Daily · 2026-06-06
UNC3753 vishing, UniFi OS CVSS 10.0🔴, SolarWinds KEV, STX RAT supply chain, OP-512 web shells
UNC3753 targets US law firms with vishing and physical office intrusions in single-day extortion blitz; Ubiquiti UniFi OS critical chain (CVSS 10.0 × 3) enables unauthenticated root RCE with persistent JWT forgery; CISA adds SolarWinds Serv-U CVE-2026-28318 to KEV with active exploitation confirmed; STX RAT supply chain campaign expands to 11 packages targeting crypto traders and 100M+ X-VPN users; China-linked OP-512 deploys custom IIS web shell framework.
The UniFi OS chain is the day's defining story. Three CVSS 10.0 vulnerabilities compose into unauthenticated root remote code execution on network management appliances, confirmed end to end by Bishop Fox, and a forged JWT minted before patching still authenticates against fully patched consoles. In deployments with UniFi Access and Protect, that position opens doors and reads surveillance footage, and biometric and NFC credentials cannot be rotated.
UNC3753, aka Luna Moth, is the second headline. The financially motivated cluster targets US law firms with vishing and, in an escalation corroborated by the FBI, physical office intrusions aimed at exfiltrating data over USB. The attack-to-extortion cycle completes within a single business day, with Google Drive and Rclone carrying the data and a three-day negotiation window before publication on the LEAKEDDATA site.
CISA added SolarWinds Serv-U CVE-2026-28318 to KEV with 12,000+ exposed servers, and the hotfix matters as much as the version. STX RAT's supply chain campaign grew to 11 trojanized packages including X-VPN, and China-linked OP-512 deploys a self-reporting ASPX web shell framework against IIS servers. Verizon's 2026 DBIR analysis lands on the browser as the primary attack surface, with credential abuse passing unblocked through non-browser controls.
Watchlist: UniFi OS 5.0.8 with JWT key rotation, RMM binary allowlists, Serv-U hotfix coverage, and browser extension governance.