VLC and VMware binaries side-load malware targeting Brazil and Portugal
WatchGuard linked the activity to Overlord RAT, Lampion, and a Pascal remote-access payload, without one shared operator.
62
Organization
WatchGuard
- Mentions · 7d2
- Mentions · 30d4
- All mentions9
- First seenAug 31, 2026
- Last mentioned4d ago
Timeline
9 articles · newest firstOverlord and Lampion campaigns hide malware with Windows tools
Phishing in Brazil and Portugal delivers VBScript downloaders that persist as fake Windows Error Reporting tasks and side-loaded DLLs.
58
Critical WatchGuard Endpoint Security Flaw Exposes Kernel and Process Memory
CVE-2026-13043 lets local users bypass WatchGuard's PSKMAD driver checks and read kernel and process memory.
66
WatchGuard security advisory (AV26-981)
Canadian Cyber Centre advisory flags CVE-2026-86134, a pre-authentication remote denial-of-service flaw in WatchGuard Fireware OS, urging users to patch.
25
WatchGuard Patches Critical Fireware OS Code Injection Vulnerability
WatchGuard patched critical Fireware OS code injection that could give remote attackers root on Firebox appliances.
68
WatchGuard security advisory (AV26-972)
Canadian Cyber Centre relayed three WatchGuard AP vulnerabilities, including unauthenticated API access and command injection, fixed before version 3.4.8.
22
Critical WatchGuard AP Flaws Let Unauthenticated Attackers Execute Arbitrary Commands
WatchGuard patched two unauthenticated critical AP flaws enabling remote command execution and API access.
78
Critical WatchGuard API Vulnerabilities Enables Command Execution Attacks
WatchGuard patched three AP vulnerabilities, including two unauthenticated critical flaws with CVSS 9.3, in firmware version 3.4.8.
58
WatchGuard security advisory (AV26-865)
Canada's Cyber Centre warns WatchGuard Dimension and Fireware OS vulnerabilities affect multiple versions and urges administrators to apply available updates.
32
Related CVEs
by mentions- Unauthenticated API session flaw in WatchGuard access points
- OS command injection in WatchGuard AP internal API
- OS Command Injection in WatchGuard AP Diagnostic CLI
- CVE-2026-13043<1%9.3Missing authentication in WatchGuard PSKMAD kernel driver
- Root code injection in WatchGuard Fireware BOVPN Over TLS
- Unauthenticated DoS in WatchGuard Fireware OS login
Appears with
- WatchGuardvendor · 4
- Canadian Centre for Cyber Securityorganization · 3
- Overlord RATmalware · 2
- Lampionmalware · 2
- Fireware OSproduct · 2
- Donutmalware · 2
- Microsoftvendor · 2
- WatchGuard Endpoint Securityproduct · 1
- Windows 11product · 1
- Panda Securityvendor · 1
- Bitsightorganization · 1
- Fireboxproduct · 1
- Dimensionproduct · 1
- PSMEMDriverproduct · 1
- WatchGuard Access Pointproduct · 1
- VideoLANvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.