Cyber Digest

Executive Summary

Sunday's digest is led by a maximum-severity SAP Commerce Cloud flaw under active exploitation attempts, international arrests closing a multi-year German banking heist, and a Vietnam-linked criminal enterprise spending ~US$7 million on expired domains to build an illegal streaming, gambling and malware operation. First, CVE-2026-58231 (CVSS 10.0) — an unauthenticated arbitrary-code-execution vulnerability in SAP Commerce Cloud that lets an attacker abuse a default authentication client to submit input lacking validation — has drawn exploitation attempts in the wild within days of SAP's patch. Vendor analysis from Onapsis and honeypot telemetry from Defused Cyber indicate attempts began as little as three days after the fix shipped; there is no public PoC, and prior SAP flaws (CVE-2025-31324) have been weaponised by China-nexus espionage clusters and cybercrime groups alike. Second, German (BKA) and Brazilian federal police announced multiple arrests this week over a November 2023 hack that drained an estimated €30 million (US$34.7 million) from German online-banking accounts — exploiting a payment-provider vulnerability and cloned payment cards, then laundering proceeds through Brazil and four European countries. A Rio de Janeiro city-council candidate was identified as having used illicit funds in his 2024 campaign. Third, DNS intelligence firm Infoblox detailed an operation it calls Sable Squirrel, based in Vietnam, that has spent nearly US$7 million acquiring expired ("dropcatch") domains so their inherited reputation, traffic and backlinks could be repurposed for illegal sports streaming, online gambling promotion and, in parallel, as malware command-and-control for 31,000+ samples including Quasar RAT, AsyncRAT and Remcos RAT.

Two structural threads tighten further this Sunday. The patch-to-exploitation conveyor remains the defining operator risk of the week. CVE-2026-58231's move from fix to attempted exploitation within three days joins this digest's and last week's slate of bugs that travelled from advisory to active targeting almost immediately — the macOS screen-sharing zero-day reaching root-and-crypto-miner weaponisation, the SharePoint authentication bypass, Metabase SQLi in CISA's KEV, and the VMware/LibWeb entries. The consistent pattern is attackers sweeping for internet-facing, immediately-reachable, under-patched commerce and remote-access surfaces rather than pursuing novel TTPs, which sharpens the relevance of CISA's KEV and the BOD 26-04 two-week federal patch directive for all Five Eyes defenders. Meanwhile, criminal and state-sponsored supply-chain and infrastructure abuse continues to expand. Sable Squirrel's weaponisation of expired-domain reputation, compromised Google Play accounts and streaming fronts for malware C2, alongside the earlier LiteLLM/Trivy credential supply-chain exposure, shows adversaries commoditising trust signals and trusted distribution channels. The German banking-raid closures — securing arrests across Brazil and several European states with asset seizures — represent a notable law-enforcement win against a cross-border card-cloning fraud network, and follow the week's broader regulatory momentum (the US private-sector offensive-operations memo, Germany's spy-law overhaul, CISA's Gunra StopRansomware advisory). Expect continued urgency on internet-facing commerce and remote-access patching, sustained infrastructure-abuse campaigns spanning streaming, gambling and malware, and deepening police-led closures against large financial-fraud pipelines in the week ahead.