The Q3 Vulnerability Pulse: Discovery ≠ Exploitation

1. Executive summary

Cisco Talos published its Q3 vulnerability pulse alongside new joint research with Recorded Future's Insikt Group on UAT-6275, a suspected Kazakhstan-nexus espionage cluster targeting government and critical infrastructure across the CIS. The newsletter's central claim is that CVE volume crossed 70,000 by end of September 2026, a 105% year-on-year increase, while CISA KEV additions grew only 37%, and that 33% of KEV entries still trace to 2025 or earlier. For EMEA financial services the direct exposure is limited: UAT-6275's observed victims are in nine CIS countries, not Europe. The item that does carry a live exploitation risk for our clients is CVE-2026-104935, an Ivanti Connect Secure flaw rated CVSS 8.6 HIGH, added to CISA KEV on 2026-10-13 with EPSS at 26%, which Talos reports as an unauthenticated remote code execution chain against fully patched VPN appliances. That CVE is the actionable item here; the rest of the newsletter is context.

2. Regulatory framing

No DORA Art. 18, 19, 24, 29 or 30 row is included: nothing in this item establishes a major incident, a testing obligation, a concentration-risk finding, or a contractual gap specific enough to trigger those articles on the facts given. UK NIS 2018 duties are not engaged by this item as written.

3. Technical analysis & attack chain

This is a newsletter item, not a single-incident report. It carries two distinct threads: a statistical argument about CVE and KEV volume, and a summary of joint Talos and Recorded Future research into UAT-6275. The two are not connected in the source, and treating the UAT-6275 activity as the cause of the CVE volume would be wrong.

Thread one: the vulnerability statistics. Talos reports that CVE volume crossed 70,000 by the end of September 2026, a 105% year-on-year increase. CISA KEV additions grew 37% over the same period, following a 30% increase from 2024 to 2025. Of the KEV entries, 33% trace to CVEs from 2025 or earlier, which Talos reads as evidence of a patch gap rather than a zero-day surge. For 2026 CVEs, 29% were added to KEV on the same day as publication, only 2% more than the 2025 figure. Networking gear accounts for 27% of CVEs, a slight uptick. Talos also flags a new KEV column, "forensicTriage," which marks high-risk vulnerabilities requiring mandatory forensic triage and incident response workflows, referencing BOD 26-04 and its implementation guidance. The practical point for defenders is that the KEV list is the prioritisation signal, not the raw CVE count, and that a third of actively exploited vulnerabilities are old enough that they should already be patched.

Thread two: UAT-6275. Talos and Recorded Future's Insikt Group jointly investigated UAT-6275, tracked by Recorded Future as TAG-193. The group targets government and critical infrastructure entities across the CIS, with observed victims and lure themes spanning nine countries: Kazakhstan, Kyrgyzstan, Tajikistan, Turkmenistan, Uzbekistan, Armenia, Azerbaijan, Russia and Belarus. Targeted institutions are responsible for diplomacy, economic development, agriculture and environmental management. Talos observed network flow activity involving a Tajik government entity shortly after treaty discussions with Kazakhstan in March 2026, and a Belarusian government entity ahead of a bilateral meeting in April 2026. Recovered decoy documents reference diplomatic relations, international trade and aviation, including a diplomatic letter addressed to Armenia's Ministry of Foreign Affairs. Energy-themed decoys included a cooperation proposal between Turkmenistan's state oil company, Turkmennebit, and Russia's Orsk Oil Refinery, used in an August 2025 sample.

The confirmed attack chain, as summarised in the newsletter:

1. Initial access is delivered through macro-enabled documents, GitHub-hosted scripts, and a WinRAR vulnerability. Talos reports four distinct infection chains.
2. Payloads are custom reverse shells, described as lightweight.
3. Persistence is established through suspicious scheduled tasks and unauthorised changes to the Windows Startup folder.
4. Command-and-control uses the reverse shells, with payloads hosted on legitimate public services including GitHub.
5. Recovered tooling indicates preparation to expand into Linux hosts and internet-facing appliances.

Talos identified three publicly accessible staging directories and a previously unreported GitHub repository used to host malicious scripts and payloads. The group's operational security lapses gave researchers direct visibility into their infrastructure and malware development. Talos assesses that UAT-6275 and YoroTrooper likely belong to the same broader activity cluster, but tracks them separately because no direct indicator or toolset overlap has been observed. The cluster overlaps with Silent Lynx (Seqrite), Tomiris (Kaspersky), ShadowSilk (Group-IB), Cavalry Werewolf (BI.ZONE) and Hydra Saiga (VMRay). Since Seqrite first reported Silent Lynx in January 2025, Talos has identified at least eight campaigns across the region through May 2026.

Confidence caveats. The UAT-6275 attribution to a Kazakhstan nexus is a Talos and Recorded Future assessment, not a government attribution, and the actor has no MITRE ATT&CK profile in our reference data. Treat the attribution as unconfirmed. The specific IOCs, ClamAV signatures and full technical analysis sit in the linked Virus Bulletin 2026 white paper and the full blog post, neither of which is reproduced here; the newsletter gives no atomic indicators for UAT-6275. The four hashes in the primary item are Talos file-reputation samples from the newsletter's general malware section, not UAT-6275 indicators, and should not be treated as such.

CVE-2026-104935. The newsletter cites SecurityWeek reporting that CVE-2026-104935 affects Ivanti Connect Secure and can be exploited for unauthenticated remote code execution with elevated privileges, in a chain that gave attackers root access to a fully patched VPN. Our verified reference data records CVSS 8.6 HIGH, CWE-290 (Authentication Bypass by Spoofing), CISA KEV addition on 2026-10-13, and EPSS 26%. The source describes the impact as unauthenticated RCE with elevated privileges; the verified CWE classifies the underlying flaw as authentication bypass by spoofing. Both can describe the same chain: a spoofing-based authentication bypass that yields code execution. Use the verified CVSS and severity. No vendor patch version, affected version range, or exploitation command is given in the source material.

4. Mitigation & containment

P1 (within 24 hours)

• Treat CVE-2026-104935 as the priority. It is in CISA KEV with EPSS 26% and CVSS 8.6 HIGH. Identify every Ivanti Connect Secure instance in the estate, including any managed by a third party or MSP. Where the vendor has published a fixed version, apply it; where it has not, isolate the appliance from untrusted networks and restrict management access to a dedicated out-of-band path. The source gives no patch version, so confirm the current fixed release directly with Ivanti.
• Hunt for the UAT-6275 persistence behaviours on any Windows host in a CIS-exposed or government-adjacent business unit: unexpected scheduled tasks and unauthorised changes to the Windows Startup folder. These are the two persistence mechanisms named in the source.
• Review proxy and egress logs for PowerShell activity and payload downloads originating from public services such as GitHub. Talos names this explicitly as the detection priority for the group's delivery method.

P2 (within 72 hours)

• Patch archive utilities across the estate. The WinRAR vulnerability is one of the four confirmed infection chains, and Talos names archive utility patching as a required control. Confirm the installed version and update to the current release.
• Restrict or monitor macro execution in documents received from external senders. Macro-enabled documents are the first named delivery vector.
• If the firm runs Ivanti Connect Secure and cannot confirm it was never exposed, run forensic triage on the appliance itself. The KEV "forensicTriage" column and BOD 26-04 referenced in the source exist precisely because appliance compromise does not always surface in endpoint telemetry.

P3 (within 7 days)

• Check whether your vulnerability management tooling handles six-digit CVE identifiers. Talos raises this twice in the newsletter and it is a concrete, checkable failure mode: a scanner that truncates or rejects six-digit CVEs will silently miss them.
• Confirm your KEV ingestion includes the new "forensicTriage" column and that it routes flagged entries into an incident response workflow rather than the standard patch queue.
• Reconcile the patch backlog against KEV. A third of KEV entries trace to 2025 or earlier, so the highest-value work is closing old, confirmed-exploited gaps, not chasing the newest CVE count.

5. Indicators of compromise

The newsletter provides no atomic indicators for UAT-6275. The four hashes below are Talos file-reputation samples from the newsletter's general malware section and are not attributed to UAT-6275 or to CVE-2026-104935. They are single-sourced to Talos; verify before enforcement.

sha256  9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507
md5  2915b3f8b703eb744fc54c81f4a9c67f
sha256  73ac1bbfaee6c76c34f655ac0477a4cd930f2aa55e658c8e312ff81aac9a741f
md5  63f3351cfdf618bec6045f60203e7978
sha256  58d6fec4ba24c32d38c9a0c7c39df3cb0e91f500b323e841121d703c7b718681
md5  f1fe671bcefd4630e5ed8b87c9283534
sha256  fed979f93bcaf4e73ebd25748093a92095d5109cbd01d55f97bdc50ce509ad2f
md5  207d9d891ac756b2bfad88aba5682c65

Behavioural indicators

6. Detection

The source gives behavioural artefacts but no distinctive strings, mutexes, filenames or registry keys specific to UAT-6275. The four sample filenames in the newsletter (sample.exe, f_00478d.exe, KMSAuto Net.exe) are generic and two are duplicated across different hashes, so they are not reliable detection strings. A YARA rule built on them would produce false positives without detecting the actual threat. No YARA rule is emitted for that reason.

A Sigma rule is warranted for the two named persistence behaviours, which are observable in Windows event logs.

title: UAT-6275 Persistence via Scheduled Task or Startup Folder Modification
id: 8f3c1a92-4d7e-4b21-9c05-6a2e8f1d3b47
status: experimental
description: Detects the two persistence mechanisms attributed to UAT-6275 by Cisco Talos and Recorded Future Insikt Group - creation of unexpected scheduled tasks and unauthorised modification of the Windows Startup folder.
author: Adverse Trace
date: 2026-10-15
references:

  - https://blog.talosintelligence.com/the-q3-vulnerability-pulse-discovery-exploitation/
  - https://blog.talosintelligence.com/break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations/
logsource:
  product: windows
  service: security
detection:
  selection_task:
    EventID: 4698
  selection_startup:
    EventID: 4657
    ObjectName|contains:

      - '\Startup\'
      - '\Start Menu\Programs\Startup\'
  condition: selection_task or selection_startup
falsepositives:

  - Legitimate software installers that register scheduled tasks or place shortcuts in the Startup folder
  - Enterprise management tooling that writes to Startup paths during provisioning
level: medium
tags:

  - attack.persistence
  - attack.t1053.005
  - attack.t1547.001

The rule is deliberately broad because the source names the persistence technique but not the specific task names or file paths used. Tune against your software baseline before enabling at high severity.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV)

7. Sources

• Cisco Talos, "The Q3 Vulnerability Pulse: Discovery ≠ Exploitation," Threat Source newsletter, 2026-10-15. https://blog.talosintelligence.com/the-q3-vulnerability-pulse-discovery-exploitation/
• Cisco Talos, "Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations," 2026. https://blog.talosintelligence.com/break-the-silence-kazakhstan-nexus-uat-6275-targets-cis-government-organizations/
• SecurityWeek, "Ivanti zero-day chain gave attackers root access to fully patched VPN," cited in the Talos newsletter above. No direct URL provided in the source material.
• Hack Read, "Hackers heat supermarket fridges to 50°C in France cyber attack," cited in the Talos newsletter above. No direct URL provided in the source material.
• SecurityWeek, "U.S. arrests two in crackdown on North Korean IT worker laptop farms," cited in the Talos newsletter above. No direct URL provided in the source material.
• CyberScoop, "Canadian cybersecurity executive arrested in U.S. federal extortion case," cited in the Talos newsletter above. No direct URL provided in the source material.
• Dark Reading, "Maximum-severity SSRF flaw in SonicWall SMA devices under attack," cited in the Talos newsletter above. No direct URL provided in the source material.

8. Adverse Trace position

Adverse Trace assesses CVE-2026-104935 as the only item in this advisory that warrants immediate client action: CVSS 8.6 HIGH, CISA KEV since 2026-10-13, EPSS 26%, and an unauthenticated remote code execution chain against a fully patched edge VPN appliance. The UAT-6275 activity is a credible espionage campaign but its observed victims are CIS government and critical infrastructure entities, not EMEA financial services, and the attribution to a Kazakhstan nexus is unconfirmed with no MITRE ATT&CK profile for the actor. We do not assess the CVE volume statistics as a risk in themselves; the KEV backlog figure of 33% is the number that should drive remediation priorities. We will pull the full Virus Bulletin 2026 white paper and the Talos blog post for the UAT-6275 IOCs and ClamAV signatures, since the newsletter does not carry them, and we will issue a follow-up if the Ivanti advisory names affected versions or a fixed release. Clients running Ivanti Connect Secure should confirm patch status with the vendor today rather than waiting for that follow-up.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.