April 24, 2026 • 5 min read
ZYMP IT Security — April 24, 2026
Global Agencies Warn of China-Linked Covert Device Networks
CYBER ESPIONAGE
Cybersecurity agencies from the United States, United Kingdom, and allied nations have issued a joint advisory warning that Chinese government-linked hackers are building and operating large-scale covert networks from hijacked SOHO routers and IoT devices. The NCSC-UK advisory, titled “Defending Against China-Nexus Covert Networks of Compromised Devices,” states that most China-nexus threat actors are already using these networks, which are continuously evolving and sometimes shared across multiple actor groups simultaneously.
The networks serve as infrastructure across every phase of the Cyber Kill Chain — from reconnaissance and malware delivery to command-and-control and data exfiltration. Officials warn that the model is dynamic, low-cost, and deniable, making traditional static IP block lists ineffective. CISA Acting Director Nick Andersen emphasised the advisory aims to inform organisations how these actors strategically use evolving covert networks at scale for malicious activity.
Microsoft Defender BlueHammer Zero-Day Exploited in the Wild
ZERO-DAY
A privilege escalation vulnerability in Microsoft Defender, tracked as CVE-2026-33825 (CVSS 7.8), has been actively exploited as a zero-day using publicly available proof-of-concept code. The flaw, dubbed BlueHammer by its discoverer, is a time-of-check to time-of-use (TOCTOU) race condition in Defender’s signature update mechanism that allows low-privilege attackers to gain full System permissions.
Patched on April 14, the vulnerability was publicly disclosed on April 2 by a researcher using the alias Chaotic Eclipse, who published exploit code to GitHub. Huntress reports the first attacks leveraging the PoC were observed on April 10, with additional activity on April 16 involving three techniques — BlueHammer, RedSun, and UnDefend — including suspicious FortiGate SSL VPN access tied to Russian infrastructure.
BlueHammer works by exploiting operation locks to suspend Defender, then tricking it into copying the Security Account Manager database during a signature update. The attacker then decrypts NT hashes, changes user passwords, and generates admin sessions to achieve System-level access.
Critical Path Traversal Flaw Patched in CrowdStrike LogScale
VULNERABILITY
CrowdStrike has published an advisory for CVE-2026-40050, a critical unauthenticated path traversal vulnerability affecting its LogScale product. The flaw enables remote attackers to read arbitrary files from the server filesystem without authentication. CrowdStrike noted that Next-Gen SIEM customers are unaffected and the vulnerability has already been mitigated for LogScale SaaS customers.
Self-hosted LogScale customers have been advised to update immediately. The vulnerability was discovered internally, and CrowdStrike reports no evidence of exploitation in the wild. Separately, Tenable disclosed a high-severity vulnerability in its Nessus scanner on Windows (CVE-2026-33694), which could allow attackers to delete arbitrary files with System privileges or achieve arbitrary code execution through junction exploitation.
CISA Updates Emergency Directive for Compromised Cisco Firewalls
GOVERNMENT DIRECTIVE
CISA has issued Version 1 of Emergency Directive 25-03, superseding the original September 2025 directive addressing the compromise of Cisco Firepower and Secure Firewall products running Adaptive Security Appliance (ASA) software. The updated directive expands required actions for federal agencies following new intelligence that threat actors retain persistence and continue unauthorised access to affected devices.
The revised directive includes additional required actions and a new reporting requirement, applying to any agency running affected products. Federal agencies must download and apply the latest Cisco-provided updates by 11:59 PM EST on April 24. The directive underscores the persistent nature of sophisticated firewall compromises and the challenges of fully eradicating threat actor access from critical network infrastructure.
1,300+ SharePoint Servers Still Exposed After Zero-Day Exploitation
CRITICAL PATCHING
More than 1,300 unpatched on-premises Microsoft SharePoint servers remain exposed to active exploitation through CVE-2026-32201, a spoofing vulnerability affecting SharePoint 2016, 2019, and Subscription Edition. The flaw enables unauthenticated attackers to exploit improper input validation for network spoofing attacks without user interaction. Despite being addressed in April’s Patch Tuesday, fewer than 200 systems have been secured since the update’s release.
The vulnerability has been added to CISA’s Known Exploited Vulnerabilities catalogue, with federal agencies ordered to patch within strict deadlines. Microsoft confirmed exploitation could expose sensitive data and allow unauthorised modification. No attribution has been confirmed, and exploitation remains ongoing, highlighting persistent enterprise patching delays and the significant risks of exposed internet-facing infrastructure.
ZY Media Productions
IT • Music • Technology