days trigger real-world outages
Two critical PHP zero-days, CVE-2026-109618 and CVE-2026-109619, enable unauthenticated remote code execution (RCE) that can hand over control of a vulnerable web server, with reports warning the impact could reach a large share of the web. The attack path centers on memory-safety bugs—described as memory corruption and use-after-free conditions—that can be triggered via web requests before an application has a chance to defend itself. Attackers are already exploiting this in the wild, and AWS said its MadPot telemetry saw “PHP2Shell” exploit attempts starting on October 17, 2026, four days before public disclosure. The incident is already causing disruption: SW Newsmagazine reported a 5-hour outage after its hosting provider took emergency defensive measures, underscoring how patching can translate into immediate downtime decisions for publishers and businesses. A fix is available in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 (affecting versions prior to those releases).
Firewall managers hit by root takeover bug
A critical flaw in Cisco Secure Firewall Management Center, CVE-2026-20079 (CVSS 10.0), can let attackers gain root access to the system that administers firewall policies and credentials. The reported exploitation method combines session fixation with CSRF token exploitation, creating a path to bypass authentication and take control of the management plane. Attackers are already exploiting this in the wild, and Cisco PSIRT acknowledged active exploitation in August 2026 after the issue was disclosed on March 4, 2026. Cisco Talos tracks three actor clusters exploiting it—UAT-12197, UAT-11823, and UAT-11988—with activity described as deploying web shells, exfiltrating configurations, and deploying ransomware. Hotfixes are available (released July 29, 2026) for affected versions 7.0.x through 7.7.12 and 10.0.0–10.0.1.
GitLab bug opens door to server code execution
GitLab shipped critical patches for a vulnerability that can allow unauthenticated code execution on GitLab servers, potentially putting source code, CI/CD pipelines, and sensitive data at risk. The key issue highlighted is CVE-2026-110264, described as an integer overflow in the regular expression compiler that could be abused to run attacker-chosen code. The article warns that exploitation has been active, reinforcing how quickly widely deployed developer platforms can become targets once a working path is known. InfoWorld also flags a related “trusted flag” problem in Workhorse that could create risk for AI-enabled systems by enabling unauthorized tool access. Fixes are available in patched GitLab releases including 19.5.1 and backports, and the affected range is described as GitLab CE/EE 7.0 to 19.5.0.
Top Threat Actors Reported in Last 24 hours
UAC-0099 and Sandworm deploy MythicRatatoskr
UAC-0099, a Ukraine-focused threat actor, teamed up with Sandworm (also tracked as a Russian-linked unit) in an intrusion that blended espionage-style access with a destructive finish at a Ukrainian grain logistics company. They got in via spearphishing on July 16, 2025, deployed the MATCHWOK backdoor, and then followed up the next day with MythicRatatoskr, a Go-based backdoor designed to hide its command-and-control inside the decentralized Yggdrasil mesh network. The malware persists as a Windows service, uses AES-encrypted configuration files, and communicates using HTTPS within Yggdrasil, making its traffic harder to spot in typical perimeter monitoring. For a business tied to grain movement, the stakes go beyond IT downtime: disruption here can spill into real-world logistics and exports. ESET researchers said the campaign culminated on September 17, 2025, when Sandworm used SDelete via Active Directory Group Policy for a data-wiping attack.
Recommended actions in the report include blocking Yggdrasil public peer addresses, monitoring for MythicRatatoskr host artifacts and service names, investigating and blocking identified IOCs, and strengthening email security against spearphishing; the write-up also flags the possible existence of a Linux variant.
Prince of Persia hides C2 in US
Prince of Persia, an Iranian cyber-espionage group, has been observed running parts of its malware operation from US-based command-and-control servers, a choice that can complicate tracking and takedowns. Researchers at Semperis tied the activity to the group’s long-running campaigns and described malware such as Tornado being used for data theft, including document exfiltration and audio capture. Instead of relying only on overtly suspicious beacons, they blend malicious communications with legitimate-looking network traffic in an effort to slip past firewalls and routine monitoring. The group targets organizations across the US, Europe, and the Middle East, putting sensitive internal discussions and intellectual property at risk when a foothold turns into quiet, long-term collection. Semperis’ Tomer Bar said the operations temporarily paused following geopolitical tensions involving Iran.
n0n ransomware supply-chain hits maritime firms
n0n, a newly emerged ransomware-and-extortion group, is being linked to a supply-chain incident that spilled into the maritime sector and hit over 40 shipping and maritime companies. They listed victims on their dark web leak site on October 12 with a payment deadline that expired October 19, and the report says most victims refused to pay and subsequently had data leaked. For port operators and shipping companies, the immediate consequence is operational disruption risk paired with exposure of commercially sensitive data, contracts, and communications that can ripple through global logistics. The intrusion is suspected to have originated with CyberLogitec, a South Korean IT platform provider for the sector, suggesting the group pivoted from a service provider into multiple downstream organizations. The same report says n0n has demanded ransoms totaling $1.2 billion and has listed over 140 victims since launching in mid-September.
Frequently Asked Questions
What is MythicRatatoskr? MythicRatatoskr is a Go-based backdoor that stands out for routing its command-and-control traffic through the decentralized Yggdrasil mesh network, a choice that can make malicious connections harder to spot and disrupt. It arrived after attackers first planted the MATCHWOK backdoor, giving them capabilities such as file transfer, screenshot capture, and proxy management while persisting as a Windows service.
What is Stadia? Stadia is a newly marketed remote access trojan (RAT) that Varonis says emerged from the remnants of the StealC infostealer, with its seller rebranding and courting former customers with a free month on the Pro tier. It is built around modular capabilities that give operators hands-on control, including hidden desktop access (HVNC), remote command execution, file management, and process manipulation—tools that can quickly turn a single infection into full device takeover.
What is Armorsteal? Armorsteal is a Python-based malware family delivered through an SEO poisoning campaign that tricks people searching for common tools into running malicious PowerShell commands from convincing fake sites. Zscaler says the operation impersonates download pages for Chocolatey and Microsoft Activation Scripts, then uses the resulting foothold for remote access, surveillance, and information theft that can include browser data, Discord tokens, and cryptocurrency wallets.
What is CVE-2026-109618? Two critical PHP zero-days, CVE-2026-109618 and CVE-2026-109619, enable unauthenticated remote code execution (RCE) that can hand over control of a vulnerable web server, with reports warning the impact could reach a large share of the web. The attack path centers on memory-safety bugs—described as memory corruption and use-after-free conditions—that can be triggered via web requests before an application has a chance to defend itself.
What is CVE-2026-20079? A critical flaw in Cisco Secure Firewall Management Center, CVE-2026-20079 (CVSS 10.0), can let attackers gain root access to the system that administers firewall policies and credentials. The reported exploitation method combines session fixation with CSRF token exploitation, creating a path to bypass authentication and take control of the management plane.
What is CVE-2026-110264? GitLab shipped critical patches for a vulnerability that can allow unauthenticated code execution on GitLab servers, potentially putting source code, CI/CD pipelines, and sensitive data at risk. The key issue highlighted is CVE-2026-110264, described as an integer overflow in the regular expression compiler that could be abused to run attacker-chosen code.
What is UAC-0099? UAC-0099, a Ukraine-focused threat actor, teamed up with Sandworm (also tracked as a Russian-linked unit) in an intrusion that blended espionage-style access with a destructive finish at a Ukrainian grain logistics company. They got in via spearphishing on July 16, 2025, deployed the MATCHWOK backdoor, and then followed up the next day with MythicRatatoskr, a Go-based backdoor designed to hide its command-and-control inside the decentralized Yggdrasil mesh network.
What is Prince of Persia? Prince of Persia, an Iranian cyber-espionage group, has been observed running parts of its malware operation from US-based command-and-control servers, a choice that can complicate tracking and takedowns. Researchers at Semperis tied the activity to the group’s long-running campaigns and described malware such as Tornado being used for data theft, including document exfiltration and audio capture.
What is n0n? n0n, a newly emerged ransomware-and-extortion group, is being linked to a supply-chain incident that spilled into the maritime sector and hit over 40 shipping and maritime companies. They listed victims on their dark web leak site on October 12 with a payment deadline that expired October 19, and the report says most victims refused to pay and subsequently had data leaked.