8 min read

Cyber Threat Intelligence Report

Picture of PacketWatch Team Sixty43 PacketWatch Team Sixty43 : August 24, 2026

Threat Intel Biweekly Briefing
Cyber Threat Intelligence Report

 

This week, we briefed our clients on CISA's recently published TTP updates for the Medusa RaaS group, originally published in March 2025.


 KEY TAKEAWAYS 

  • New #StopRansomware TTPs for Medusa RaaS. Learn how to protect your organization.

  • Critical and high severity vulnerabilities in Citrix, SAP, Cisco, Siemens, GitLab, Zimbra, and GeoServer, plus updates to CISA KEV, patch now!


 

Medusa RaaS Updated TTPs

CISA recently published updates to a joint #StopRansomware advisory for the Medusa Ransomware-as-a-Service (RaaS) group. This advisory covers newly observed tactics, techniques, and procedures (TTPs) for the group since the original publication of the advisory in March 2025. Since their debut in June 2021, Medusa has compromised over 500 organizations from a variety of industry verticals including medical, education, legal, insurance, technology, and manufacturing. This article will review these new findings and discuss strategies for protection your organization against them. 

 

Initial Access

Medusa frequently leverages initial access brokers (IABs) to obtain their initial foothold in a victim environment. These IAB affiliates have been observed using the following techniques for initial access:

  • Phishing campaigns are the primary method for stealing victim credentials.
  • Exploitation of unpatched software vulnerabilities:
    • CVE-2024-1709 - Authentication bypass in ScreenConnect
    • CVE-2023-48788 - Fortinet EMS SQL injection vulnerability
    • CVE-2025-10035 - Fortra GoAnywhere Deserialization of Untrusted Data vulnerability
    • CVE-2026-1731 - BeyondTrust OS Command Injection vulnerability

The updated advisory notes that Medusa tends to operate opportunistically by targeting victims with unpatched software rather than focusing on specific organizations or sectors. There is no indication that they use 0-day or N-day vulnerabilities, and instead use known exploits. To confirm successful exploitation, Medusa uses Interactsh dynamic URLs from oast[.]site, oast[.]pro, or oast[.]fun. This typically has the URL pattern of <victim-name>.<random-33-alphanumeric-characters>.oast[.]site. 

 

Discovery

Medusa uses living-off-the-land (LOTL) techniques and legitimate tools like Advanced IP scanner and SoftPerfect Network scanner for initial enumeration. They typically scan common ports such as 21/FTP, 22/SSH, 23/Telnet, 80/HTTP, 115/SFTP, 443/HTTPS, 1433/SQL, 3050/Firebird, 3128/HTTP proxy, 3306/MySQL, and 3389/RDP. They have also been observed using Windows Management Instrumentation (WMI) for querying system information. 

 

Stealth

This part of the advisory saw several updates, as Medusa has been repeatedly observed using legitimate tools and LOTL techniques to avoid detection.

  • They use certutil.exe to download files.
  • They use Minidump (comsvcs.dll) to dump LSASS credentials.
  • Medusa commonly uses base64 encoded PowerShell commands
  • They place suspicious tooling such as rclone in pre-existing Windows Defender excluded folders to avoid detection.
  • They leverage Ligolo-ng and Cloudflared to create network tunnels to hide network traffic.

They use endpoint management tools such as Nezha and MeshAgent for backdoors to compromised endpoints. 

 

Lateral Movement, Credential Access, and Execution

The advisory notes Medusa actors heavily use legitimate remote management software for maintained access, and will often tailor which tool is used based on which tools are already present in the environment. These tools include, AnyDesk, Atera, ConnectWise, eHorus, N-able, BeyondTrust, SimpleHelp, and Splashtop. Remote Desktop Protocol (RDP) and PsExec are also leveraged to move laterally through the network. Medusa will modify firewall rules and modify the registry to allow for RDP connections.

CISA has observed Mimikatz being leveraged for dumping LSASS credentials and to aid in lateral movement.

One of the more unusual methods that was observed is Medusa will use the vssadmin command to create a new shadow copy for the C: drive. They will then copy ntds.dit, system, and security registry hives out of the shadow copy and then delete the shadow copy to prevent discovery. Medusa can use these stolen files to create forged Kerberos tickets.

Medusa was also observed modifying Active Directory Default Domain Policy settings, then setting the Default Domain Policy to "Enabled, Enforced" which overrides stricter Group Policies set by the organization. 

 

Exfiltration and Impact

Medusa uses Bandizip to create archives of files to be exfiltrated. They then use rclone to exfiltrate those files to Medusa C2 servers.

Recently, Medusa has been leveraging PDQ Deploy in Windows environments to deploy the encryptor (typically named "gaze.exe") across the network. In Linux environments they instead use SFTP to copy the encryptor across the environment.

 

How to Protect Your Organization

While this update provides the latest TTPs for Medusa, none of these TTPs use anything particularly fancy or undetectable. Using security best practices will go a long way toward preventing compromise from this group:

  • Regularly patch internet-facing systems - Medusa and its affiliates heavily rely on exploitation of known vulnerabilities of internet-facing systems. Patching these systems greatly reduces the chances of becoming a target of Medusa in the first place.
  • Monitoring for suspicious/anomalous network behavior - With network monitoring tools such as PacketWatch WireSight, organizations can easily identify traffic such as internal port scans or traffic to suspicious domains like oast[.]fun.
  • Know your tools - Baseline your network so that you understand which tools and corresponding traffic are normal. Events like new or anomalous RMM traffic should be treated as highly suspicious.
  • Ensure up-to-date EDR is deployed across all endpoints - EDR tools can identify and prevent common tools such as Mimikatz from dumping credentials.
  • Implement robust network segmentation.
  • Disable unused ports and services.
  • Limit which accounts have administrative privileges (principle of least privilege).
  • Maintain offline backups of data and regularly test and maintain these backups.

 

Resources

 

 

Vulnerability Roundup

 

Authentication Bypass in Citrix NetScaler ADC & NetScaler Gateway

Citrix recently released a security update addressing two new vulnerabilities in NetScaler. The most severe of the flaws is CVE-2026-19490, an authentication bypass vulnerability affecting NetScaler appliances configured as a Gateway or AAA virtual server with SAML Action configured. Specific configuration requirements are listed below:

  • 14.1-43.56 or later: Applicable only when configured with a SAML action AND NetScaler is configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver
  • 14.1-66.68-FIPS or later: Applicable only when configured with a SAML action AND NetScaler is configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver
  • 14.1-43.55 or earlier: Applicable when configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver.
  • 13.1-61.28 or later: Applicable only when configured with a SAML action.
  • 13.1-61.27 or earlier: Applicable when configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy or AAA vserver).
  • 13.1 FIPS: Applicable when configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy or AAA vserver).

Additional mitigations can be found in the advisory. Administrators are urged to apply the update as soon as possible:

  • NetScaler ADC and NetScaler Gateway 14.1-73.32 or later,
  • NetScaler ADC and NetScaler Gateway 13.1-63.21 or later,
  • NetScaler ADC FIPS 14.1-73.32 FIPS or later,
  • or NetScaler ADC FIPS and NDcPP 13.1-37.277 or later, as applicable.

 

 

Multiple Critical Vulnerabilities in SAP

The August 2026 Security Patch Day for SAP addressed 28 new vulnerabilities, including 4 rated critical. CVE-2026-58231 is a maximum-severity flaw in SAP Commerce Cloud where a default authentication client can be abused for arbitrary code execution. CVE-2026-34265 is a critical vulnerability in SAP NetWeaver Application Server ABAP that allows an unauthenticated attacker to exploit logical errors resulting in memory corruption. A full list of vulnerabilities and associated affected software versions can be found in the SAP advisory here. Administrators are urged to apply the updates as soon as possible.

 

AI Exploits Targeting Siemens S7 PLCs

CISA recently issued a warning of an active threat targeting critical infrastructure organizations with AI-generated exploit scripts. This campaign is specifically targeting Siemens S7 SeriesProgrammable Logic Controllers (PLCs). The following PLC models have been targeted:

    • S7-200 Series (all CPU variants)
    • S7-300 Series (all CPU variants including 314, 315, 317 models)
    • S7-400 Series (all CPU variants)
    • S7-1200 Series (CPU 1211C, 1212C, 1214C, 1215C, 1217C variants)
    • S7-1500 Series (all CPU variants, including F-series safety controllers)

CISA is urging any organization that uses these devices to ensure they are running the latest versions, isolate them from the internet wherever possible, have strong access controls, and employ security tooling to monitor ICS environments for signs of anomalous or malicious activity.

 

Maximum-severity Vulnerabilities in Cisco Crosswork & Secure Workload

Cisco recently addressed a series of critical vulnerabilities in their Crosswork platforms and Secure Workload Software, including several rated as maximum-severity. The vulnerabilities in the table below affect the following Cisco Crosswork platforms, regardless of device configuration: Crosswork Data Gateway, Crosswork Network Controller, Crosswork Planning, and Crosswork Workflow Manager.

 

2026-08-24-Cisco-01

Fig. 1: Cisco Crosswork Vulnerabilities (Source: Cisco)

 

These vulnerabilities affect Data Gateway, Network Controller, and Planning versions 7.2.1 and earlier, with a fixed release of version 7.2.1-SP. Versions 2.1.1 and below of Workflow Manager are affected, with a fixed release of verion 2.1.1-SP.

The vulnerabilities in the table below affect Cisco Secure Workload Software SaaS & on-premises deployments, regardless of device configuration: 

 

2026-08-24-Cisco-02

Fig. 2: Cisco Secure Workload Vulnerabilities (Source: Cisco)

 

These vulnerabilities affect Secure Workload release 3.10 and earlier and version 4.0. Fixed releases are 3.10.9.1 and 4.0.4.16. Administrators are urged to apply the patches as soon as possible.



Cisco ASA & FTD Denial of Service Vulnerability

Cisco recently released details for a new denial-of-service (DoS) vulnerability affecting the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software. Per the disclosure, the vulnerability tracked as CVE-2026-20349, can allow for a remote, unauthenticated attacker to send crafted HTTP requests to the device, causing the device to reload, resulting in a DoS condition. To be vulnerable, one of the following conditions must be met on the device: 

 

2026-08-24-Cisco-03

Fig. 3: Cisco ASA & FTD Configurations (Source: Cisco)

 

The tables below show the ASA and FTD versions with their associated hotfix releases. Administrators are urged to patch as soon as possible.

 

2026-08-24-Cisco-04

Fig. 4: Cisco ASA Releases and Corresponding Hotfix (Source: Cisco)

 

2026-08-24-Cisco-05

Fig. 5: Cisco FTD Releases and Corresponding Hotfix (Source: Cisco)

 

 

Critical GitLab Flaw Under Active Exploitation

A code injection flaw that allows an unauthenticated attacker to modify or delete publicly accessible GitLab projects has come under active exploitation according to security firm watchTowr. Tracked as CVE-2026-19478, the flaw affects GitLab Community Edition (CE) and Enterprise Edition (EE) versions 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4.

GitLab introduced fixed versions 19.2.4, 19.1.6, 19.0.8, and 18.11.11 to address the issue. Administrators are urged to upgrade as soon as possible. Per their research, watchTowr also noted that administrators can check for signs of exploitation by searching web logs for requests containing '@gl_introduced'.

 

Zimbra Collaboration (ZCS) RCE Under Active Exploitation

A new security vulnerability in Zimbra Collaboration (ZCS) has come under active exploitation per the Polish Computer Emergency Response Team (CERT Polska). Tracked as CVE-2026-73750, this vulnerability is classified as a command injection flaw that can lead to remote code execution. The application is vulnerable if it is running ZCS before 10.1.20 with the optional zimbra-snmp package installed, and SNMP notifications are enabled. Administrators are urged to patch to version 10.1.20 or greater as soon as possible.

 

GeoServer 0-Day RCE

A high-severity SQL-injection flaw in GeoServer was recently disclosed by security researcher @q1uf3ng. Per the disclosure, if the exploit is ran against the system administrator 'sa' database, remote code execution is achievable. No CVE identifier has been assigned to this vulnerability yet. Versions 3.0.1, 2.28.5, and 2.27.6 have been released to address this vulnerability.

 

CISA KEV Additions

The following vulnerabilities were added to CISA's Known Exploited Vulnerabilities Catalog in the last 2 weeks:

  • CVE-2026-73570 - Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability 
  • CVE-2026-72529 - TrueConf Server Missing Authentication for Critical Function Vulnerability 
  • CVE-2026-72530 - TrueConf Server Code Injection Vulnerability 
  • CVE-2026-64849 - MLflow Server-Side Request Forgery Vulnerability
  • CVE-2026-65400 - Apple macOS Improper Authentication Vulnerability 
  • CVE-2026-55040 - Microsoft SharePoint Weak Authentication Vulnerability
  • CVE-2026-59310 - Broadcom VMware vCenter Path Traversal Vulnerability
  • CVE-2026-33824 - Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability
  • CVE-2025-62593 - Ray-Project Ray Code Injection Vulnerability
  • CVE-2026-72898 - Metabase SQL Injection Vulnerability
  • CVE-2026-68820 - Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
  • CVE-2026-20349 - Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vulnerability

 

 

 

This report is provided FREE to the cybersecurity community.

Visit our Cyber Threat Intelligence Blog for additional reports.

Visit our Cyber Threat Profile Blog for detailed intelligence profiles.

Visit our Beyond the Threat Feed Blog for more articles.

 

Subscribe to be notified of future Reports:

NOTE
We have enhanced our report with data from SOCRadar. You may need to register to view their threat intelligence content.
Table of Contents
Cyber Threat Intelligence Report

8 min read

Cyber Threat Intelligence Report

August 24, 2026

This week, we briefed our clients on CISA's recently published TTP updates for the Medusa RaaS group, originally published in March 2025.

Read More
Cyber Threat Intelligence Report

9 min read

Cyber Threat Intelligence Report

August 10, 2026

This week, we briefed our clients on recent data extortion campaigns targeting numerous industry verticals with fake technical support vishing...

Read More
Cyber Threat Intelligence Report

6 min read

Cyber Threat Intelligence Report

July 27, 2026

This week, we briefed our clients on "Certighost", a Domain Controller Impersonation Exploit that allows standard users to obtain valid DC...

Read More
Future Team Sixty43 Reports.
Be notified when Cyber Threat Intelligence Reports, Threat Profiles, or Beyond the Threat Feed articles are published.