CTI status
As of:
Last pipeline run:
BRICKSTORM operates below the guest OS layer on the virtualization plane where EDR agents are ineffective and traditional security controls historically lag , a critical visibility gap for most organizations.
State-backed North Korean threat actor compromised axios npm packages with malicious dependency and deployed multi-platform backdoor; active supply-chain campaign relevant to software development and industrial control system environments.
Chinese APT group UNC2814 operates the GRIDTIDE campaign against telecommunications and government organizations across 42 countries with focus on international infrastructure; Google and Mandiant have initiated disruption operations.
Sophisticated APT groups like UNC6201 and UNC5807 optimize for extreme persistence by targeting edge devices (VPNs, routers) lacking EDR telemetry; exploitation occurs on average 7 days before patch availability, with custom malware deployed directly to network appliances.
Destructive cyberattacks are deliberately employed by state actors as a cost-effective weapon during conflicts; organizations should prioritize proactive hardening measures against wipers and destructive malware.
A Pwn2Own-winning vulnerability enables unauthenticated remote code execution on Canon printers across the network with high CVSS 8.8 severity.
Network-accessible Canon multifunction printers can be abused for unauthenticated remote code execution; this attack surface is frequently overlooked.
An integer-overflow vulnerability in ESXi's VMXNET3 driver enables local privilege escalation from high-privileged guest processes with CVSS 8.2; a ZDI/Pwn2Own finding indicates robust exploitation potential.
Pwn2Own demonstration of VMware ESXi exploitation reveals real privilege-escalation risks in critical virtualization infrastructure.
The vulnerability enables a protocol downgrade attack on Ubiquiti AI Pro Discovery without authentication, presenting a network entry point for network-adjacent attackers.
Local attackers with code execution can escalate to system privileges (CVSS 7.8); patches required for Windows Server 2022/2019.
A local privilege escalation vulnerability in Windows with high CVSS requires prior code execution but increases the risk of insider threats or post-compromise exploitation in the enterprise environment.
A local privilege escalation in Windows cdd with high CVSS score (8.8) requires prior code execution but poses significant risk for already-compromised systems.
A 0-day vulnerability in Microsoft Azure MCP with CVSS 9.8 enables unauthenticated remote code execution, threatening cloud identity and collaboration infrastructure across all Azure-dependent organizations.
This CVE was published in 2022; the ZDI disclosure is a post-embargo publication following Pwn2Own , patch status should be verified.