October 26, 2026 Emerging Threats Weekly

This week’s briefing covers:

00:00 – Intro

00:47 [SUPPLY CHAIN] Compromised LiteLLM Release Steals Secrets and Installs Remote Access
LiteLLM version 1.107.0 was identified as compromised on October 21, affecting published Python wheels and the corresponding official Docker image. The release contained an infostealer and a remote-access component. At publication, PyPI had quarantined the version, but the compromised Docker image remained available, including through several moving tags.

03:28 [THREAT ACTOR] APT28 Uses HOOKEDGE and a New Loader Against NATO Defense Targets
Symantec’s Threat Hunter Team attributed APT28 to intrusions at a naval shipbuilder, a military aircraft-engine manufacturer and a law-enforcement organization in two unnamed NATO members.

06:57 [VULNERABILITY] Armory Castle Exploits BeyondTrust Remote Support Zero-Day
On October 15, BeyondTrust disclosed vulnerability CVE-2026-102764 in its Remote Support appliance with CISA adding it to its Known Exploited Vulnerabilities catalogue the following day. The critical flaw, with a CVSS score of 9.3, affects versions up to and including 26.2.3 and results from insufficient origin validation in an internal messaging component.

10:04 [SOCIAL ENGINEERING] Calendar Invitations Scale Microsoft 365 Credential Theft
Security researchers last week reported several large phishing campaigns using calendar invitations to place credential-harvesting content inside normal business workflows. Activity accelerated from September 25, increasing from more than 118,000 messages during September to more than 740,000 in the first two weeks of October.

12:54 [RANSOMARE] SafePay Advisory Details More Than 600 Victims Across Critical Sectors
CISA, the FBI, the U.S. Secret Service, and German and UK partners released joint advisory AA26-293A on October 20 describing SafePay ransomware activity observed as recently as August 2026. The agencies assess SafePay as one of the most active ransomware groups.

Dive deeper:

Kroll’s Monthly Threat Intelligence Spotlight Report: https://www.kroll.com/en/reports/cyber/threat-intelligence-reports/cti-spotlight-trends-report

Kroll’s Cyber Threat Intelligence: https://www.kroll.com/en/services/cyber/threat-intelligence-services

Kroll’s 2025 Cyber Threat Landscape Report: Cybercrime in the Crypto Era: https://www.kroll.com/Reports/Cyber/Threat-Intelligence-Reports/Threat-Landscape-Report-Lens-on-Crypto

Playlist of Kroll's Weekly Cyber Threat Intelligence Briefings: https://www.youtube.com/playlist

Kroll Cyber Blog: https://www.kroll.com/en/insights/cyber

Kroll Threat Intelligence Reports: https://www.kroll.com/en/reports/cyber/threat-intelligence-reports

Kroll Cyber and Data Resilience: https://www.kroll.com/en/services/cyber

#krollcyber #threatintelligence #cyberthreats