The Cyber Byte - 19 May 2026

The cyber threat landscape for this reporting period has been dominated by mass exploitation of edge infrastructure, supply-chain compromises, and the exposure of sophisticated ransomware operations. State-sponsored actors like North Korea’s Lazarus Group and cybercriminal syndicates such as The Gentlemen are actively adapting their tactics to include live surveillance and AI-accelerated malware development. Furthermore, the proliferation of unmanaged non-human identities and the weaponization of AI hallucinations pose severe systemic risks to enterprise security postures. Critical vulnerabilities in industrial routers and the exploitation of open-source registries remain pressing avenues for initial access and botnet expansion.

Significant Cyber Incidents and Articles of Interest

• Four-Faith Router Mass Exploitation: Global commerce and industrial sectors are currently under active attack targeting CVE-2024-9643, an authentication bypass flaw in Four-Faith F3x36 industrial cellular routers. This incident involves the exploitation of hardcoded credentials within the management interface to achieve full infrastructure takeover. CrowdSec telemetry indicates mass exploitation began escalating significantly by mid-May 2026, pointing to automated campaigns designed to absorb neglected edge devices into extensive botnet arrays. This represents a critical threat to organizations relying on remote field equipment and branch infrastructure, requiring immediate firmware patching to prevent botnet assimilation. [2]

• The Gentlemen Ransomware Operations Exposed: A highly active Ransomware-as-a-Service (RaaS) group known as The Gentlemen recently suffered a breach of their internal 4VPS hosting infrastructure, exposing the operation's backend. The leak revealed that the administrator, a former Qilin affiliate, heavily relies on AI coding assistants to develop ransomware tools rapidly, and the group actively utilizes chain-victimization—leveraging data stolen from one victim (e.g., a UK consultancy) to immediately breach their clients (e.g., a Turkish firm). The exposure underscores the devastating operational impact of third-party breaches and the increasing professionalization of small, highly skilled RaaS syndicates targeting unpatched edge devices. [6]

• AI Hallucinations Inducing Security Blindspots: Enterprise security operations are facing growing risks from AI hallucinations, where models confidently present factually incorrect outputs that manipulate human trust. These hallucinations are leading to missed cyber threats (especially zero-days missing from training data), fabricated false positive alerts that cause alert fatigue, and incorrect remediation guidance such as deleting critical system files. As AI systems are integrated into automated defenses, organizations are urged to enforce strict least-privilege access for AI agents and mandate human-in-the-loop verification before executing privileged actions. [5]

• Microsoft Edge Password Memory Mitigation: Microsoft has rolled out a defense-in-depth update for the Edge browser to mitigate an issue where saved passwords were being loaded into process memory in cleartext upon startup. While the original behavior fell within the expected threat model—requiring an attacker to have prior local control of the device—the change proactively reduces exposure to post-compromise credential harvesting. This update, prioritized under the Secure Future Initiative (SFI), is live in Edge build 148 and newer across all supported versions. [1]

• Unmanaged Identity "Dark Matter" Outweighs Visible Identity: A new report from Orchid Security reveals that 57% of enterprise identity now exists outside the purview of centralized IAM systems, classifying it as "identity dark matter." Furthermore, 67% of non-human accounts are created locally within applications, bypassing formal governance, and 70% of enterprise applications contain excessive privileged accounts. This systemic lack of visibility presents a critical risk as organizations deploy unpredictable, autonomous AI agents that will actively exploit these hidden, unmanaged access pathways. [8]

Threat Actor Activity

• Lazarus Group (DPRK): Evolving their "Contagious Interview" campaign, Lazarus operators are utilizing the "OtterCookie" JavaScript/Node.js RAT to shift from traditional stored-data theft to continuous live surveillance of developer workstations. They employ Socket.IO over Engine.IO v4 to maintain persistent control planes that capture keystrokes, clipboard data, and screen captures. The malware is heavily distributed via compromised npm packages and Vercel staging domains, utilizing colliding uid and userKey values to track campaign deployment batches rather than individual machines. [3]

• TeamPCP Copycats: Unidentified threat actors are aggressively capitalizing on the recent TeamPCP open-source code leak by deploying exact, unobfuscated clones of the Shai-Hulud infostealer to the npm registry. Using typo-squatting techniques against packages like Axios, these actors distribute various payloads—including SSH key stealers, crypto wallet hijackers, and DDoS botnets written in GoLang—to harvest cloud credentials and absorb developer endpoints into botnets. [4]

• The Gentlemen (RaaS): This ransomware syndicate uses a highly lucrative 90/10 affiliate split to attract skilled operators. Their TTPs almost exclusively rely on exploiting unpatched internet-facing devices (such as CVE-2024-55591 and CVE-2025-32433) or using purchased credentials to gain initial access. Once inside, they swiftly execute Active Directory enumeration, NTLM relay attacks, and EDR disablement before deploying ransomware domain-wide via Group Policy. [6]

• SHub Reaper Operators: Targeting macOS environments, these threat actors use fake WeChat and Miro installers alongside typo-squatted Microsoft domains to deliver the "Reaper" variant of the SHub infostealer. They bypass Terminal mitigations by dynamically constructing applescript:// payloads. TTPs include deploying an AMOS-style Filegrabber module for document theft, actively modifying local crypto wallet application bundles (like Exodus and Ledger) to intercept funds, and installing persistent backdoors mimicking Google Software Updates. [7]

Indicators to Watch

• CVE-2024-9643 Mass Exploitation: Monitor for crafted HTTP requests directed at the /Status_Router.asp endpoint on Four-Faith F3x36 industrial routers. Immediate patching is required as a CVSS 9.8 flaw is being actively used to fold these devices into broader botnet infrastructure. [2]

• Malicious npm Typo-Squatting: Security teams should audit environments for the installation of malicious npm packages chalk-tempalte, @deadcode09284814/axios-util, axois-utils, and color-style-utils. Network blocks should be applied to C2 endpoints: 87e0bbc636999b[.]lhr[.]life, 80[.]200[.]28[.]28:2222, b94b6bcfa27554[.]lhr[.]life, and edcf8b03c84634[.]lhr[.]life. [4]

• SHub Reaper macOS Stealer Activity: Monitor for unexpected execution of osascript or the applescript:// URL scheme, especially following interaction with fake domains like qq-0732gwh22[.]com or mlcrosoft[.]co[.]com. Inspect macOS environments for persistence mechanisms created under ~/Library/Application Support/Google/GoogleUpdate.app/Contents/MacOS/GoogleUpdate and block C2 hebsbsbzjsjshduxbs[.]xyz. [7]

• OtterCookie Live Beacons: Search for Engine.IO v4 / Socket.IO upgrades to non-standard high-numbered ports originating from developer workstations. Behavioral indicators include detached Node.js child processes, recurring clipboard reads with no user-facing context, and anomalous payload fetches from Vercel-hosted domains during npm post-install hooks. [3]