Fresh exploits, zero-day weaponisation and supply chain risk

At a glance

What this is: This weekly intelligence report tracks three active attack paths, showing how quickly attackers converted perimeter flaws, phishing attachments, and trusted software distribution into compromise.

Why it matters: It matters because security teams responsible for IAM, PAM, NHI, and broader cyber controls must assume valid access, trusted channels, and administrative privilege can all be abused before normal review cycles catch up.

By the numbers:

• The supply chain attack compromised more than 200 systems and possibly as many as 500.
• APT28 targeted more than 60 government email addresses with spear-phishing.

👉 Read FireCompass's weekly cybersecurity intelligence report on recent attacks and breaches

Context

The security problem here is speed. Attackers are chaining public-facing exploitation, phishing, and supply chain abuse faster than many organisations can patch, investigate, or revoke access, which makes perimeter trust and credential assurance fragile across both human identity and NHI controls. In this report, FireCompass shows how quickly a weak control boundary becomes a usable foothold.

For IAM and PAM teams, the important point is that these incidents do not stay in their original lane. A device compromise can expose credentials, a phishing attachment can produce harvested logons, and a trusted updater can become a distribution path for malware, so identity governance and operational security have to be joined up rather than treated as separate programmes. That pattern is now typical, not exceptional.

Key questions

Q: What breaks when a perimeter appliance has an authentication bypass?

A: The main failure is that the control plane stops being a reliable gatekeeper. Attackers may reach administrative or policy functions without satisfying the intended identity checks, which can undermine logging, segmentation, and downstream trust decisions. The practical consequence is that exposure, not just credentials, becomes part of the access control problem.

Q: Why do fresh exploits become so dangerous when patching and review cycles are slow?

A: Because attackers can weaponise public vulnerabilities faster than many teams can deploy fixes or complete manual validation. Once exploitation happens within hours or days, the window for reactive control shrinks sharply. The answer is continuous exposure management, faster containment decisions, and telemetry that shows abuse before the next scheduled review.

Q: What are the signs that a weaponised attachment has moved from email to endpoint compromise?

A: Look for document applications spawning script interpreters or command shells, unusual child processes, and registry or autorun changes appearing after message delivery. Those patterns suggest the attachment is no longer just a phishing attempt, but an active foothold. Correlate them with authentication events to see whether the attacker has started harvesting credentials.

Q: How should security teams monitor software updates when a trusted application may have been compromised upstream?

A: Treat software provenance as necessary but not sufficient. Verify update signatures, monitor unusual network connections, and watch for abnormal process behavior after patching. Supply chain compromise often succeeds because teams trust the source and stop checking the payload. Defensive controls should assume that a legitimate update channel can be abused, especially when access persists quietly and only selected targets are touched.

Technical breakdown

Perimeter authentication bypass and administrative takeover

Fortinet CVE-2026-24858 shows how device registration and authentication validation can be separated in a way that lets legitimate credentials be abused for unintended admin access. Once the trust boundary is broken, attackers can create accounts, export configurations, and reuse the appliance as a pivot into the internal network. This is a control failure because the appliance assumes credential legitimacy is enough, even when the session context is untrusted. The exploit path is especially dangerous on perimeter devices because they often sit outside normal identity telemetry and change-management coverage.

Practical implication: isolate and harden administrative sign-in paths for perimeter appliances before attackers turn valid credentials into full device control.

Weaponised documents as an initial access vector

The Office zero-day illustrates how a file attachment can become a delivery mechanism for code execution without macros or visible prompts. The Mark-of-the-Web bypass allowed malicious content to instantiate blocked objects inside the Word process, which meant the payload could run with user context and then move toward credential harvesting and persistence. This is a classic initial access problem, but it also intersects with identity because the attacker’s goal is usually to obtain reusable logons or session material after the first foothold. Email security and endpoint controls both matter here because either one on its own is easy to evade.

Practical implication: combine attachment hardening, process-spawn detection, and privileged logon monitoring rather than relying on one defensive layer.

Trusted update channels can become malware distribution paths

The eScan incident shows that supply chain compromise is not just about code insertion, but about trust inheritance. If customers trust signed updates and vendor distribution infrastructure, attackers only need to subvert the update path once to reach hundreds of systems with SYSTEM-level execution. That is why supply chain security has to include cryptographic verification, update provenance checks, and post-update behavioural detection. The impact can extend beyond malware deployment into domain credential theft, because security tooling often runs with elevated privileges and broad visibility across endpoints.

Practical implication: validate security-software updates cryptographically and monitor for post-update privilege abuse across endpoints.

Threat narrative

Attacker objective: The objective is to gain durable access paths that can be used for lateral movement, credential harvesting, and broader environment compromise.

1. Entry occurred through three distinct paths: a Fortinet authentication bypass, a weaponised Office attachment, and a compromised antivirus update server.
2. Escalation followed quickly as attackers created rogue administrator accounts, executed payloads in the Word process context, and established backdoors from trusted software installs.
3. Impact included perimeter compromise, credential exposure, internal reconnaissance, and malware distribution across customer environments.

Breaches seen in the wild

• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.
• Reviewdog GitHub Action supply chain attack — reviewdog/action-setup GitHub Action supply chain attack exposed secrets.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Speed is now the primary control variable in exposure management. The report shows attackers weaponising fresh vulnerabilities within 72 hours, which means patch queues and manual review cycles are increasingly out of phase with real adversary tempo. NIST CSF and MITRE ATT&CK both point toward continuous detection and response, not periodic reassurance. Practitioners need exposure workflows that assume same-week exploitation is normal.

Perimeter appliances now behave like identity-bearing assets, not passive infrastructure. Once FortiCloud credentials could unlock administrative access, the control problem became an identity problem as much as a vulnerability problem. That creates direct relevance for PAM, privileged session governance, and NHI-style lifecycle control around service and administrative accounts. The named concept here is perimeter identity collapse: when a device trust boundary fails, the administrative identity attached to it fails with it. Practitioners should govern appliance access as an identity surface.

Trusted distribution channels are becoming privilege amplification paths. The eScan case demonstrates that security tooling can become the very mechanism that delivers code execution and persistence. That should force governance teams to treat security vendor updates as privileged events requiring integrity checks, provenance validation, and post-install monitoring. CIS Controls and NIST SP 800-53 both map cleanly to that expectation. Practitioners need to verify not just the update, but the behaviour it enables after install.

Identity and endpoint telemetry must be analysed together, not in silos. The Office zero-day path began as a document exploit, but the operational objective was credential harvesting and follow-on access. That means SOC, IAM, and endpoint teams need a shared view of where authentication, process execution, and privileged access intersect. MITRE ATT&CK remains useful here because the attack chain spans initial access, credential access, and lateral movement. Practitioners should align detections across those stages instead of treating them as separate tickets.

From our research:

• From our research: Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, followed by inadequate monitoring and logging (37%) and over-privileged accounts (37%), according to The State of Non-Human Identity Security.
• Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
• If you are building a response programme, pair this with Top 10 NHI Issues to align exposure reduction with identity governance.

What this signals

Perimeter trust is collapsing into identity trust. Appliance logins, privileged sessions, and configuration export rights now sit on the same risk continuum as human identity governance. Teams that still separate network security from identity operations will miss the point where valid access becomes attacker access, so their response plans need to merge IAM, PAM, and network containment.

The report also reinforces a broader programme signal: if a security product can be turned into a malware distribution path, then vendor trust deserves the same scrutiny as internal privileged access. That means hardening update provenance, reviewing blast radius for security tools, and testing whether the control plane can be abused after a single compromise. A useful reference point is MITRE ATT&CK Enterprise Matrix, which maps the escalation and lateral movement stages that follow initial access.

The practical next step is to shorten the time between detection and decisive containment. In environments with exposed appliances and high-value mailboxes, delayed action lets attackers complete credential access before the organisation can even agree on ownership. Identity and endpoint teams should rehearse cross-domain triage, because that is where the next compromise will be contained or missed.

For practitioners

• Disable or constrain FortiCloud SSO on exposed perimeter appliances Review all FortiOS, FortiAnalyzer, FortiManager, and FortiProxy appliances for device-level authentication exposure, then apply the vendor's disablement guidance where business use does not require it. Hunt for rogue administrator accounts, configuration exports, and unexpected test-device registrations from the incident window.
• Hunt for document-to-process execution patterns across endpoint telemetry Search for Word spawning PowerShell, cmd.exe, or other unusual child processes, then correlate those events with new logons, registry run keys, and suspicious attachments sent to executive or government users. Prioritise accounts that can reach sensitive mailboxes or privileged assets.
• Treat security-software updates as privileged supply chain events Require cryptographic validation for all endpoint protection updates, verify file sizes and hashes against approved baselines, and monitor for post-update persistence mechanisms such as scheduled tasks, registry exclusions, and domain blocking entries.
• Unify credential, endpoint, and appliance telemetry for faster containment Build playbooks that connect failed or suspicious authentication, local process execution, and appliance configuration changes into a single investigation path. That gives responders a chance to contain access before the attacker exports credentials or establishes persistence.

Key takeaways

• Attackers are moving from initial access to privileged use fast enough that patch cadence alone no longer defines resilience.
• Perimeter appliances, trusted update channels, and phishing attachments all become identity-adjacent risk surfaces once credentials or execution rights are abused.
• Controlling blast radius now requires joined-up exposure management, privileged access governance, and cross-domain telemetry instead of isolated point fixes.

Key terms

• Perimeter Authentication Bypass: A failure in which a network-facing device accepts valid credentials without properly confirming the device context or intended authorization path. This turns trusted login data into administrative access and often exposes configuration, routing, and credential material that attackers can use for broader compromise.
• Weaponised Attachment Chain: A weaponised attachment chain is a delivery pattern where a malicious document or embedded object starts a multi-stage infection sequence. It often combines phishing lures, code execution, and secondary payload retrieval, making email a durable initial access path.
• Trusted Update Compromise: A supply chain failure where legitimate software update infrastructure is subverted so that signed or expected updates deliver malware. The danger is not only initial code execution, but the inherited trust and elevated privileges that security tools and update agents often carry by design.
• Perimeter Identity Collapse: A control failure where the identity trust associated with a perimeter device or service breaks at the same time as the device itself. In practice, administrators, service accounts, and device registration flows become indistinguishable from attacker activity once the original trust boundary is compromised.

What's in the full article

FireCompass's full report covers the incident-level detail this post intentionally leaves for the source:

• Exact CVE and detection details for the Fortinet appliance exploitation path, including affected versions and immediate remediation guidance
• The full Office zero-day technical chain, including payload behaviour, persistence indicators, and patch references
• IOC-level details for the eScan supply chain compromise, including file names, hashes, HOSTS modifications, and registry changes
• Week-by-week incident summaries that let responders map these events into their own threat hunting and response timelines

👉 FireCompass's full report includes the incident timelines, indicators of compromise, and remediation notes behind each case.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity control with the operational risks that emerge when access is compromised.