Confucius

Signals

NVD · CVE-2026-7726 · 6.5 · The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the `Layouts_WPB_Remote::template_sync(NVD · CVE-2026-7693 · 7.2 · The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization oNVD · CVE-2026-7520 · 8.1 · The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `sign_in()` anNVD · CVE-2026-7444 · 8.1 · The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missinCISA KEV · CVE-2026-18556 · 7.4 · N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability · Added 2026-08-04 · Due 2026-08-07CISA KEV · CVE-2026-34486 · 7.5 · Apache Tomcat Missing Encryption of Sensitive Data Vulnerability · Added 2026-08-04 · Due 2026-08-07NVD · CVE-2026-7726 · 6.5 · The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the `Layouts_WPB_Remote::template_sync(NVD · CVE-2026-7693 · 7.2 · The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization oNVD · CVE-2026-7520 · 8.1 · The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `sign_in()` anNVD · CVE-2026-7444 · 8.1 · The Search Analytics for WP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.16. This is due to missinCISA KEV · CVE-2026-18556 · 7.4 · N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability · Added 2026-08-04 · Due 2026-08-07CISA KEV · CVE-2026-34486 · 7.5 · Apache Tomcat Missing Encryption of Sensitive Data Vulnerability · Added 2026-08-04 · Due 2026-08-07

Threat Actors · Confucius

· ATT&CK GroupG0142

Confucius APT

Techniques

Software

Tactics

Aliases

Description

Confucius is a cyber espionage group that has primarily targeted military personnel, high-profile personalities, business persons, and government organizations in South Asia since at least 2013. Security researchers have noted similarities between Confucius and Patchwork, particularly in their respective custom malware code and targets.(Citation: TrendMicro Confucius APT Feb 2018)(Citation: TrendMicro Confucius APT Aug 2021)(Citation: Uptycs Confucius APT Jan 2021)

Tactic Coverage

execution (6)exfiltration (2)persistence (2)privilege escalation (2)command and control (2)discovery (2)stealth (2)initial access (2)collection (1)resource development (1)

Techniques Used (19)

T1041Exfiltration Over C2 Channel

exfiltration

T1053.005Scheduled Task

executionpersistence

T1059.001PowerShell

execution

T1059.005Visual Basic

execution

T1071.001Web Protocols

command and control

Registration Required

Create a free account to access full Threat Actor Techniques

Showing 5 of 19 results

✓ Personal dashboard✓ Track 1 vendor/product✓ 1 keyword alert✓ Weekly digest✓ 1 CSV export/month

Already have an account? Sign in →

Software Used (1)

S0670WarzoneRATmalware

References (4)

https://attack.mitre.org/groups/G0142 https://www.trendmicro.com/en_us/research/18/b/deciphering-confucius-cyberespionage-operations.html https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html https://www.uptycs.com/blog/confucius-apt-deploys-warzone-rat