Patchfirst
Patchfirst

Dropping Elephant APT Group Targets Turkish Defense Industry With New Campaign and Capabilities: LOLBAS, VLC Player, and Encrypted Shellcode

arcticwolf.com · 23 Jul 2025 · Licence: not cleared; local research copy only

Read the original ↗

CVEs this report names

6 CVEs
  1. CVE-2026-0257Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
    Palo Alto Networks · PAN-OSKEVRansomwarePublic exploitCritical · 9.1T1190Exploit Public-Facing ApplicationT1133External Remote Services4 reports
    95.0%Top 0.14%
    93.3priority
  2. CVE-2026-18577N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
    N-able · N-centralKEVPublic exploitHigh · 8.1T1190Exploit Public-Facing ApplicationT1078Valid Accounts7 reports
    14.6%Top 3.3%
    88.0priority
  3. CVE-2026-18556N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability
    N-able · N-centralKEVPublic exploitHigh · 7.4T1190Exploit Public-Facing ApplicationT1078Valid Accounts5 reports
    7.9%Top 5.3%
    82.1priority
  4. CVE-2026-50656Microsoft Defender Elevation of Privilege Vulnerability
    Microsoft · Microsoft Malware Protection EnginePublic exploitHigh · 7.87 reports
    11.2%Top 4.1%
    42.4priority
  5. CVE-2026-28323SolarWinds Web Help Desk SAML Authentication Bypass Vulnerability
    SolarWinds · Web Help DeskCritical · 9.85 reports
    1.0%Top 36%
    31.2priority
  6. CVE-2026-28299SolarWinds Web Help Desk Denial-of-Service Vulnerability
    SolarWinds · Web Help DeskHigh · 8.25 reports
    0.7%Top 46%
    29.0priority

Where it names them

CVE-2026-0257
Pirates: Strange New Tides in Business Email Compromise August 6, 2026 View Post 14 min readThreat ResearchExpanding the Castle: New Campaigns, New Tooling, and the NeedleStealer Connection July 27, 2026 View Post 15 min readThreat ResearchCookie Crumbles: How Exploitation of CVE-2026-0257 Leads to Qilin
Original (opens in a new tab) ↗
CVE-2026-18577
Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak)August 6, 2026SolarWinds Web Help Desk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299August 3, 2026CVE-2026-18556 / CVE-2026-18577: N-able N-central Authentication Bypass Vulnerabilities Require Immediate PatchingVIEW ALLView All
Original (opens in a new tab) ↗
CVE-2026-18556
Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak)August 6, 2026SolarWinds Web Help Desk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299August 3, 2026CVE-2026-18556 / CVE-2026-18577: N-able N-central Authentication Bypass Vulnerabilities Require Immediate PatchingVIEW ALLView All
Original (opens in a new tab) ↗
CVE-2026-50656
12, 2026Microsoft Defender Patch Bypass: High Severity Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak)August 6, 2026SolarWinds Web Help Desk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299August 3, 2026CVE-2026-18556 / CVE-2026-18577: N-able N-central Authentication Bypass
Original (opens in a new tab) ↗
CVE-2026-28323
Bypass: High Severity Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak)August 6, 2026SolarWinds Web Help Desk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299August 3, 2026CVE-2026-18556 / CVE-2026-18577: N-able N-central Authentication Bypass Vulnerabilities Require Immediate PatchingVIEW
Original (opens in a new tab) ↗
CVE-2026-28299
Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak)August 6, 2026SolarWinds Web Help Desk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299August 3, 2026CVE-2026-18556 / CVE-2026-18577: N-able N-central Authentication Bypass Vulnerabilities Require Immediate PatchingVIEW ALLView All
Original (opens in a new tab) ↗

Techniques drawn from this report

None

No passage in this report has been tied to an ATT&CK technique.

↑ ↓ chooseEnter openEsc close