[bambootoken]

September 22, 2026

Delivery Through the Trust Layer: GPO, a Signed Driver, and Valid npm Provenance

PAYLOAD ransomware achieved full Windows impact through a Group Policy Object at the domain root, eliminating the need for binary encryption or persistence. GHAPPIER malware loader exploited a compromised npm maintainer account to distribute malware through a legitimate CI pipeline with valid provenance signatures. Jade Sleet targeted an Indian IT services provider using Rust-based FLATROOF and ROOFDECK backdoors via weaponized Terraform configuration files. Three unpatched Linux kernel vulnerabilities (CVE-2025-39964, CVE-2026-53266, CVE-2025-39682) now have exploitation in the wild and CISA's remediation deadline has passed.

September 16, 2026

• BambooToken uses MQTT for C2 across Windows and Linux systems. Lumen Black Lotus Labs traces the activity from February 2023 through July 2026, including infections associated with backend services and a GitLab instance across Asia and South America. The Windows agent was sideloaded by Tendyron OnKey; a Linux sample first observed in December 2025 still appeared to be under development (Lumen). · Threat Activity & Malware

in CVE-2026-76461 Gives Remote Attackers Root on Cisco Email Gateways