Security posture report - May 2026

New developments

• Expanded targets: In addition to previously targeted ERP/OA systems, this variant is now capable of cross-platform attacks. We have observed cases where Linux servers were also encrypted, making cloud environments and server assets new high-risk targets.

• Kingdee official alert: Kingdee Software has issued a security bulletin confirming that its K3 Cloud Enterprise Edition private cloud servers have been attacked by this ransomware. Files were encrypted with the .sorry extension, and Kingdee advises users to immediately disconnect from the internet, patch vulnerabilities, and perform off-site backups.

New IOC

c9efa12506b6c3a08221391a1e8e11d5

Security recommendations

Alibaba Cloud once again advises you to reduce your public attack surface, remediate all weak passwords, and upgrade legacy ERP/OA systems as soon as possible.

Attack technique: SSH brute-force worm

This type of botnet uses brute-force attacks against SSH services with weak passwords as its initial access vector. The attack chain consists of three stages:

• Brute-force intrusion: The botnet conducts large-scale SSH dictionary attacks to breach a host's defenses. Once successful, it immediately deploys cryptomining malware.

• Persistent control: The attackers implant an SSH public key to enable passwordless login. They then use the chattr +ia command to set the key file's immutable attribute, preventing administrators from deleting or modifying it to achieve persistent control.

• Telemetry exfiltration: The botnet enhances its mechanism for exfiltrating data from compromised hosts. Information such as the host's IP address, system environment, and computing power is sent back to the Command and Control (C2) server. This allows attackers to centrally manage and orchestrate the compromised resources.

Overall, this type of botnet has become significantly more versatile, stealthy, and resistant to removal.

IOC

e49c610315ff35dca6729fda138553d5

a803de211bbdc0dfae46c5e2af7b2591

Security recommendations

1. Strengthen SSH authentication: Replace all weak passwords with strong passwords of at least 12 characters containing uppercase and lowercase letters, numbers, and special characters. Disable direct root SSH login, using a standard account with sudo for privilege escalation instead. Prioritize SSH key pair authentication over passwords, and in /etc/ssh/sshd_config, set PasswordAuthentication no.

2. Reduce your public attack surface: Avoid exposing port 22 to the public internet unless necessary. If exposure is required, configure a security group to restrict access to an IP allowlist, or manage access through a VPN or bastion host.

3. Remediate infected hosts: If a botnet backdoor has compromised your host, immediately claim your free security protection for ECS. Then, in Security Center, navigate to **Protection Configuration > Virus Scan** and perform a deep scan. This process automatically removes malicious programs, backdoor files, unauthorized SSH public keys, and persistence mechanisms, including files locked with the chattr +ia command.

Critical RCE vulnerabilities in Redis

In May 2026, three critical remote code execution (RCE) vulnerabilities were disclosed in Redis. All three stem from underlying memory management flaws that, under specific conditions, allow an authenticated attacker to achieve RCE and gain full control of the target system.

1. Use-after-free in Lua script execution (CVE-2026-23631)

When Redis has Lua scripting enabled and runs as a replica node, an attacker can trigger a use-after-free vulnerability through the master-replica synchronization mechanism to achieve remote code execution. The exploit conditions are strict, requiring Lua scripting to be enabled, the replica node to not be in read-only mode, and the attacker to have authentication credentials.

Affected versions: Redis 7.2.0–7.2.9, 7.4.0–7.4.3

2. Use-after-free when unlocking client streams (CVE-2026-23479)

This vulnerability exists in the client-side caching feature of Redis. A memory management flaw in the processing of client stream unlock operations allows an attacker to craft a special request to trigger a use-after-free condition, ultimately leading to remote code execution.

Affected versions: Redis 7.2.0–7.2.9, 7.4.0–7.4.3, 8.0.0–8.0.2

3. Invalid memory access with the RESTORE command (CVE-2026-25243)

An attacker with permission to use the RESTORE command can send a specially crafted command to the server. During deserialization, this can trigger an invalid memory access, leading to a service crash or remote code execution.

Affected versions: Redis 7.2.0–7.2.9, 7.4.0–7.4.3, 8.0.0–8.0.2

Alibaba Cloud recommends upgrading to the latest secure version immediately. If an immediate upgrade is not possible, restrict Redis access by source IP address and enforce a least-privilege ACL policy as a temporary mitigation.