Summary

HiveForce Labs has reported a sharp rise in cybersecurity threats, highlighting the growing complexity and frequency of global cyber incidents. Over the past week, 12 major attacks were detected, and 35 vulnerabilities were actively exploited, signaling a concerning escalation in malicious activity worldwide.

Among the most significant developments, CVE-2026-73570 is a command injection flaw in Zimbra Collaboration Suite before 10.1.20. If SNMP notifications are on, attackers can run commands without logging in. Over 274 servers have since been hit with web shells, cryptominers, and backdoors, and attackers stole emails and credentials. Meanwhile, CVE-2026-88779 is a high-severity memory overflow zero-day in NetScaler ADC and Gateway, and it's under active attack on appliances set up as a SAML Service Provider or Identity Provider.

Elsewhere, CL-STA-1178, an Iran-nexus threat cluster, is posing as the Dubai Airports IT department and sending a targeted engineer a trojanized Visual Studio coding test. Together, these incidents underscore a growing trend of hybrid cyber operations that combine technical exploitation with social engineering, reinforcing the need for timely patching, continuous monitoring, and layered security defenses.

Threat Distribution

Backdoor, Web Shell, Post-Exploitation Tool, Cryptominer, Tunneling loader, Downloader, Worm, Hacktool, Loader

Targeted Countries (109, most to least)

Iraq, United Arab Emirates, Israel, Thailand, Nigeria, United States, Brazil, South Africa, Canada, Kazakhstan, Chile, Mexico, China, Russia, Colombia, Sudan, Finland, Japan, France, Argentina, Germany, Libya, Greenland, Mongolia, India, Poland, Indonesia, Saudi Arabia, Iran, Spain, Algeria, Sweden, Ukraine, Australia, Italy, United Kingdom, Qatar, Monaco, Taiwan, Andorra, North Korea, Canada Quebec, Serbia, Cape Verde, Cameroon, Cayman Islands, Nauru, Central African Republic, Panama, Chad, Saint Lucia, Angola, Brunei, Anguilla, Tonga, Antigua and Barbuda, Mauritania, Comoros, Morocco, Congo-Brazzaville, New Zealand, Costa Rica, Norway, Croatia, Philippines, Cuba, Rwanda, Curacao, San Marino, Cyprus, Slovakia, Czech Republic, Swaziland, Democratic Republic of Congo, Tibet, Denmark, Turkmenistan, Djibouti, Malta, Dominica, Bhutan, Dominican Republic, Montenegro, Ecuador, Myanmar, Egypt, Netherland Antilles, El Salvador, Niger, Equatorial Guinea, Northern Cyprus, Estonia, Pakistan, Ethiopia, Paraguay, Faroe Islands, Portugal, Fiji, Romania, Albania, Saint Eustatius, Armenia, French Guiana, Scotland, Gabon, Sierra Leone, Georgia, British Virgin Islands, Aruba

Targeted Industries (30)

Aviation, IT Services, Technology, Telecommunications, Aerospace, Agriculture, Banking, Biomedical, BPO, Chemical, Computer Gaming, Construction, Consumer, Cryptocurrency, Defense, eCommerce, Education, Electronics, Industrials, Insurance, Jewelry, Logistics, Maritime, NGOs, Oil and gas, Pharmaceutical, Professional Services, Real estate, Research Entities, Utilities

Attack Details

Vulnerability Details

A dash in Status means neither zero-day nor CISA KEV. No celebrity vulnerabilities were exploited this week.

Headline Vulnerabilities

Exploited by the ClingSTUN Backdoor (31)

Associated TTPs across these 31 CVEs: T1059, T1059.004, T1078, T1078.001, T1105, T1133, T1190, T1210, T1499, T1499.004, T1505, T1505.003, T1570, T1584, T1584.005, T1584.008.

Actor Details

No threat actor activity was observed or reported during this week.

Recommendations

1. 01
   Security Teams

   This digest can be utilized as a drive to force security teams to prioritize the 35 exploited vulnerabilities and block the indicators related to the malware Chopper, Godzilla, CoinMiner, Looptik, Zimdown2, Zimclient2, ShelbyLoader, ShelbyC2, PsProxy, Blackwood, Shai-Hulud, and ClingSTUN.

2. 02
   Uni5 Users: Run a Scan

   This is an actionable threat digest for HivePro Uni5 customers. Run a Scan over the HivePro Uni5 dashboard to discover the assets impacted by the 35 exploited vulnerabilities.

3. 03
   Uni5 Users: Test Security Controls

   Test the efficacy of security controls by simulating attacks related to the malware Mini Shai-Hulud, ClingSTUN Downloader, and BlinderTunnel in Breach and Attack Simulation (BAS).

Indicators of Compromise (IoCs)

MITRE ATT&CK TTPs

Top MITRE ATT&CK TTPs

References & Patch Links

Threat Advisories

• 274 Mail Servers Down as CVE-2026-73570 Fuels Zimbra SNMP Exploitation Wave
• Citrix NetScaler SAML Zero-Day CVE-2026-88779 Under Active Exploitation
• Fortinet FortiMail Zero-Day Exploited to Write Arbitrary Files
• One Flaw, Eight Products: Atlassian's Critical Pre-Auth File Read (CVE-2026-21589)
• Blinder Tunnel: Iran-Nexus Actor Hides Backdoor in Fake Coding Test
• Hostage Token: Shai-Hulud Hijacks Tensorlake's npm SDK
• ClingSTUN Backdoor Turns Exposed IoT Devices into Stealthy Proxy Nodes