CVE-2026-104286(fortinet / fortimail)

‼️ WARNING: Attackers are exploiting a critical FortiMail flaw that allows unauthenticated arbitrary file writes. CISA added "CVE-2026-104286" to KEV. Fortinet published IOCs and workarounds, with fixes still pending for some versions. Learn more: https://thehackernews.com/2026/10/critical-fortimail-zero-day-flaw.html

🚨 CISA KEV — FORTINET FORTIMAIL CVE-2026-104286 (PATH TRAVERSAL → UNAUTH FILE WRITE / RCE) CISA added CVE-2026-104286 to its Known Exploited Vulnerabilities (KEV) Catalog on October 1, 2026, based on evidence of active exploitation. • Product: Fortinet FortiMail • Issue: Path traversal + NULL-byte neutralization flaw that may let an unauthenticated attacker write arbitrary files via crafted HTTP/HTTPS requests • Severity: Critical (Fortinet CVSS 9.8); Fortinet reports exploitation in the wild • Federal due date: October 4, 2026 (BOD 26-04); forensic triage required • Affected: FortiMail 8.0.0–8.0.1 · 7.6.0–7.6.6 · 7.4.0–7.4.8 · 7.2.0–7.2.9 • Fix path: upgrade to upcoming 8.0.2 / 7.6.7 / 7.4.9+ (or move 7.2 branch to 7.4+) • Interim workaround: disable IBE (`config system encryption ibe` → `set status disable`) and/or restrict management-interface access from the internet ⚠️ Analyst Note: This is first DDW coverage of Fortinet FG-IR-26-175 and the same-day CISA KEV addition (catalogVersion 2026.10.01; count 1731; dateReleased 2026-10-01T19:54:04Z). Prefer Fortinet PSIRT + CISA KEV over secondary media. Fortinet published IoCs (files/IPs/log patterns) in the advisory — operators should hunt before/while patching. Fortinet advisory (FG-IR-26-175): https://fortiguard.fortinet.com/psirt/FG-IR-26-175 CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog #DDW #DarkWeb #CISA #KEV #Fortinet #FortiMail #CVE2026104286 #ThreatIntelligence #CyberSecurity

🚨 FortiMail under active exploitation Unauth Path Traversal - CVE-2026-104286 IoCs included Added to our KEV catalog https://t.co/d79U4UnaMM

Fortinet confirms CVE-2026-104286 is under active exploitation on FortiMail, CVSS 9.8 and already on CISA's KEV list. A path traversal in its HTTP and HTTPS handling lets an unauthenticated attacker write arbitrary files on the underlying system, no credentials needed. VulnTracker recommends upgrading immediately, Fortinet has a fixed build for every affected branch. Details: http://vulntracker.io/cves/CVE-2026-104286 #Fortinet #FortiMail #CVE #InfoSec

FortiMail just got a stranger writing files on the box with no login. Fortinet rates it Critical and already sees exploitation. CISA put CVE-2026-104286 on KEV today. https://hol.org/blog/cve-2026-104286-fortimail-path-traversal-kev https://t.co/AEJSajPWWs

🚨 New FortiMail details for CVE-2026-104286. Fortinet published IOCs linked to the attacks, including modified /data/etc/httpd.conf and /data/migadmin.tar.gz. CVSS 9.8 | CISA KEV ExploitGrid: 95.0/100 Critical 🔎 https://exploitgrid.net/vulnerabilities/CVE-2026-104286

🚨 CVE-2026-104286: FortiMail zero-day is being actively exploited. The unauthenticated path traversal vulnerability allows arbitrary file writes through crafted HTTP/HTTPS requests. CVSS 9.8 | CISA KEV ExploitGrid: 95.0/100 Critical 🔎 https://exploitgrid.net/vulnerabilities/CVE-2026-104286

米国サイバーセキュリティ・社会基盤安全保障庁(CISA)が既知の悪用された脆弱性カタログにFortinet FortiMailのパストラバーサルCVE-2026-104286を追加。ゼロデイ。対処期限は3日後の10/4。ランサムウェアによる悪用は不知。 https://www.cisa.gov/news-events/alerts/2026/10/01/cisa-adds-one-known-exploited-vulnerability-catalog IBE機能が有効な場合に管理IFへの細工されたHTTP​(S)リクエストにより任意ファイル書き込みが可能。 差分：https://kev.kokumoto.com/#/cveId:CVE-2026-104286

🔴 Fortinet FortiMail'de kritik güvenlik açığı: CVE-2026-104286 - CVSS: 9.8 Critical Kimlik doğrulaması gerektirmeyen saldırgan, özel hazırlanmış HTTP/HTTPS istekleriyle Path Traversal açığını kullanarak underlying sistem üzerinde keyfi dosya yazabiliyor. https://fortiguard.fortinet.com/psirt/FG-IR-26-175

Fortinet、ゼロデイ攻撃で悪用されているFortiMailの重大な脆弱性について警告：CVE-2026-104286 | Codebook https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/47886/ "認証されていない攻撃者は細工されたHTTPまたはHTTPSリクエストを通じてこの脆弱性を悪用し、基盤となるシステム上の任意ファイルへの書き込みを行うことが可能"

CVE-2026-104286 is now in CISA KEV following reported exploitation of FortiMail. The path traversal flaw allows unauthenticated attackers to write arbitrary files through crafted HTTP/HTTPS requests. CVSS 9.8 | KEV ExploitGrid: 39.2/100 🔎 https://exploitgrid.net/vulnerabilities/CVE-2026-104286

🔐 Daily Security & Standards Brief (Oct 01) CVE-2026-104286--Fortinet FortiMail: validate paths and patch Fortinet FortiMail. Full digest 👇 via PCMedicalist #CyberSecurity #InfoSec https://t.co/Lm2C4pDKNT

CVE-2026-104286 (CVSS 9.8), a CISA KEV-listed zero-day path traversal in FortiMail, is actively exploited. Hunt for /data/etc/ld.so.preload, /data/lib/liblog.so, and archive account archive234; IOCs and log signatures in the advisory. #DFIR_Radar https://t.co/8ep650glLh

🔥 CyberForge CVE of the Day #067 🚨 CVE-2026-104286 — Fortinet FortiMail: unauthenticated file writes, known exploitation and a patch-status trap Fortinet reports exploitation in the wild and CISA has added this flaw to KEV. An unauthenticated HTTP/HTTPS request can cause arbitrary file writes; Fortinet also classifies the impact as code/command execution. The urgent complication: PSIRT still marks corrected releases as upcoming, while the CVE record contains conflicting version and solution fields. Reduce exposure now and investigate earlier activity; do not mistake a planned upgrade for an applied fix. 🗓️ Evidence checked: 2 October 2026, 08:11 UTC / 09:11 BST. Source conflicts are retained below. 🎯 The quick hit: What is happening? Fortinet's FG-IR-26-175 describes unauthenticated arbitrary file write and reports exploitation. KEV corroborates the threat; neither source proves a particular appliance was compromised. Who should check? FortiMail 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8 and 7.2.0–7.2.9, following current PSIRT. Identify web-management exposure and Identity-Based Encryption (IBE) state. Keep 7.0 in vendor review because structured CVE data lists that branch but PSIRT does not resolve it. Start with: disable IBE, or remove internet management-interface access / restrict it to a trusted private network, as Fortinet directs. Coordinate service impact and verify the control across relevant nodes. Follow this trail: admin/configuration and IBE events → unexpected archive-account changes → file indicators and egress. Join appliance identity, time and change history. Preserve remote records where available. Escalate when: unexplained matching files, unapproved archive destinations or correlated suspicious activity appear. A decoding error or IP hit alone needs context; evidence gaps during suspected compromise need a response decision. Be careful with: conflicting fix fields. Some releases named in the CVE solution text remain affected in PSIRT. Confirm the actual supported correction; mitigation does not establish that earlier compromise is absent. 🔑 Key details: ⭐ Severity: Critical — Fortinet. 📊 CVSS: v3.1 9.8, Fortinet CNA; reproduced by NVD, not an independent NIST assessment. 🧮 Base vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`. 🧠 Weaknesses: CWE-22, path traversal; CWE-158, NULL-byte/NULL-character handling, both named by PSIRT and KEV. The CNA weakness field lists CWE-22 alone. 🎯 Product / component: FortiMail; PSIRT identifies the GUI component. 🌐 Access: network, unauthenticated HTTP/HTTPS; low complexity, no user interaction in the published vector. ⚔️ Documented capability: arbitrary file write; PSIRT impact category also includes unauthorised code/commands. 👤 Execution identity: no universal root/service identity established by the public vulnerability description. 🛡️ Fix status: PSIRT lists upcoming 8.0.2+, 7.6.7+ and 7.4.9+; 7.2 is directed to branch 7.4 or above. Availability and the precise supported upgrade route require vendor confirmation. 🧯 Immediate workaround: disable IBE, or restrict/remove internet management-interface access as directed by Fortinet. 🚨 Exploitation: reported by Fortinet; CISA KEV added 1 October 2026. 📋 KEV: catalogue 2026.10.01; due-date field 4 October 2026; `forensicTriage: Yes`; ransomware use Unknown. 📉 FIRST EPSS: request succeeded but returned no record. Probability and percentile are unavailable, not zero. 🧪 Public PoC: search surfaced repository claims; no working public reproduction was validated. No exploit was run. 🏷️ Credit: Gwendal Guégniaud, Fortinet Product Security; internal discovery. The CNA/CSAF vector also carries `E:P/RL:O/RC:C`. Those temporal fields do not prove a downloadable fix or supersede current exploitation evidence. No CVSS v4.0 score was supplied in the records reviewed. NVD was Awaiting Analysis. The KEV date belongs to CISA's federal directive framework, not a universal private-sector deadline. Affected agencies must assess BOD 26-04 and triage requirements against asset exposure. Known exploitation warrants prompt action elsewhere too. 🧬 What actually went wrong? File-handling code should keep a pathname within authorised locations. Fortinet identifies failures in that restriction and NULL-byte handling, allowing an unauthenticated HTTP/HTTPS caller to obtain an arbitrary-file-write capability. The route, parameter, validation sequence and path constraints are undisclosed. The IBE workaround and decoding-error indicators are useful context; they do not prove that delivery by email attachment or a user click is required. Fortinet also classifies the impact as unauthorised code/commands and publishes changed software/configuration files. The public material does not establish every intermediate step or a universal execution identity. Defender model: reachable vulnerable processing → unauthorised file/state change → possible administrative misuse or persistence → observable network/configuration consequences. The write capability is documented; the exact local sequence needs evidence. Do not infer mailbox theft, ransomware or lateral movement from severity alone. 📦 Affected releases and the source conflict: Current PSIRT HTML and Fortinet CSAF agree: 🔴 8.0: 8.0.0–8.0.1 affected → upcoming 8.0.2+. 🔴 7.6: 7.6.0–7.6.6 affected → upcoming 7.6.7+. 🔴 7.4: 7.4.0–7.4.8 affected → upcoming 7.4.9+. 🔴 7.2: 7.2.0–7.2.9 affected → move to branch 7.4 or above. The branch instruction must be read with the affected 7.4 range: an arbitrary 7.4 release is not enough. Confirm a released, supported correction and migration route with Fortinet; maintain the workaround meanwhile. The CVE structured fields instead stop at 8.0.0, 7.6.5 and 7.4.6, and add 7.0.0–7.0.9. Its description matches current PSIRT. Its solution text names earlier upcoming FortiMail releases and includes FortiRecorder entries. These are primary-record conflicts. Decision: use the matching PSIRT/CSAF matrix, retain the discrepancy and ask Fortinet about 7.0. Do not infer that 7.0 is safe or apply FortiRecorder instructions to FortiMail. Review automated inventory findings that rely on the conflicting structured ranges. Record each active/standby appliance, actual build, management/public address, role and exposure history. An overlooked interface or failover node can retain exposure. 🕰️ Exposure window and timeline: 1 October: Fortinet published the advisory and reported exploitation; CISA added the CVE to KEV. The earliest attack date is not provided. Publication and KEV addition are not attack-start timestamps. 2 October review: corrected releases remain marked upcoming; FIRST returned no EPSS row. The retrieved KEV catalogue was version 2026.10.01, with 1,731 entries. Hunt window: use local installation/reachability history and available retention, including time before disclosure where covered. Record when mitigation became effective. Later closure of the vulnerable condition does not remove earlier malicious changes. 🧭 SOC investigation trail. Objective: establish exposure and determine whether vendor indicators correspond to unauthorised activity. Use authorised assets, a stated UTC window and existing logs or supported acquisition. Record timezone, retention and collection gaps. C01 — Build, IBE state and web reachability Action / location: read running firmware and IBE configuration; review firewall/NAT/proxy records and all relevant HA nodes. Signal / correlation: match build, appliance identity, reachable interface and exposure dates to PSIRT. Current configuration cannot establish historical state. Benign causes / limits: stale inventory, retired instances or changed mappings can mislead; 7.0 needs vendor clarification. Escalation: confirmed exposure goes to the change owner immediately. Suspicious activity additionally goes to SOC/IR; exposure alone is not compromise. C02 — Admin, configuration and IBE events Action / location: preserve supported event exports and remote syslog/FortiAnalyzer records where deployed. Signal / correlation: PSIRT includes IBE decoding errors, unusual admin logout context and a cron-related example. Join matching events to configuration changes, sessions and egress on the same appliance; retain surrounding records. Benign causes / limits: malformed legitimate input, normal logout and scheduled tasks can resemble these clues. Missing debug events may never have been collected. Escalation: an unexplained cluster aligned with an unauthorised change warrants triage. An isolated error or missing log does not establish exploitation or safety. C03 — Remote archive changes Action / location: inspect configuration events, current archive accounts and approved change history. Fortinet's example adds archive234, remote IP 79.141.169.187, and remote directory /uploads. Signal / correlation: join unexpected archive destinations to the responsible account/session and actual outbound flows. Search for changed names too. Benign causes / limits: legitimate remote archiving can look similar. A configured destination does not prove transfer or identify transferred content. Escalation: an unapproved archive change plus related activity warrants IR/data-owner review. Protect archive credentials and establish whether message data was actually exposed. C04 — File indicators and integrity Action / location: request supported acquisition or approved forensic copies of the published paths, including /data/lib/liblog.so and /data/etc/ld.so.preload. Signal / correlation: compare full SHA-256 values and added/modified status with provenance, firmware baseline and the event timeline. Benign causes / limits: path existence alone is insufficient; upgrades and authorised changes need a trustworthy baseline. Timestamps can mislead and variants can change hashes. Do not force unsupported shell access. Escalation: an exact vendor hash match or corroborated unauthorised modification warrants urgent response. Preserve evidence; deleting one file is not eradication. C05 — Egress and follow-on activity Action / location: review retained firewall/flow records for the appliance and published IPs, then unexpected destinations beyond that list. Signal / correlation: join 79[.]141[.]169[.]187 or 45[.]129[.]0[.]192 to archive/file/admin changes; account for NAT and record direction, outcome and volume. Benign causes / limits: shared or reassigned IPs and normal integrations need review. A connection alone cannot establish purpose, content or actor. Do not contact the addresses. Escalation: unexplained egress plus unauthorised state changes merits incident handling. Scope credentials and integrations from evidenced access, not assumed universal compromise. C06 — Verify control and track the correction Action / location: re-read saved IBE state or verify the management-access restriction; repeat across active/standby nodes and confirm service health. Signal / correlation: change record, effective configuration and reachability evidence must agree. Track the forthcoming fix separately and verify its running build when deployed. Benign causes / limits: HA drift or an overlooked interface can preserve exposure. Successful restriction does not remove older malicious changes. Escalation: failed verification, continuing suspicious activity or an unbounded suspected incident requires an owner decision. Handover: appliance/owner → UTC window → source/record IDs → finding/confidence → gaps → next action/owner. Classify exposure, suspicion, corroborated compromise or insufficient telemetry. Report no matches only for the reviewed scope; do not label the appliance clean. 🔎 Vendor-published indicators. Fortinet publishes the following file leads in FG-IR-26-175. “Added” and “modified” are the vendor's classifications, not a finding on the reader's appliance. Added: `/data/lib/liblog.so`, `/data/bin/webconsole`, `/data/bin/mailservice`, `/data/etc/ld.so.preload`. Modified: `/bin/smit`, `/data/etc/httpd.conf`, `/data/migadmin.tar.gz`. Two useful exact SHA-256 comparisons: `/data/lib/liblog.so` `8015f34dc84922b03688399d7f9fe7a00361789f7e420c7e2a2cdb23e75cef84` `/data/etc/ld.so.preload` `8953ec7960b09f544a880b072ad4e6cfda7a8303f486251d3478dcfdfbac23b6` The advisory supplies the remaining hashes. Network leads: 79[.]141[.]169[.]187, 45[.]129[.]0[.]192 (defanged). Useful log pivots include the archive234 account change, Invalid Base64 Encoding in an IBE decoding context, unusual admin logout context and the vendor's cron example. Use original records for the full context. Generic errors, filenames and account strings remain leads until corroborated. Published 1 October; per-IOC observation dates and completeness are unspecified. A miss cannot clear an appliance. Review ownership and expiry before blocking addresses. 🧰 Tools and bounded checks. Check A — Running build and IBE state Use an authorised FortiMail session with read permission. Syntax is documented in the 7.6.3 CLI reference; confirm it for the installed release. These commands inspect configuration: ```text get system status show full-configuration system encryption ibe ``` Record firmware/build, node/HA identity, time and explicit IBE status. Full-configuration includes defaults that ordinary `show` can omit. Repeat after the approved change is saved. Keep potentially sensitive configuration output private. Limit: this establishes current reported state, not historical exposure or eradication. Documentation-checked; not executed against a FortiMail device here. Check B — An already collected log export Use ripgrep on a plain UTF-8 working copy exported for the agreed appliance and UTC window. Replace the example path; decompress archives through the approved evidence process first. ```bash rg -n -F \ -e 'archive234' \ -e '79.141.169.187' \ -e '45.129.0.192' \ -e 'Invalid Base64 Encoding' \ -- /analysis/fortimail-case/system-events.log ``` `-F` searches literal strings; `-n` prints line numbers. Dotted IPs here are local search terms, not connections. Review surrounding events and typed fields: substring hits are candidates, not exact IP attribution. The export supplies the time window; this command has no date filter. Exit 0 means matches, 1 no matches, 2 an error. Resolve missing/unreadable files before interpreting a negative. Encoding, format, retention and collection gaps can hide evidence; large files consume I/O. Local syntax and synthetic match/no-match/error behaviour were checked, not client logs. Check C — Hash an acquired copy without executing it On the analysis workstation, replace this path with an approved evidence copy: ```bash sha256sum -- /analysis/fortimail-case/files/liblog.so ``` Compare the full digest with Fortinet's value and record acquisition provenance. Hashing reads the file without loading/executing it. Identical bytes are strong evidence, but a different digest cannot exclude a variant. Do not obtain unsupported appliance shell access to run a workstation example. 🩹 Remediation and verification: 1 — Assign service and response owners. Preserve useful evidence where feasible. Active harm can require containment before complete collection; document that trade-off and avoid casual rebooting or deletion. 2 — Apply the supported workaround. Fortinet publishes this IBE change: ```text config system encryption ibe set status disable end ``` This changes configuration. The authorised administrator should assess the IBE service impact and use the emergency-change process. Alternatively, disable internet access to the management interface or restrict it to a trusted private network. Cover all relevant nodes and both HTTP/HTTPS exposure where applicable. 3 — Verify control and service health. Confirm saved/effective IBE state or the access restriction and record the change time. Use approved mail-workflow checks. Public-access restriction leaves vulnerable code present; internal reachability and existing attacker access still matter. 4 — Obtain and verify the supported correction. Confirm fixed-build availability and upgrade path with Fortinet. Keep the 7.2 migration and 7.0 ambiguity in the ticket. When a supported fix is available, verify every relevant running instance; downloading an image is not completion. 5 — Resolve earlier compromise separately. Hunt the exposure window. Where compromise is corroborated, follow vendor/IR guidance for acquisition, trusted recovery and justified credential/session revocation. A rebuild may be needed when integrity cannot be restored confidently. Review unauthorised archive destinations and exposed integrations. Completion: verified control/correction plus a separately documented incident conclusion with coverage limits. A future patch must not automatically close an open investigation. 🧾 Evidence separation. Official: the write capability, PSIRT execution-impact classification, current version matrix, upcoming fixes/workarounds, IOC set, exploitation statement and KEV entry. Researcher claims: repository PoC claims appeared in search; no working reproduction, named actor or complete campaign account was validated for this edition. CyberForge analysis: prioritise reachable affected nodes and correlate files, archive changes and egress. These are investigation recommendations, not customer findings. Unknown: exact route/parameter, universal execution identity, attack-start date, victim count, ransomware linkage, complete IOC coverage, confirmed fixed-release availability and definitive 7.0 disposition. 🔥 CyberForge verdict: This is unauthenticated web processing on a mail-security appliance, with reported exploitation and concrete evidence leads. Reachable affected systems deserve immediate owner attention; missing EPSS data does not reduce that urgency. Order of work: establish scope and preserve evidence; apply and verify the workaround; correlate earlier activity; obtain a confirmed supported fix and resolve compromise separately. The deciding question: did the team only reduce new exposure, or also establish what happened beforehand? > Close the exposed path, then follow the evidence: a mitigated FortiMail appliance is not automatically a trusted one. 🔗 Sources and further reading: Fortinet PSIRT — versions, workarounds, IOCs: https://fortiguard.fortinet.com/psirt/FG-IR-26-175 CVE record: https://www.cve.org/CVERecord?id=CVE-2026-104286 NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-104286 CISA KEV announcement: https://www.cisa.gov/news-events/alerts/2026/10/01/cisa-adds-one-known-exploited-vulnerability-catalog CISA forensic-triage guidance: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk FIRST EPSS query: https://api.first.org/data/v1/epss?cve=CVE-2026-104286 FortiMail 7.6.3 CLI reference — IBE and get/show commands: https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/dd24207d-269c-11f0-a9d0-d2b0d2e22f7d/FortiMail-7.6.3-CLI-Reference.pdf ripgrep documentation: https://github.com/BurntSushi/ripgrep/blob/master/GUIDE.md SHA-256 reference: https://www.gnu.org/software/coreutils/manual/html_node/sha2-utilities.html #CyberSecurity #CVE #Fortinet #FortiMail #SOC #ThreatHunting #IncidentResponse #BlueTeam #CyberForge

Critical FortiMail zero-day exploited in the wild (CVE-2026-104286) securitytc.​com/TVl6v7 https://t.co/pGxW11ygNI

🚨 Alerte critique : Fortinet FortiMail CVE-2026-104286 activement exploitée, deadline CISA au 4 octobre 2026. Permet l’écriture de fichiers arbitraires et peut conduire à l’exécution de code arbitraire. #zoneantimalware https://zoneantimalware.com/cisa-fortinet-alerte-2/

🚨Critical - Fortinet FortiMail Unauth Arbitrary File Write via Path Traversal (CVE-2026-104286) Fortinet FortiMail web interface mishandles path normalization in HTTP/HTTPS request handling, enabling ../ traversal to write attacker-controlled files to arbitrary locations without authentication. This can lead to code execution or full device compromise depending on writable paths. 👉Affected: Fortinet FortiMail 8.0.0-8.0.1, 7.6.0-7.6.6, 7.4.0-7.4.8, 7.2.0-7.2.9

Fortinet is warning customers of a critical FortiMail vulnerability, tracked as CVE-2026-104286, that is being actively exploited in zero-day attacks to execute unauthorized code or commands on vulnerable devices. https://www.bleepingcomputer.com/news/security/fortinet-warns-of-critical-fortimail-flaw-exploited-in-zero-day-attacks/ #Fortinet #Fortimail #ENETechnologyServicesGlendora

1/5 Fortinet FortiMail is being exploited through CVE-2026-104286, a critical path-traversal flaw that allows arbitrary file writes without authentication. CVSS 9.8. No user interaction. And the fixes were still listed as upcoming. 🧵 https://t.co/diyW6AjTbD

FCEB due Oct 4: FortiMail CVE-2026-104286. CISA KEV today. CVSS 9.8 unauth path traversal to file write. Fortinet: exploited ITW, fixes upcoming. Now: disable IBE or lock mgmt off internet. Hunt /data/lib/liblog.so and 79.141.169.187 / 45.129.0.192. Victims: Undisclosed. https://t.co/u35b5w6msA