Table of Contents

Cyberthreat Analysis

• VPN Exploitation When Patched Doesn't Mean Protected
• MiniPlasma: Windows Privilege Escalation Zero-Day Affects Fully Patched Systems
• Nimbus RAT: How Threat Actors Are Abusing Microsoft Teams and Google Drive to Deploy a Java RAT

Industry News

#NMFTACyber On Demand

VPN Exploitation When Patched Doesn't Mean Protected

Between February and March 2026, ReliaQuest identified activity that we assess with medium confidence to be the first in-the-wild exploitation of CVE-2024-12802, targeting SonicWall devices across multiple environments. CVE-2024-12802 is an authentication bypass vulnerability in SonicWall appliances that reduces VPN security to single-factor authentication. Disclosed in early 2025, it’s the latest in a series of VPN vulnerabilities exploited to gain initial access to corporate networks.

On Gen6 devices, the firmware patch alone doesn’t remediate the vulnerability. Six additional manual reconfiguration steps are required. SonicWall documented those steps in its advisory, but standard patch-management workflows aren't designed to verify them: The firmware updates, the version check passes, and the device appears remediated while remaining fully exploitable. For any organization that relies on firmware version alone to confirm remediation, this is a blind spot, and it’s not unique to SonicWall.

In the intrusions we observed, threat actors brute-forced VPN accounts and bypassed MFA to gain access to internal networks. The tools observed were consistent with actors operating in the ransomware ecosystem. In some cases, as few as 13 brute-force attempts separated an attacker from a valid credential. In one environment, they reached a file server within 30 minutes and deployed tools consistent with pre-ransomware staging. Intrusions left the same signal in the logs: A session type associated with automated VPN authentication that most organizations are unlikely to be monitoring today.

MiniPlasma: Windows Privilege Escalation Zero-Day Affects Fully Patched Systems

MiniPlasma is a local privilege escalation exploit targeting CVE-2020-17103, a vulnerability in the Windows Cloud Filter driver (cldflt.sys). The flaw was originally reported to Microsoft by Google Project Zero researcher James Forshaw in September 2020, assigned a CVE, and reportedly patched in December of that year.

According to Chaotic Eclipse, either the patch was never properly applied or was silently rolled back at some point. The researcher states that the original Google Project Zero proof-of-concept code worked without any modifications. MiniPlasma is a weaponized version of that same PoC, modified to spawn a SYSTEM shell rather than simply demonstrate the flaw.

The vulnerability targets the HsmOsBlockPlaceholderAccess routine within the Cloud Filter driver, the component Windows uses to support cloud-backed file handling in OneDrive and similar services. The flaw allows registry key manipulation via the undocumented CfAbortHydration API, enabling an attacker to create a key in the DEFAULT user hive without access checks. That path leads to privilege escalation and SYSTEM-level code execution.

This is not the first time this driver component has been exploited. In December 2025, Microsoft patched a separate privilege escalation flaw in the same component, CVE-2025-62221, which it confirmed was being actively exploited in the wild at the time of patching.

The exploit is a race condition, so success rate may vary. In practice, researchers at ThreatLocker confirmed the exploit works on fully patched Windows 11. Will Dormann, Principal Vulnerability Analyst at Tharros, has noted it does not appear to function on the Windows 11 Insider Preview Canary build.

Nimbus RAT: How Threat Actors Are Abusing Microsoft Teams and Google Drive to Deploy a Java RAT

In early April 2026, eSentire's Threat Response Unit (TRU) identified an intrusion targeting a customer in the legal industry. Threat actors used Microsoft Teams voice phishing (vishing) to deceive the victim into granting remote access via Quick Assist, then deployed a Java-based remote access trojan (RAT).

TRU tracks this malware as Nimbus RAT, which Rapid7 previously documented in connection with BlackSuit affiliate activity following Black Basta's internal conflict in early 2025. Nimbus RAT is a self-contained implant that uses Google Drive and Google Sheets for command-and-control (C2), helping its network traffic appear benign.

The intrusion followed a well-established vishing kill chain: the targeted user's mailbox was flooded with hundreds of subscription confirmation emails; an actor-controlled Microsoft Teams account posing as IT helpdesk reached out to the user offering assistance, and the user was walked through launching Quick Assist and downloading a payload from a compromised Microsoft 365 tenant. From initial Teams contact to RAT execution, the attack took less than 20 minutes.

TRU also analyzed over a year's worth of external Teams messaging telemetry across our customer base and identified 1,540 similar events targeting 172 distinct customer environments, with a sharp surge in activity between December 2025 and March 2026.

The data reveals consistent infrastructure patterns, including the heavy use of throwaway Microsoft 365 tenants, freshly registered .top domains, and hosting-provider source IPs, that help defenders distinguish malicious Teams external messages from legitimate vendor traffic.

Refer a Colleague

Would you like others at your company to be added to the NMFTA Headline Newsletter email distribution list? Send them this link or fill out the form for them on their behalf below!