🔴 TrueConf KEV: Head Mare APT trojanizes meeting clients, 🎯 LockBit 5 claims U.S. Bank, ⚠️ Microsoft Entra ID CVSS 10.0 RCE, 🛡️ BTR.sys weaponized Defender driver bypasses EDR, 🔓 Rust crate supply chain hits hundreds of millions of downloads, 📋 SilkParasite APT deploys 5 new RATs via Google Drive C2

CISA added two critical TrueConf Server vulnerabilities (CVE-2026-72529, CVE-2026-72530) to the KEV catalog today, confirming active exploitation by the Head Mare APT group. Attackers compromise TrueConf servers and replace the legitimate Windows client installer with a trojanized version carrying the PhantomCore backdoor, turning every meeting participant into a potential victim when they download the guest client. Versions 5.3.x before 5.3.9, 5.4.x before 5.4.9, and 5.5.x before 5.5.5 are affected, and the supply-chain nature of the attack means patching the server alone does not recover already-delivered trojanized installers.

LockBit 5 claimed a cyberattack against U.S. Bank and threatened to publish stolen data unless the bank negotiates by September 3. U.S. Bank said it found no indication of internal system compromise but is investigating. The claim against one of the largest U.S. banks marks a significant escalation in LockBit's post-law-enforcement-disruption targeting.

Microsoft Entra ID CVE-2026-69836 carries a CVSS 10.0 rating for deserialization of untrusted data enabling unauthenticated remote code execution in Microsoft's cloud identity provider. Microsoft says the fix was applied server-side and no customer action is needed, but the severity of RCE in the identity plane that governs Azure, Microsoft 365, and thousands of integrated SaaS applications warrants immediate verification that Entra ID tenants are patched and authentication logs reviewed for anomalous activity since August 20.

Google researchers identified three Russian espionage clusters (UNC6293, UNC7005, UNC5976) running coordinated social-engineering campaigns against academics, diplomats, and defense staff across Europe and the United States. The groups manipulate targets into completing legitimate authentication workflows, including State Department-themed app-password phishing and Microsoft device-code flows, granting persistent mailbox and MFA access without traditional phishing indicators.

Two overlapping Rust supply-chain compromises hit the ecosystem. A broader campaign poisoned arrayref v0.3.10, append-only-vec v0.1.9, and internment v0.8.7, collectively reaching hundreds of millions of downloads, stealing credentials and wallet data during build. The impersonation pattern (proc-macro1 mimicking proc-macro2) suggests deliberate targeting of high-traffic packages. Separately, the onering crate (18,000+ downloads) exfiltrated source code from developer machines via a malicious v1.4.1 update detected June 10.

Peer2Profit's bandwidth-sharing application feeds residential proxy capacity to AstroProxy, which resells it at a 27x markup. Silent Push observed 117,224 unique IPs across AstroProxy's pools, averaging 1,071 new addresses per hour. Critically, internal network resources can be reached through specific HTTP request patterns, meaning employee devices running Peer2Profit become unauthorized proxy exit nodes exposing corporate IP space from inside the perimeter.

Attackers are distributing Vidar stealer through a fake Google Gemini installer hosted on Google Colab, exploiting interest in generative AI tools. Darktrace investigated a July 2026 intrusion where a user downloaded Download_Google_Gemini_For_Windows.exe, which deployed the credential-harvesting stealer.

Manic is an Android malware family active since February 2026 that monitors 169 banking, government, payment, crypto wallet, and authenticator apps, with Ukraine as the primary target. Its distinguishing feature is a peer-relay mechanism that exfiltrates stolen data through nearby compromised phones when direct internet is blocked, forming a Wi-Fi mesh for data theft that defeats network-level controls.

Check Point Research and Jiri Vinopal independently disclosed how Microsoft Defender's BTR.sys driver can be weaponized to bypass EDR and antivirus. The legitimate Microsoft-signed driver executes kernel-level file and registry operations before security products initialize during boot. The researcher reverse-engineered the undocumented transaction protocol, turning a trusted remediation component into a Living-off-the-Land driver capable of arbitrary file deletion. No CVE exists; this is a design-level issue in the signed driver's protocol.

SilkParasite is a China-nexus espionage campaign targeting government bodies across Central Asia with five previously undocumented RAT families (DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, NodeEdgeRAT) plus two known families linked to ShadowPad. The C2 infrastructure tunnels RAT traffic through Google Drive, blending into trusted cloud activity that defeats network-level detection.

North Korean threat actors continue targeting open-source developers through social engineering to compromise development environments and inject malicious code into downstream supply chains, with the campaign now extending into the Rust ecosystem alongside JavaScript and Python.

[UPDATE] NSA, CISA, FBI, DOE, and EPA expanded the Siemens PLC warning with a companion FAQ addressing the active threat to S7 Series controllers, adding Tenable's detailed guidance on remediation steps and IT/OT segmentation. Separately, CERT Polska confirmed PLC sabotage at a Polish CHP plant via private APN, underscoring that these are not theoretical risks.

[UPDATE] Cloud Software Group's Citrix NetScaler CVE-2026-19490 (CVSS 9.3) authentication bypass continues to draw additional analysis, with SOCPrime publishing detection logic. Given NetScaler's history as a ransomware entry point, exploitation is expected once technical details mature.

[UPDATE] Zimbra CVE-2026-73570 exploitation continues across multiple campaigns. SecurityWeek reported a broader active exploitation effort beyond the CERT Polska advisory, with the unauthenticated SNMP command injection vector remaining viable on unpatched instances running the default swatchdog service.

Watchlist: apply VMware vCenter patches (CVE-2026-59310, CVE-2026-59309) before the August 21 CISA deadline given active exploitation with ransomware deployment; prioritize the Microsoft AFD.sys zero-day (CVE-2026-68820) which requires a reboot to fully remediate; patch BeyondTrust EPM to 26.1.2 before the privilege-escalation chain is weaponized; patch GitLab to address CVE-2026-19478 before exploitation scales; verify Zimbra instances are on version 10.1.20 or later; treat Citrix NetScaler CVE-2026-19490 as emergency maintenance; Siemens PLC operators should verify internet exposure and review IT/OT segmentation; and organizations running open-source SAML libraries should audit their XML canonicalization stacks.