Joel Traber AG

Top news

• TAKTISCH The Hacker News
  PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions

  The report adds to the patch information by describing active exploitation by a suspected advanced actor and the use of memory-resident malware that operates on FortiGate VPN gateways without file artifacts.

  → Directly relevant because FortiGate/FortiOS is part of the company’s stack and the article describes active exploitation of CVE-2025-61624 to deploy the memory-resident PEERSTITCH malware.

• TAKTISCH ZDI: Published Advisories
  ZDI-26-661: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability

  The vulnerability requires user interaction and enables code execution when opening malicious PDFs; active exploitation is not confirmed.

  → The company uses Adobe Acrobat Reader DC, so a remote code execution vulnerability in this product is directly operationally relevant.

• TAKTISCH The Hacker News
  China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers

  The report shows that China-linked APTs are actively exploiting zero-days in remote support appliances to gain root access and credentials , a risk for indirectly exposed service providers.

  → The campaign targets BeyondTrust Remote Support appliances, which are not part of the company's listed stack, but it demonstrates nation-state exploitation of remote support infrastructure relevant to DACH manufacturing.

• TAKTISCH The Hacker News
  ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan

  The report adds to the patch information that the Siemens vulnerability is already actively exploited in ClickFix campaigns to distribute a remote access Trojan.

  → The vulnerability affects Siemens Software Center, a component directly relevant to Siemens-based manufacturing environments, and is already exploited in active ClickFix attacks.

• TAKTISCH Securelist
  How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia

  APT41 is reviving a known UEFI bootkit technique through a Secure Boot flaw that has been patched for years, demonstrating that boot-level persistence still works without an updated Secure Boot database (Windows UEFI CA 2023).

  → The report describes how the state-sponsored APT41 group uses the Secure Boot bypass CVE-2022-21894 via the BlackLotus bootkit against Windows targets , a technique that is likewise applicable to Windows server and client environments with UEFI/Secure Boot.

• OPERATIV ZDI: Published Advisories
  ZDI-26-619: Microsoft Windows UMPDDrvStretchBltROP Improper Object Management Local Privilege Escalation Vulnerability

  The report describes a local privilege escalation in Windows that is exploitable only after low-privileged code execution; no active exploitation or KEV status is mentioned.

  → The vulnerability affects Microsoft Windows systems used across the company's server and endpoint estate and allows local privilege escalation.

• OPERATIV ZDI: Published Advisories
  ZDI-26-622: Microsoft Windows IKEv2 AES-GCM Decryption Integer Underflow Remote Code Execution Vulnerability

  The advisory adds patch information about a pre-authenticated RCE flaw in Windows IKEv2, whose practical relevance depends heavily on the IPsec configuration in use.

  → The vulnerability affects Microsoft Windows, which is part of the company's stack, and may allow unauthenticated remote code execution in specific IPsec configurations.

• OPERATIV ZDI: Published Advisories
  ZDI-26-694: Linux Kernel Net Scheduler Clsact Qdisc Use-After-Free Local Privilege Escalation Vulnerability

  The vulnerability affects the Linux kernel and therefore also Ubuntu servers; however, exploitation requires already elevated local privileges, which reduces the risk for exposed systems.

  → The vulnerability affects the Linux kernel and thus directly the Ubuntu 24.04 LTS servers in use; a local attacker with already elevated privileges can escalate to root.

• TAKTISCH Unit 42
  Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

  The report shows that exploitation of CVE-2024-47575 does not end with patching: PEERSTITCH masquerades as a legitimate service and serves long-term credential collection across managed FortiGate devices.

  → Fortinet FortiGate is part of the company infrastructure; the report describes an implant dropped on FortiManager systems after exploitation of CVE-2024-47575 that compromises managed FortiGate devices and credentials.

• OPERATIV Microsoft Security Blog
  The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime

  Phishing kits and credentials for Microsoft and Google cloud environments are traded as commodities on a Chinese-language marketplace, letting attackers run large-scale credential phishing without building anything themselves.

  → The report details a criminal phishing-kit marketplace and active campaigns that harvest Microsoft 365 and Google Workspace credentials via email links, directly matching the Microsoft Entra ID / Defender for Office 365 stack most organisations rely on.

• UNIT 42 14/10/2026
  Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant

  Unit 42 has discovered PEERSTITCH, a stealthy implant targeting FortiGate firewalls. The implant is linked to the FortiManager vulnerability CVE-2024-47575. Attackers can use it to maintain persistent access to affected systems. Companies like Joel Traber AG in the DACH region face an elevated risk.

• MICROSOFT SECURITY BLOG 14/10/2026
  The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime

  Microsoft uncovered a Chinese-language cybercriminal ecosystem consisting of phishing kit operators, developers, and an illicit marketplace called YAM Store (Storm-3119). The three kits CoGUI, Haozi, and Iron Man System, tracked as Storm-2990, enable large-scale phishing and credential theft. Since January 2026, over one billion phishing emails and SMS messages have been sent to more than 75,000 organizations worldwide, especially in healthcare, financial services, wholesale distribution, and IT. Microsoft's Digital Crimes Unit, with partners, disrupted the primary developers and infrastructure.

• CYBERSECURITY BLOG | SENTINELONE 13/10/2026
  Bring Your Own Vulnerable Driver: How EDR Killing Became an Industry

  The EDR-killer trade has become a commercialised, tiered market, and because the same vulnerable driver is used by multiple unrelated ransomware crews, attribution by driver hash groups the suppliers rather than the gangs.