A Busy Day for the KEV Catalog

On August 26, the US Cybersecurity and Infrastructure Security Agency (CISA) dropped six new entries into its Known Exploited Vulnerabilities (KEV) catalog in a single day. That’s a hefty batch, even by recent standards. The message is blunt: these aren’t theoretical risks. There’s real-world evidence attackers are using them right now.

The CISA KEV catalog is essentially a watchlist of flaws that have been confirmed as exploited in the wild. Federal agencies are required to patch them by binding operational directives, and CISA strongly urges critical infrastructure operators to do the same. When a vulnerability lands here, the clock starts ticking.

The Citrix NetScaler Memory Overflow at the Top of the List

Two of the six flaws carry a high-severity rating. The first, tracked as CVE-2026-8452, is a memory overflow issue in NetScaler ADC and NetScaler Gateway from Citrix. It was reported back in late June and carries a CVSS score of 8.8.

What can an attacker do with it? If the appliance is set up as a Gateway (think SSL VPN, ICA Proxy, CVPN, RDP Proxy) or as an AAA virtual server, exploitation can trigger unpredictable behavior or a full denial of service (DoS). That’s the kind of outage that gets IT teams called in at 2 a.m.

Citrix has already shipped fixes. The patched versions are:

• NetScaler ADC and NetScaler Gateway 14.1-72.61 and later
• NetScaler ADC and NetScaler Gateway 13.1-63.18 and later releases of 13.1
• NetScaler ADC 14.1-FIPS 14.1-72.61 FIPS and later 14.1-FIPS releases
• NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1.37.272 and later releases

Why This One Matters

NetScaler devices sit at the network edge. They’re the front door for remote workers and VPN traffic. A memory overflow there isn’t just a server problem — it’s a gateway to the whole internal network. If you’re running an unpatched version, the window for fixing this is narrow.

The Seven-Year-Old Microsoft SQL Server RCE That Won’t Die

The second high-severity entry is CVE-2019-1068, a remote code execution (RCE) vulnerability in Microsoft SQL Server. It also scores 8.8 on the CVSS scale. Here’s the uncomfortable part: a patch has been available since 2019. Seven years. And attackers are still finding unpatched systems to hit.

The exploit works by sending a specially crafted query to an affected SQL server. If it lands, the attacker can execute code in the context of the SQL Server Database Engine service account. That’s not a sandbox — that’s a high-privilege position inside your database tier.

For the two high-severity flaws, CISA has set a deadline of August 29. That’s a short window, and it reflects how urgent the agency considers these particular exploits.

The Rest of the Batch: Older Flaws, Real Consequences

The other four entries are all several years old, but age hasn’t made them harmless. CISA has given organizations until September 9 to patch these:

• CVE-2015-3246: A race condition in Red Hat Libuser, rated 5.1. It can lead to privilege escalation or other unauthorized actions.
• CVE-2015-5287: A privilege escalation flaw in Red Hat’s automatic bug reporting tool (ABRT), rated 7.8. Attackers can use it to gain elevated access on affected systems.
• CVE-2021-23758: A deserialization of untrusted data issue in Ajax.NET Professional, rated 8.1. This one can lead to remote code execution in the right conditions.
• CVE-2022-0995: An out-of-bounds write vulnerability in the Linux kernel, rated 7.8. Exploitation can cause system crashes or, worse, arbitrary code execution.

Why Old Vulnerabilities Still Get Exploited

It’s tempting to assume a 2015 or 2019 flaw is ancient history. The reality is different. Attackers scan the internet constantly for signatures of unpatched systems. Legacy software lingers in corners of enterprise networks — that old SQL Server instance nobody remembers, the Linux box running a kernel from three years ago.

The KEV catalog addition doesn’t mean these are new attacks. It means CISA has confirmed they’re ongoing. The agency’s decision to include them signals that real-world exploitation is happening at a scale worth flagging.

What You Should Do Right Now

If you’re running any of these products, the first step is to check your versions against the patched releases. For Citrix NetScaler, verify the exact build. For SQL Server, confirm you’re on a supported version with the latest cumulative update. For Linux and Red Hat components, check with your distribution’s security advisories.

Don’t wait for the deadlines. August 29 for the Citrix and Microsoft flaws, September 9 for the others — these aren’t suggestions. If your organization has ever struggled with patch management best practices, this is the moment to tighten the process.

Also worth reviewing: your vulnerability disclosure and response workflow. The gap between a vendor releasing a patch and your team applying it is exactly the window attackers exploit. Seven years is a long time for a known RCE to stay alive. Don’t let your environment be the reason it keeps going.

FBI Issues Urgent Warning About QTFY Hacker Group

The FBI has issued a stark warning about a sophisticated Chinese hacking group known as QTFY that is actively targeting US government networks and critical infrastructure. The group has been operating since 2018, focusing on the defense industrial base (DIB), communications, government agencies, and higher education institutions.

In 2024 alone, QTFY managed to exfiltrate data from more than 300 organizations worldwide. The victims included US defense contractors, financial institutions, and universities. The group exploited a vulnerability in Check Point Quantum Gateway devices to gain access.

Other high-profile targets have included the US Department of Justice, the Federal Reserve, and NASA. The FBI also noted attempts to compromise hospitals and election systems.

Custom Platforms Power QTFY Attacks

What sets QTFY apart is its custom-built ecosystem of malicious tools. The group developed a platform called QScan, designed to rapidly identify vulnerabilities in victim networks and exploit vulnerable IoT devices. The FBI revealed that QTFY used QScan to conduct over two million scanning and penetration testing tasks in a single day in 2024.

Another key tool is QTRouter, a network traffic obfuscation system running on routers with custom OpenWrt software. The group also uses botnet products to control compromised IoT devices, turning them into proxy nodes for QTRouter.

“These products work in conjunction with each other,” the FBI noted in its advisory.

How QTFY Identifies Victims and Launches Attacks

The advisory, published in coordination with the NSA and Cyber National Mission Force on August 26, detailed QTFY’s tactics. The group exploits zero-day and N-day vulnerabilities to gain initial access. QScan conducts reconnaissance including webpage scraping, TLS certificate collection, subdomain enumeration, and penetration testing.

QTFY maintains a large database of potential targets, allowing it to quickly match new vulnerabilities against known systems. The group also participates in freelance PRC hacker networks and malicious cyber contracting marketplaces to stay current on new exploits and attack techniques, including integrating AI into their processes.

Once inside a network, QTFY maintains persistence through remote access trojans (RATs), web shells, and stolen legitimate credentials. The QTRouter obfuscation network lets the group access victim networks from nearby compromised IoT devices, blending in with legitimate users.

The FBI revealed that unique user agent strings originating from IP addresses in China indicated QTRouter was used by both QTFY personnel and PRC government personnel.

Expert Analysis on QTFY’s Threat

Nick Tausek, lead security automation architect at Swimlane, emphasized the sensitivity of the targets. “Military and defense-linked networks are about as sensitive as targets get. They can expose operational plans, contractor relationships, technical capabilities and access paths into systems tied directly to national security,” he said.

Gabrielle Hempel, security operations strategist at Exabeam, noted the scale and sophistication of QTFY’s model. “They have built an ecosystem designed to make malicious activity look geographically and operationally ordinary,” she said. She added that the group’s vulnerability scanning tool gives it a head start when new vulnerabilities emerge: “It does not necessarily need to search for targets from scratch; it may already have a catalogue of exposed systems ready to match against the latest exploit.”

How to Defend Against QTFY Activity

The authoring agencies recommended that government and critical infrastructure organizations take urgent action. Key measures include:

• Apply the latest software and firmware updates to all devices
• Regularly audit web pages and applications for published secrets like API keys and tokens
• Proactively threat hunt for indicators of compromise included in the advisory
• Isolate critical systems from edge devices
• Regularly test your security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework

US Authorities Disrupt QTFY Infrastructure

In a separate announcement on the same day, the US Justice Department and FBI revealed they had successfully disrupted the QScan and QTRouter platforms used by QTFY. Court documents show QTFY offers hacking services including these tools to paying customers.

The law enforcement action is the latest in a series of court-authorized technical operations against indiscriminate hacking activities by the PRC, the Justice Department said.

For more on related threats, see our coverage of Chinese state-sponsored hacking campaigns and critical infrastructure security best practices.

German companies point the finger at foreign spies

The hulking steelworks of Thyssenkrupp on the Rhine in Duisburg might seem an unlikely digital battleground. But according to a new survey, foreign intelligence services — especially those from China and Russia — are increasingly behind cyberattacks on German companies.

Nearly four in 10 German businesses hit by data theft, industrial espionage or sabotage in the past year said they could trace at least one incident back to a foreign intelligence service. That’s a sharp jump from 28% last year and just 7% in 2023, according to the German digital industry association Bitkom.

The findings come from a survey of 1,003 German companies with at least 10 employees. They paint a picture of a corporate sector increasingly caught in the crosshairs of state-sponsored hacking.

China and Russia lead the pack

China was the most frequently cited foreign source of attacks. More than half of the companies that experienced an incident said they had traced at least one attack to Beijing. Russia ranked second, and Iran emerged as a significant player too — roughly one in 10 affected companies linked an incident to Tehran.

Sinan Selen, president of Germany’s domestic intelligence agency, didn’t mince words at the study’s presentation. “Foreign intelligence services have intensified their hybrid activities and are increasingly responsible for attacks on the German economy,” he said. He singled out Germany’s security and defense industry as a particularly attractive target.

What’s striking is the sheer scale of the problem. More than two-thirds of surveyed companies said they had experienced a successful cyberattack of some sort in the last 12 months. That’s not a niche concern — it’s the new normal for German business.

The blurred line between criminals and spies

Organized crime remains the biggest source of attacks identified by companies. But Bitkom’s president, Ralf Wintergerst, argues the distinction between criminal gangs and state intelligence agencies is dissolving.

“The lines between organized crime and intelligence services are blurred in many countries,” Wintergerst said. “Intelligence services utilize criminal structures, and conversely, criminals are given free rein as long as they choose their targets in accordance with political directives.”

That blurring makes attribution harder and defense trickier. A ransomware gang might look like a purely profit-driven outfit, but its targets can align suspiciously well with a foreign power’s strategic interests.

The staggering cost of cyberattacks on German firms

The economic toll is hard to overstate. Bitkom estimates that cyberattacks cost German businesses between $186 billion and $240 billion over the past year. That includes business interruptions, investigations, recovery efforts, legal disputes, extortion payments, and lost revenue and competitive advantages.

Ransomware remains the most common form of attack, with one in four companies reporting that attackers encrypted their data and demanded payment. But the threat landscape is broader: phishing, password attacks, distributed denial-of-service attacks, malware infections, communications interception and corporate data theft all made the list.

The damage often ripples outward. A successful attack on one company can cause production outages at business partners or reputational harm for customers, the researchers noted. It’s not just the direct victim that bleeds.

Real-world incidents hit German institutions

This isn’t abstract. Several prominent German organizations have disclosed cyber incidents this year.

• Lidl — the discount supermarket giant revealed in July a data breach after attackers gained access to customer information held by one of its IT service providers.
• Unimed — in April, hackers targeted this external billing provider used by medical centers across Germany. Several university hospitals later said patient information had been stolen.
• Dresden State Art Collections — in January, one of Europe’s oldest museum networks was hit by a targeted cyberattack that disrupted large parts of its digital infrastructure.

These are not obscure targets. They’re household names and critical institutions. And they show that no sector is off-limits.

What German businesses can do about state-sponsored hacking

The Bitkom survey is a wake-up call, but it’s not all doom and gloom. There are practical steps companies can take to harden their defenses against state-sponsored hacking and industrial espionage Germany faces.

First, treat threat intelligence seriously. Knowing who’s likely to target you — and why — helps prioritize defenses. Second, invest in basics: multi-factor authentication, regular patching, and employee training on phishing. Third, have an incident response plan ready before the breach, not after.

For smaller firms, the cost of robust security can feel prohibitive. But the price of a single ransomware attack or data theft often dwarfs the investment in prevention. The survey’s numbers make that math painfully clear.

The threat from foreign intelligence services isn’t going away. It’s growing, becoming more sophisticated, and increasingly indistinguishable from organized crime. German companies — and businesses everywhere — need to adapt or risk becoming the next statistic.