Fresh exploits, zero-day weaponisation and supply chain risk

At a glance

What this is: FireCompass’s weekly threat report shows attackers quickly weaponising a Fortinet appliance flaw, an Office zero-day and a supply chain compromise in the same week.

Why it matters: For identity and security teams, the article underlines how administrative access, trusted software channels and exposed perimeter systems can become fast-moving entry points before normal remediation cycles catch up.

By the numbers:

• 200-500+ customers were affected by the eScan supply chain attack across South Asia.
• 60+ government targets were hit by APT28 spear-phishing.
• Within 72 hours, attackers had weaponized fresh vulnerabilities and delivered malware through trusted channels.

Context

This week’s pattern is a control-latency problem: exposed systems, phishing delivery and trusted update channels were all converted into operational access faster than many defenders can patch, isolate or verify. The primary security gap is not discovery of risk, but the interval between public exposure and enforced control.

The identity angle is strongest where the article describes administrative access, credential exposure and trusted distribution paths. Those are governance failures as much as technical ones, because they show how quickly high-trust pathways can be abused before lifecycle controls, authentication hardening or containment measures take effect.

The report is typical of modern exploitation pressure rather than an outlier. Attackers are increasingly sequencing multiple entry paths in the same week, which means defenders must treat exposure management, privileged access and software trust as one operating problem.

Key questions

Q: What fails when perimeter SSO is allowed to cross trust boundaries on security appliances?

A: The failure is that appliance administration becomes reachable through an identity flow that was never meant to govern the device itself. Once authentication and device registration are not isolated, a valid credential can become a route to backdoor accounts, configuration export and full perimeter control.

Q: Why do fresh vulnerabilities sometimes become operational incidents within hours?

A: Because attackers do not wait for normal patch cycles. They target exposed services, use trusted delivery paths and automate post-exploitation steps quickly enough that remediation, detection and account review all lag behind the first compromise.

Q: What are the warning signs that a security tool or appliance has been turned into the attack path?

A: Look for new administrator accounts, unexpected outbound connections, configuration export activity, disabled protections and update activity that does not match the normal vendor trust chain. Those signals suggest the control plane itself has been subverted.

Q: How should organisations decide whether to trust a signed software update?

A: Signature validation is necessary but not sufficient. Teams should also verify the distribution path, the update package size and behaviour, the privileges it requests and whether an upstream compromise would let a vendor channel deliver attacker code at scale.

Technical breakdown

Fortinet SSO bypass and administrative takeover

CVE-2026-24858 worked because FortiCloud SSO validation and appliance-level authentication were not sufficiently isolated. Once a valid FortiCloud credential could register or authenticate in the wrong trust context, attackers could obtain administrative access on vulnerable devices, create backdoor accounts and export network configurations. That turns a login problem into a device-control problem, because the appliance itself becomes the privilege boundary. The mechanism matters for IAM and PAM teams: authentication that spans devices, tenants or trust zones must be evaluated as an access-control design, not just a credential check.

Practical implication: treat cross-device SSO on security appliances as a privileged access control surface, not a convenience feature.

Office zero-day delivery and in-memory execution

The Office campaign used a Mark-of-the-Web bypass to get malicious documents to instantiate blocked COM objects without macro prompts. That let the payload execute inside Word’s process context, which reduces user friction and bypasses several common control assumptions around document warnings. The important architectural point is that initial access did not rely on a traditional executable dropping to disk first. Instead, trust in a familiar file format and application runtime was enough to start code execution, which then enabled credential access and persistence.

Practical implication: strengthen document handling controls around COM object abuse, process spawning and post-open behaviour.

Supply chain compromise through trusted update infrastructure

The eScan incident shows what happens when signing, update delivery and endpoint trust are assumed to be equivalent. A compromised regional update server can distribute malicious binaries that appear legitimate to downstream customers, which collapses the normal distinction between vendor content and attacker content. In operational terms, this is a trust-propagation problem: once the updater is compromised, every managed endpoint that accepts the update inherits the attacker’s code path. For defenders, the key issue is not just malware detection but how much execution authority is implicitly granted to the software supply chain.

Practical implication: validate update integrity independently of vendor distribution paths and treat security software updates as privileged code.

Threat narrative

Attacker objective: Attackers sought fast access to high-trust environments so they could create persistence, harvest credentials, and use trusted software or admin channels to widen control.

1. Entry began with a Fortinet FortiCloud SSO bypass and with weaponised Office documents delivered by spear-phishing, giving attackers initial footholds through trusted access channels.
2. Credential access and privilege escalation followed when malicious administrators were created on appliances and LSASS memory was targeted on compromised Windows hosts.
3. Impact came through perimeter compromise, network reconnaissance, persistent backdoors and a supply chain infection that turned antivirus updates into malware distribution.

Breaches seen in the wild

• New York Times GitHub breach 2024: An exposed GitHub token gave an attacker The New York Times' repositories; the 270GB leak held 4,875 unique secrets.
• Gladinet Hard-Coded Keys RCE Exploitation: Actively exploited hard-coded keys in Gladinet CentreStack and Triofox enable remote code execution.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Control latency has become the decisive security variable. The article shows attackers converting fresh exposure into functioning access inside the same operational window, which means patch volume is no longer the main planning metric. What matters is how quickly the control plane can enforce new trust decisions across appliances, endpoints and update channels. Practitioners should measure exposure-to-containment time, not just vulnerability counts.

Trust propagation is now a governance problem, not only a malware problem. The eScan case shows how one compromised distribution path can turn a security tool into an attack vector, which is a broader supply chain lesson for every managed control plane. This is the kind of failure that undermines assumptions about signed updates, vendor trust and delegated execution authority. Practitioners should govern the trust chain, not just the endpoint.

Administrative access is the real blast-radius multiplier. The Fortinet incident shows that once an attacker reaches appliance-level admin, perimeter infrastructure can become a credential and topology extraction point. That intersects directly with PAM and NHI governance because the most dangerous identities are the ones that can reconfigure the control plane itself. Practitioners should focus privileged access policy on the systems that define trust for everyone else.

Fresh exploit campaigns collapse the separation between alerting and response. When exploitation, phishing and supply chain compromise all land within days, detection that arrives after the first session is already too late to shape outcomes. That pressure forces security programmes to align vulnerability management, identity controls and software trust governance into a single exposure-management operating model. Practitioners should plan for same-week exploitation, not next-cycle remediation.

What this signals

Exposure management now has to include identity-bearing infrastructure. Perimeter appliances, security software update channels and document runtimes are not just technical assets, they are trust gateways. When those gateways are compromised, identity controls downstream have less time to detect or contain abuse.

Same-week exploitation should reshape remediation priorities. The article shows that public disclosure and practical abuse are no longer separated by a comfortable interval. Security teams need operational rules that push appliance takeovers, zero-day document delivery and supply chain trust failures to the front of the queue before lateral movement begins.

For practitioners

• Harden appliance SSO boundaries Disable or restrict cross-context SSO on perimeter appliances where device registration and authentication are not strictly isolated. Review any path that allows one identity domain to administer another trust zone.
• Review privileged accounts created during the attack window Search for new or unexpected administrator accounts on Fortinet devices and similar appliances, especially where account names or roles suggest backup, audit or security administration.
• Tighten document execution controls Block or monitor Office behaviours that spawn PowerShell, cmd.exe or COM object execution after document open, because that is the practical bridge from spear-phishing to host compromise.
• Separate update trust from endpoint trust Require independent integrity validation for security software updates and check that regional or third-party update infrastructure cannot distribute code without additional verification.
• Re-prioritise exposure management around high-trust systems Put perimeter appliances, endpoint security tools and identity-bearing software channels at the top of remediation queues because they can amplify compromise across the rest of the estate.

Key takeaways

• The report links three different attack paths to the same operational problem: defenders are losing the race between disclosure and enforcement.
• The strongest evidence in the article is not the number of vulnerabilities but the speed at which attackers converted them into admin access, footholds and malware delivery.
• Security teams should treat perimeter appliances, Office document handling and update infrastructure as high-trust control points that require faster containment decisions.

Key terms

• Trust Boundary: A trust boundary is the point where one system’s authority should stop and another system’s authority should begin. For internal automation, weak trust boundaries let monitoring, remediation, and execution share privileges that should have remained separate.
• Exposure-to-Containment Time: Exposure-to-containment time is the interval between a vulnerability becoming usable and the point at which defenders actually block or isolate it. In fast exploitation campaigns, that window determines whether a flaw stays theoretical or becomes a live access path across appliances, endpoints or supply chains.
• Supply Chain Propagation Trust Gap: The supply chain propagation trust gap is the risk that trust in one software or service component is inherited by downstream systems without fresh verification. In practice, a signed package, trusted dependency, or approved integration can spread compromise across environments when identity, provenance, and integrity checks are not continuously enforced.
• Privileged Administration Surface: A privileged administration surface is any interface that can alter configuration, content, identity flows or backend connectivity. In SAP portal environments, these surfaces deserve control-plane treatment because compromise can move quickly from administrative action to host-level execution or downstream trust abuse.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is suitable for practitioners who need to connect privileged access, lifecycle control, and governance decisions across modern identity programmes.