Afternoon Review in IT Security — September 21, 2026

The cybersecurity landscape continues to face escalating threats across multiple vectors today, from sophisticated ransomware operations exploiting core Windows infrastructure to coordinated attacks targeting open-source developers. Organizations are confronted with critical vulnerabilities, supply chain compromises, and targeted campaigns against key software maintainers that demand immediate attention and remediation.

Group Policy Hijacked: PAYLOAD Ransomware Weaponizes Active Directory GPO

Kaspersky GERT experts have analyzed a significant technical incident involving PAYLOAD ransomware, which operates through an unconventional approach that eschews traditional encryption and binary payloads. Instead, the threat actor abuses Active Directory mechanisms, specifically Group Policy Objects, to weaponize domain admin access and propagate across enterprise environments. This technique represents a sophisticated evolution in ransomware tactics, leveraging legitimate administrative infrastructure to achieve its objectives. Source: Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO

The attack methodology highlights a critical vulnerability in how organizations manage identity and access controls. By compromising Group Policy Objects, attackers gain the ability to deploy malicious configurations across entire domains, potentially affecting thousands of systems simultaneously. This incident underscores the importance of securing Active Directory infrastructure and monitoring GPO modifications for unauthorized changes.

Organizations Warned of 3 Exploited Linux Kernel Vulnerabilities

Three Linux kernel vulnerabilities are currently being exploited in active attacks, posing significant risks to organizations running Linux-based infrastructure. The affected vulnerabilities, tracked as CVE-2025-39682, CVE-2025-39964, and CVE-2026-53266, can be leveraged by attackers to cause denial-of-service conditions, disclose sensitive memory contents, or modify memory on vulnerable systems. Source: Organizations Warned of 3 Exploited Linux Kernel Vulnerabilities

The active exploitation of these kernel-level flaws represents an urgent threat requiring immediate patching across all affected systems. Organizations must prioritize kernel updates and implement comprehensive patch management strategies to mitigate the risk of memory disclosure and system compromise. The combination of these three vulnerabilities creates a layered attack surface that sophisticated threat actors can exploit for persistent access.

Rust Team Members and Popular Crate Owners Targeted via Video Calls

Developers within the Rust community, including core team members and maintainers of popular crates, have become targets of coordinated social engineering attacks conducted through fake video calls. The attack techniques employed by the threat actors align with methodologies previously attributed to North Korean threat actors, though it remains unclear whether these campaigns represent a continuation of previous Rust-focused operations. Source: Rust Team Members and Popular Crate Owners Targeted via Video Calls

The targeting of Rust developers represents a supply chain risk with potential implications for the broader software ecosystem. By compromising key maintainers and core contributors, attackers could potentially introduce malicious code into widely-used libraries and frameworks. The use of social engineering tactics via video calls demonstrates the sophistication of these campaigns and the need for enhanced security awareness among open-source contributors.

CrowdSec Confirms Source Code Stolen in Supply Chain Attack

CrowdSec has confirmed that its source code was stolen as part of a supply chain attack, with the cybersecurity firm attributing the breach to the May 2026 TanStack supply chain incident. The compromise of CrowdSec's source code represents a significant security incident with potential ramifications for organizations relying on the company's security solutions. Source: CrowdSec Confirms Source Code Stolen in Supply Chain Attack

The incident demonstrates how supply chain compromises can cascade through multiple organizations and projects. When a third-party dependency is compromised, the impact extends far beyond the initial victim, potentially affecting all downstream consumers of that software. This attack underscores the critical importance of supply chain security practices, including vendor assessment, dependency monitoring, and incident response planning.

Today's threat landscape reflects a coordinated and multifaceted approach by threat actors targeting infrastructure, developers, and supply chains simultaneously. Organizations must implement defense-in-depth strategies that address identity and access management, kernel security, developer security awareness, and supply chain resilience to effectively mitigate these converging risks.