Splunk Zero-Day, INC Ransomware, and DragonForce’s Teams Exploit

CISA has confirmed active exploitation of CVE-2026-20253, a critical Splunk Enterprise vulnerability allowing unauthenticated file manipulation. Meanwhile, INC ransomware has claimed over 830 victims since 2023, exploiting unpatched Fortinet and Citrix vulnerabilities from that same year. DragonForce operators are routing command-and-control traffic through Microsoft Teams relay infrastructure, making malicious activity indistinguishable from legitimate collaboration traffic. This episode examines three distinct threats that share a common pattern: attackers are moving inside trusted infrastructure, rendering traditional perimeter defences insufficient. Corrine provides specific guidance for UK small businesses whose IT providers run Splunk, explains why unpatched CVEs from 2023 remain actively exploited, and sets out five practical actions you can take this week to verify your defences against techniques specifically designed to bypass standard firewall rules and network monitoring.

Chapters

• Intro Corrine introduces a CISA-confirmed active exploitation of a Splunk vulnerability and previews three connected threats that challenge perimeter-based security thinking.
• Splunk Zero-Day: Patch It Today CVE-2026-20253 allows unauthenticated attackers to create or truncate arbitrary files in Splunk Enterprise. CISA has added it to the Known Exploited Vulnerabilities catalogue. UK businesses should verify their MSPs have patched immediately.
• CTA Corrine asks listeners to follow, rate, review, and share the show to extend its reach to other UK small business operators.
• INC Ransomware: 830 Victims and Counting INC ransomware-as-a-service has claimed over 830 victims since 2023, targeting healthcare, manufacturing, and professional services. Affiliates exploit CVE-2023-48788 and CVE-2023-3519, both disclosed in 2023 but still unpatched in many environments.
• DragonForce Is Hiding Inside Microsoft Teams DragonForce affiliates use Backdoor.Turn to route command-and-control traffic through Microsoft Teams relay infrastructure, bypassing standard firewall rules and network monitoring by appearing as legitimate Teams traffic.
• What This Pattern Actually Means Attackers are moving malicious activity inside trusted infrastructure. Perimeter-based defences cannot distinguish malicious Teams traffic from legitimate use, making endpoint detection essential alongside network controls.
• What to Do Before Friday Five specific actions: verify Splunk patches, check patch currency for CVEs older than 30 days, ask about endpoint detection capability, review Microsoft 365 external access settings, and stay informed.
• Outro Corrine summarises that the biggest active threats are hiding inside trusted tools and known vulnerabilities from 2023. Specific knowledge enables actionable conversations with IT providers.

Links

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog