Category: Security Operations

While the state-sponsored group deployed backdoors (Struggle/SIGNBT 3.0 and Brandoor/COPPERHEDGE) for espionage, Gunra ransomware was used in parallel attacks for data encryption and exfiltration. Overlapping indicators—including SSH key fingerprints, network infrastructure, and watering hole domains—suggest shared TTPs, though ASEC concludes no definitive collaboration has been proven. The campaign, named 'Operation Double Barrel,' highlights the risk of dual-use exploits in critical financial software supply chains. Read more

A vulnerability in ABB's KNX Update Tool allows attackers with physical bus access to compromise legacy KNX devices lacking integrity checks, rendering them unusable or altering behavior, with no software fix possible due to outdated protocol design. Read more

A critical vulnerability (CVE-2026-7891) in Siemens Mendix Runtime allows privilege escalation and unauthorized access to sensitive user data due to inadequate documentation of System.User entity behavior, enabling misconfigured access rules that expose all records to anonymous users. Read more