Daily · 2026-06-26
🇷🇺 Turla STOCKSTAY backdoor, ⚙️ PTC Windchill exploited, 🌏 CL-STA-1062 APT report, 🔵 Bluekit BitM phishing, 🇵🇱 SIM-swap bust, 🏭 Akira victims
Turla's STOCKSTAY .NET backdoor analyzed by Google Threat Intelligence. CISA adds PTC Windchill CVE-2026-12569 to KEV. CL-STA-1062 APT targets SE Asian energy. Bluekit phishing kit adds browser-in-the-middle. Poland arrests SIM-swapping gang. Akira claims two US victims.
First-ever in-the-wild exploitation of PTC Windchill is the day's defining story. CISA added CVE-2026-12569 to KEV after Clop deployed JSP webshells against PLM systems to exfiltrate product data in a data-theft extortion campaign; Windchill exploitation puts manufacturing and retail supply chains in the crosshairs of a group that weaponizes enterprise platforms at scale. Hunt for POST requests to /Windchill/login with hex-named JSP files.
Google's STOCKSTAY analysis attributes a three-component .NET espionage platform to Turla, active since at least 2022 and delivered through compromised WordPress sites and RDP files, with environmental keying shared with KAZUAR. STOCKSTAY is a reminder that FSB-aligned operators keep investing in stealthy, long-lived implants. The Miasma campaign returned with 23 malicious npm packages against the Leo Platform ecosystem, using binding.gyp execution to bypass metadata scanners.
Forescout confirmed the Lantronix EDS5000 command injection was exploited in a honeypot after the patch shipped, indicating patch-gapping. FCC rules now mandate basic hygiene and alert authentication for emergency alert systems, and Poland arrested four SIM-swappers with FBI support. Citizen Lab's finding that Russia used Cellebrite equipment after contract cancellation shows how offline-capable forensic hardware resists export controls.
Watchlist: Windchill and FlexPLM patch status with webshell hunting, npm lockfile review for Leo Platform packages, and EDS5000 firmware verification for OT fleets.