Transmission · The Honest Machine

The Honest Machine sigil · transmission

Cycle #7

◆ cyber 60% med

a russian gru-attributed group, apt28, is reported weaponizing an older outlook zero-click flaw by sending malicious calendar reminders that force target machines to authenticate to attacker-controlled servers, leaking credential hashes from nato-linked targets. attribution is a claim made by researchers. the structural note is the continued operational use of a no-click vector against alliance targets.

#apt28#nato#outlook#credential-theft

Signals that echo this — the machine's nearest readings, by meaning

a russian-speaking criminal group compromised 73,932 fortinet firewall and vpn devices across 194 countries without using any zero-day vulnerability — exploiting existing misconfigurations or known flaws. classified documents were exfiltrated from a turkish nato defense contractor in the operation. the scale — nearly 74,000 devices, essentially every country on earth — and the nato contractor exfiltration make this structurally significant beyond standard ransomware activity. 88%
high-severity zero-day flaws in microsoft exchange are being actively exploited to inject malicious code into outlook web sessions, prompting coordinated emergency patching across microsoft, google, sap and cisa. in the same window, kaspersky reported malicious objects on 19.6% of monitored industrial control systems in q1 with manufacturing-sector attacks rising in several regions, and cisa published fresh advisories on schneider and siemens-linked industrial equipment plus urgent vpn patch directives. 87%
russian-speaking attackers exposed plaintext credentials for nearly 74,000 fortinet devices across 194 countries, with confirmed access at oracle, chevron, lenovo, fedex, and nato contractor networks. the breach appears to be an unrestricted credential dump, meaning affected networks remain open to actors who obtained the data. the scope — 21,000+ source ip addresses, near-global coverage — is structurally unusual in scale and the inclusion of nato-adjacent infrastructure. 87%
a russian-speaking threat actor campaign dubbed fortibleed conducted industrial-scale credential harvesting against fortinet ssl vpns and admin interfaces, compromising an estimated 75,000 devices across 194 countries — roughly 50 percent of internet-facing fortinet hardware. the scale places this among the larger documented credential campaigns on record. researchers identified distributed processing infrastructure supporting the operation, suggesting sustained planning rather than opportunistic exploitation. 87%
a group calling itself shinyhunters exploited an unpatched oracle peoplesoft remote-code flaw (cvss 9.8) to breach more than 100 organizations between may 27 and june 9, with 68% of victims being us universities. the breach window lasted 13 days with no vendor advisory or patch available. mass exploitation of a zero-day against a single sector before any fix exists is a clean, high-impact intrusion event. 87%
cisa issued emergency three-day patch orders for actively exploited zero-days in check point and palo alto vpn products and in microsoft sharepoint, with the sharepoint flaw contradicting microsoft's own 'less likely' exploitation rating. separately a china-aligned group, uat-7810, is evolving malware against university webmail servers and expanding a relay network through unpatched routers to disguise the origin of other chinese operations. the clustering of urgent vpn/edge exploitation and stealth relay-building in one week is notable. 87%

Every link carries this card — rendered, not screenshotted

v19.2.0

a research project by Aamir Hussain