Single point of failure: The security threat no one’s talking about

After achieving initial access by targeting vulnerable internet-exposed web and application servers, UAT-5918 utilized tools previously associated with Volt Typhoon and Flax Typhoon to facilitate lateral movement, credential and data theft, and further compromise.

Attackers, tracked under the UAC-0200 threat cluster, leveraged the Signal messaging app to deliver messages purportedly containing minutes of the meeting reports as archive files.

Israel-based systems were most targeted by the attempted exploitation of ServiceNow bugs but threat actors also sought to compromise instances in Germany, Japan, and Lithuania