Rust Supply Chain Attack, Entra ID Zero-Day, and Cisco, TrueConf Patches

Malicious Rust Crates Turned cargo build Into a Malware Installer

The Rust Project pulled malicious releases of three widely used crates this week after a compromised maintainer account let attackers slip malware directly into the crates.io ecosystem, no imports or function calls required to trigger it.

What You Need to Know

Attackers published malicious versions of three popular Rust crates, arrayref 0.3.10, internment 0.8.7, and append-only-vec 0.1.9, on August 20, and the releases stayed live for 86 to 107 minutes before removal. Each added a dependency on proc-macro1, a typosquat of the legitimate proc-macro2 crate, whose build script downloaded and ran a remote payload during dependency resolution. Because the trigger was cargo build, cargo check, or cargo test rather than any library function, a developer could get infected just by compiling. arrayref is deeply embedded in the Rust dependency tree, so the blast radius here is real.

What Happened

The attacker compromised a maintainer account and used it to push the three tainted releases into crates.io. Each one added proc-macro1 as a dependency, a package built to look like proc-macro2 at a glance. The proc-macro1 source itself was a functional copy of the real crate, so affected projects still compiled cleanly. The malicious part lived in the build script, which reconstructed its payload infrastructure from encoded fragments at build time rather than shipping the payload outright, a design clearly meant to survive casual code review.

The attacker also pulled arrayref versions 0.3.5 through 0.3.9 from the registry, a move that likely nudged developers toward updating to the newly published, and malicious, 0.3.10 release.

The Details

Once triggered, the build script disabled TLS certificate verification and picked a payload based on the host's operating system and architecture. On Linux and macOS, it wrote an executable to /tmp/rust-setup. On Windows, it used a VBScript launcher to deploy a hidden PowerShell payload. The resulting second-stage implant could establish persistence through Windows Registry Run keys, macOS LaunchAgents, or Linux systemd user services, communicate with command-and-control infrastructure over HTTPS, pull down further payloads, and go after browser-stored credentials. Researchers have flagged infrastructure overlap with recent North Korean supply-chain activity, but no one has formally attributed this crates.io compromise to a specific actor.

Why This Matters

This wasn't a bug in library code that only bites you if you call a specific function, it was an attack on the build process itself, and cargo's normal dependency resolution ran the malicious code automatically. Any project with a permissive version range on arrayref, internment, or append-only-vec during that window was exposed, and hundreds of crates depend on arrayref alone. Automated build pipelines that pull fresh dependencies on every run are exactly the kind of unattended, trusted process this technique is designed to exploit.

What to Do

Check Cargo caches, build logs, endpoint telemetry, and lockfiles for the affected crate versions and for proc-macro1, proc-macro-en, aovine, arone, aronenao, and tinymember. Look for network connections to 23.254.165.112, and check systems for /tmp/rust-setup or the Windows PowerShell/VBScript payload chain, along with the persistence mechanisms described above. Rotate any browser or development credentials that may have been exposed. Longer term, this is a good prompt to revisit dependency pinning, SBOM validation, registry monitoring, and a minimum package-age policy for anything that flows into an automated build pipeline.

A compromised maintainer account is a hard thing to defend against directly, but a little friction in how fast new package versions reach your build can turn a 90-minute exposure window into a non-event.

Microsoft Discloses Exploited Entra ID Zero-Day, Already Fixed

Microsoft disclosed a maximum-severity Entra ID vulnerability that attackers exploited before it was patched, and while no customer action is required, it's a good moment to check your identity monitoring is actually ready for this kind of incident.

What You Need to Know

CVE-2026-69836 is a maximum-severity, unauthenticated remote code execution flaw in Microsoft Entra ID, the identity service formerly known as Azure Active Directory that underpins sign-in and access control for Microsoft 365, Azure, Dynamics CRM Online, and connected enterprise apps. Microsoft has fully mitigated it at the service level, so customers don't need to patch anything themselves. Still, an unauthenticated, no-user-interaction RCE bug in the platform that manages tenant identities and administrative privileges is worth a closer look at your own detection posture, even after the vendor has closed the hole.

What Happened

CVE-2026-69836 is an insecure deserialization vulnerability that let an unauthenticated attacker execute code remotely over the network, and with low complexity. No privileges and no user interaction were required, which is about as favorable a combination as an attacker can ask for, especially against a service that manages tenant identities, authentication policies, application access, and administrative privileges. Microsoft has not released details on the exploitation activity, which service components were affected, or indicators of compromise, and no public exploit code was available at the time of disclosure. That limited detail is likely deliberate, reflecting both the sensitivity of the affected service and Microsoft's choice to prioritize disclosure once the fix was already in place rather than before.

Why This Matters

A vulnerability in a centralized identity provider is a different category of risk than a typical app bug. If an attacker compromises the identity plane, they can establish persistence, tamper with application registrations, reach sensitive workloads, or simply impersonate trusted users and admins. Microsoft closing the hole doesn't retroactively tell you whether anything touched your tenant while it was open, which is why this is really a detection and readiness story, not just a patching one.

What to Do

No remediation action is required for CVE-2026-69836 itself. Use the disclosure as a prompt to confirm you have high-fidelity logging on Entra ID sign-ins, audit events, privileged role assignments, application consent activity, service principal changes, and conditional access policy changes. Review authentication logs for unusual token activity, new federated identity credentials, unexpected enterprise application permissions, and admin actions from unfamiliar locations or devices. Also take the opportunity to confirm MFA enforcement, privileged access controls, and incident-response procedures are actually ready for a cloud identity compromise scenario.

Microsoft closed this one before most organizations even knew it existed, but the exercise of checking your own identity telemetry is worth doing regardless of who catches the next one.

CISA Orders Federal Agencies to Patch Actively Exploited TrueConf Server Flaws

Two critical TrueConf Server vulnerabilities are now confirmed under active exploitation, and CISA has given federal agencies a hard deadline to fix them, with a Russia-linked hacktivist group already using both flaws to plant backdoors.

What You Need to Know

CISA added CVE-2026-72529 and CVE-2026-72530 to its Known Exploited Vulnerabilities catalog after confirming active exploitation against TrueConf Server, a self-hosted messaging and video-conferencing platform typically deployed inside an organization's own network. Federal Civilian Executive Branch agencies must remediate by September 3, 2026. The two flaws chain together into a path from unauthenticated access straight to full server-level code execution, and a hacktivist group has already used them to turn a trusted internal communications tool into a malware delivery mechanism.

What's Vulnerable

CVE-2026-72529 is a missing authentication vulnerability that lets an unauthenticated remote attacker invoke an undocumented function over TCP port 4307 and run arbitrary scripts on an unpatched TrueConf Server. CVE-2026-72530 is a separate, critical code-injection flaw that lets an attacker who has already gained execution inside TrueConf's isolated environment escape the application sandbox and run commands on the underlying operating system. Chained together, they give an external attacker a practical route from no credentials at all to full server-level compromise, particularly anywhere TrueConf is internet-facing or reachable through partner networks, remote-access infrastructure, or loosely segmented internal environments.

What Happened

Kaspersky reports that the Head Mare hacktivist group has exploited both vulnerabilities since at least July 2026, targeting Russian organizations across transportation, energy, IT, electronics, and software development. The group replaced legitimate TrueConf client installers with malicious versions that deployed backdoor malware, effectively weaponizing a trusted internal communications platform as a distribution channel. This isn't TrueConf Server's first high-profile incident this year either: it was also targeted in Operation True Chaos, a zero-day campaign involving CVE-2026-3502 attributed to Chinese threat actors.

Why This Matters

TrueConf Server sits inside an organization's local network by design, which is exactly why compromising it is so valuable to an attacker: it's an internal foothold with a built-in path to lateral movement, and in this case, a built-in mechanism (the client installer) for spreading further. The two vulnerabilities being both exploitable in the wild and chainable into full OS-level access raises the stakes well beyond a typical unpatched-server scenario.

What to Do

Identify every TrueConf Server deployment in your environment and confirm whether TCP port 4307 is externally accessible. Apply the vendor updates immediately, and review server and network logs for abnormal script execution, unauthorized installer modifications, new administrative activity, or unexpected outbound traffic. Validate the integrity of your software distribution process for TrueConf clients, restrict management interfaces to approved administrative networks, enforce MFA for privileged access, and isolate communications infrastructure from your sensitive systems so a compromise here doesn't cascade further.

Federal agencies have a hard deadline, but any organization running TrueConf Server, especially one with a presence in sectors already targeted, should treat September 3 as their deadline too.

Attackers Are Hiding Malware Commands in FTP Server Banners

A Windows malware campaign is using something you'd never think to monitor, the greeting text an FTP server shows on connection, as a covert channel to deliver commands for two new remote access trojans, E4del and PINHOLE.

What You Need to Know

SOCRadar has identified a campaign, active since early July 2026 and still running in August, that hides PowerShell commands inside FTP server banners instead of using a typical web-based dead drop. The infection starts with a phishing-delivered ZIP archive containing a malicious shortcut file, and it leads to one of two previously undocumented trojans: E4del, a Node.js-based RAT disguised as a signed Discord Electron app, or PINHOLE, a more evasive tool that pulls its configuration from Pinterest pins and SurveyMonkey surveys. Both give an attacker hands-on-keyboard access, and the technique itself, treating FTP banners as a C2 channel, is a reminder that overlooked protocols still make useful hiding spots.

What Happened

The infection chain begins with a ZIP archive containing a malicious Windows shortcut (LNK) file, almost certainly delivered through phishing. Running the LNK file connects to an attacker-controlled FTP server and pulls a PowerShell command out of the banner text the server presents on connection, a channel most security tooling isn't watching. From there, the campaign branches into one of two payloads. One path installs E4del, distributed as a digitally signed Electron application impersonating Discord, which supports persistent and temporary command shells, screenshot capture, desktop streaming over WebSockets, and further payload execution. The other deploys PINHOLE, which retrieves its command-and-control configuration from Pinterest pins and SurveyMonkey survey questions rather than traditional infrastructure.

The Details

PINHOLE is built for stealth: it keeps only a 4 KB slice of its payload in memory at a time before injecting the assembled code into a suspended ApplicationFrameHost.exe process using Early Bird APC injection. It supports at least 14 commands, covering file discovery, file transfers, command execution, process management, screenshot capture, and theft of browser-stored credentials. SOCRadar has observed only 11 execution events so far, but the combination of LNK-based delivery, FTP-banner command retrieval, signed-app impersonation, web-service-hosted configuration, and process injection gives the operators multiple ways to slip past traditional detection at once.

Why This Matters

Most detection strategies focus on well-known C2 channels: web traffic, DNS, known-bad IPs. A campaign that hides commands in an FTP banner, or configuration in Pinterest pins and SurveyMonkey questions, is specifically designed to look like nothing worth flagging. Combined with a signed Electron app impersonating a legitimate tool like Discord, this campaign is built around exploiting the gaps in what defenders typically watch, not around any novel exploit.

What to Do

Block or tightly restrict outbound FTP connections, especially from workstations that have no legitimate need for the protocol, and alert on FTP sessions initiated by PowerShell, script hosts, LNK-launched processes, or user-profile directories. Have email gateways and endpoint telemetry flag ZIP archives containing shortcut files, and look for Electron applications masquerading as Discord. Watch for suspicious activity involving ApplicationFrameHost.exe, Node.js, WebSocket connections, Pinterest, or SurveyMonkey. Incorporate the campaign's available indicators into your detection workflows, and remind users to treat unsolicited archives and shortcut-based attachments as high risk.

The exploit here isn't a piece of software, it's an assumption about where malicious commands come from, and this campaign is built to live in the blind spot that assumption creates.

Cisco Patches Nine Crosswork and Secure Workload Vulnerabilities, Five Rated Maximum Severity

Cisco has shipped fixes for nine vulnerabilities across its Crosswork network-automation platforms and Secure Workload segmentation software, five of them rated a perfect 10.0 on the CVSS scale, with no known exploitation yet but plenty of reason not to wait.

What You Need to Know

Cisco's latest round of hardening releases addresses nine vulnerabilities across Crosswork Data Gateway, Crosswork Network Controller, Crosswork Planning, and Secure Workload (formerly Tetration), five of which carry the maximum CVSS score of 10.0. Cisco says it isn't aware of active exploitation of any of these nine issues, but both product lines sit in high-value network-management and workload-security roles, which makes rapid patching worth prioritizing regardless. This follows Cisco's ongoing internal security review, which has already produced several other hardening releases across its portfolio this month.

What's Vulnerable

Four vulnerabilities affect Crosswork Data Gateway, Crosswork Network Controller, and Crosswork Planning running version 7.2.1 or earlier, regardless of device configuration. All four are fixed in Crosswork Release 7.2.1-SP. Crosswork products collect telemetry, support network automation, and manage service-provider or enterprise network operations, so a compromise here could give an attacker visibility into network infrastructure, access to management-plane services, or a way to disrupt automation workflows.

The remaining five vulnerabilities affect Secure Workload, across both SaaS and on-premises deployments. Secure Workload provides workload visibility, segmentation, and application dependency mapping, which means a weakness in the platform can have security implications well beyond the host it runs on.

The Backstory

This isn't an isolated release. It follows Cisco's remediation of 12 vulnerabilities in Catalyst SD-WAN and IOS XE Software earlier in August, plus the company's separate warning that CVE-2026-20349, an 8.6-severity flaw in Secure Firewall ASA and FTD Software, has already been exploited in the wild. Cisco hasn't linked the new Crosswork and Secure Workload issues to any known attacks, but the pattern across the month underscores how much attention management-plane infrastructure is getting right now, from both Cisco's own review process and, in at least one case, real-world attackers.

Why This Matters

Crosswork and Secure Workload aren't edge products, they sit in the management plane and the segmentation layer, which means a compromise doesn't just affect one host, it can affect visibility and control across your whole network. Five maximum-severity ratings in one release is a strong signal about how bad exploitation could get, even without confirmed attacks yet, and the broader pattern this month (SD-WAN, IOS XE, ASA, FTD, and now Crosswork and Secure Workload) suggests Cisco's management-plane products are getting sustained scrutiny from somewhere.

What to Do

Identify all Crosswork deployments, confirm version information, and apply the 7.2.1-SP update, then validate that administrative interfaces and associated APIs are restricted to trusted management networks. For Secure Workload, apply vendor updates across all impacted deployment models, review administrative accounts and privileged access assignments, and confirm integrations with identity providers, cloud services, and network-enforcement components are limited to approved service accounts. Assess whether remediation requires agent, collector, or controller updates, and validate deployment health after patching. More broadly, treat internet-exposed or remotely accessible Cisco systems as priority assets, limit administrative access through segmentation and MFA, and monitor for unusual configuration changes or API activity.

No confirmed exploitation yet doesn't mean no urgency, five perfect CVSS scores in products that manage your network's visibility and control are exactly the kind of gap attackers go looking for once details are public.