Wednesday, September 30, 2026|Issue 13|6 min read|Join the discussion
The systems closest to trust boundaries are where attackers want to land
Attackers increasingly don't need exotic malware when trusted identities, development pipelines, signed remote-management software and edge appliances already provide the access they need. At the same time, infrastructure vendors are redesigning trust itself, from post-quantum web certificates to security agents embedded in enterprise AI workflows.
The short version
- Storm-3068 turned one self-service password reset into Azure DevOps and Kubernetes access, Microsoft says, with no malware involved.
- Phishing lures delivered a legitimate, signed MSP360 RMM installer that then pulled down ScreenConnect for a second way back in.
- Star Blizzard's new RedFlick delivery uses scheduled tasks to drop CosmicPulse with a single user interaction.
- NetScaler CVE-2026-88771/88772 hit their federal deadline today; the job now is patched and investigated.
- Cloudflare plans to become a public CA with post-quantum Merkle Tree Certificates.
Issue at a glance
2 critical2 high
- criticalIdentityStorm-3068 walks from a password reset into the pipeline
- highSecurityA signed RMM installer is still an attacker's foothold
- highSecurityStar Blizzard trims the clicks out of its infection chain
- criticalVulnerabilityNetScaler moves from patch emergency to compromise investigation
Patch clock
| CVE | Product | What it is | Severity |
|---|---|---|---|
| CVE-2026-88771 | Citrix NetScaler ADC and Gateway | Unauthenticated remote command execution; default configurations | Critical (CVSS v4 9.5), KEV, exploited |
| CVE-2026-88772 | Citrix NetScaler ADC and Gateway | Memory overflow leading to RCE or denial of service when DTLS is enabled | Critical (CVSS v4 9.5), KEV, exploited |
Also on the vulnerability desk
- Fixed builds per Citrix: 14.1-73.37 and later, 13.1-64.23 and later, 14.1-73.37 FIPS and later, and 13.1-37.279 FIPS/NDcPP and later. The objective is patched and investigated, not just patched.
Breaking
identity / Azure DevOps / Kubernetes
Storm-3068 walks from a password reset into the pipeline
Microsoft's incident responders describe Storm-3068 gaining a user account through self-service password reset, then registering its own authentication methods to take full control of the identity. It used legitimate admin tools and scripts to enumerate Azure DevOps repositories, projects, pipelines and deployment environments, modified pipelines to collect Kubernetes credentials, and installed the Atera RMM agent and the Chisel tunneling tool for persistence. Microsoft says no malware or software exploits were used.
Why it matters. Repositories and CI/CD are control-plane assets. They hold deployment identities, configuration and secrets that reach production.
What to do. Correlate password resets with new MFA or authentication-method registration. Audit pipeline identities, service connections and secrets; require pipeline approvals; restrict who can enumerate projects; and hunt Azure DevOps activity that follows identity changes.
RMM / phishing / ScreenConnect
A signed RMM installer is still an attacker's foothold
Microsoft Defender Experts observed phishing campaigns, starting in July, that delivered a legitimate, digitally signed MSP360 RMM installer disguised as meeting invitations, PDF tools and software updates. Once run with elevation, the RMM access was used to download and install a ConnectWise ScreenConnect client as a redundant remote-access channel, then for information collection and credential access. Microsoft did not observe exploitation of ScreenConnect itself, and has not attributed the activity.
Why it matters. Malicious use of legitimate admin software defeats simple binary-reputation thinking. A valid signature says who built the file, not who is driving it.
What to do. Keep an inventory of approved RMM tools and block the rest. Alert on new RMM installs, especially right after browser or email activity, and on a second RMM appearing where one already exists.
nation-state / Russia / phishing
Star Blizzard trims the clicks out of its infection chain
Microsoft says the Russian state actor Star Blizzard has, since January, shifted to larger phishing campaigns sent from accounts on compromised websites and a delivery technique it calls RedFlick. RedFlick creates scheduled tasks to deploy the CosmicPulse backdoor and needs a single user interaction, unlike the earlier ClickFix chain that required several. Targets include Ukrainian institutions, NGOs, think tanks and governments with a Ukraine nexus.
Why it matters. Less victim interaction means fewer chances for a user to notice something is wrong.
What to do. Hunt Microsoft's published IOCs and queries, and watch for new scheduled tasks posing as maintenance components, especially after archive or VHDX attachments are opened.
Citrix / NetScaler / KEV
NetScaler moves from patch emergency to compromise investigation
Today is CISA's federal deadline for CVE-2026-88771 and CVE-2026-88772. Citrix confirms exploitation and lists fixed builds. LevelBlue reports observed post-exploitation activity across customer environments, including payload retrieval, reverse shells, persistence, web-shell installation and attempted theft of NetScaler configuration data.
Why it matters. Vulnerability remediation is not incident remediation. A patched appliance can still carry a web shell planted before the patch.
What to do. Confirm fixed builds, then preserve logs and snapshots, check for web shells and unexpected accounts or configuration changes, review outbound connections and rotate credentials stored on or passed through the appliance.
CVE-2026-88771, CVE-2026-88772
Citrix security bulletin CTX697096|CISA|Unit 42|LevelBlue SpiderLabs
Trends
If this thing falls, what authority falls with it?
Yesterday the unit of control was identity. Today the unit of risk is authority. The password reset that became a DevOps foothold, the signed RMM tool, the edge appliance and the security agent wired into an AI workspace all carry delegated power. Ask of every system: if this thing falls, what authority falls with it?
The attack surface is becoming a chain of authority
Storm-3068 shows how identity, source control, pipelines and clusters are linked. Each link inherits the trust of the last, so defense has to follow the chain, not the individual asset.
Signed software is not trusted behavior
Both the MSP360 campaign and Storm-3068's use of Atera rely on legitimate, signed tools. Detection has to ask whether the behavior is expected, not whether the binary is known.
Post-quantum migration is moving into infrastructure
Cloudflare announced its intent to become a public CA, has applied to the Chrome, Apple, Microsoft and Mozilla root programs, agreed to acquire trusted root key material from GlobalSign, and plans to support post-quantum Merkle Tree Certificates, targeting early 2027 for Chrome's quantum-resistant root program. It is not issuing certificates yet. Separately, Palo Alto Networks' CLARA Agent connects Strata Cloud Manager to Google Cloud Gemini Enterprise for plain-language questions about cloud exposure and shadow AI. The question for any security agent: what authority should it have, and how is that audited?
Clearance corner
BOD 26-04 and risk-based remediation
The NetScaler deadline is BOD 26-04 in action: known exploitation and exposure set priority, not raw CVSS. For practitioners, the skill that matters is showing that a fix was verified and the asset investigated, not just that a ticket closed.
What we are watching next
NetScaler post-exploitation
More IOCs and victim reports now that the deadline has passed.
Storm-3068
Whether the identity-to-pipeline pattern shows up in other environments.
Star Blizzard / RedFlick
New lures and changes to the scheduled-task chain.
Cloudflare CA
Root program decisions and the timeline to first issuance.
AI security agents
Identity, permissions and auditability as security tools move into AI workspaces.
Sources
Join the discussion
Loading comments…