Check Point VPN flaw fuels VerdantBamboo espionage campaign

A critical alert highlights three active exploits detected, including vulnerabilities in Google Chromium V8 and Cisco Catalyst systems. A more serious threat, CVE-2026-50751, involves a Check Point VPN exploit that is currently active in the wild.

The VerdantBamboo malware campaign, attributed to a Chinese advanced persistent threat group, has been discovered infiltrating enterprise networks through edge devices. This operation utilizes sophisticated methods, exploiting unsecured hardware and employing stolen credentials to gain unauthorized access. The attackers have been able to maintain long-term access without raising internal alarms by using a strategy of blending into normal operations.

Key insights include the use of local privilege escalation, where attackers exploited vulnerabilities within storage devices and Managed Service Providers, and the development of advanced malware such as PLENET, which complicates detection and analysis. Security recommendations stress the importance of multifactor authentication, network segmentation, and continuous monitoring of outbound traffic.