TA578

Signals

NVD · CVE-2026-7529 · 7.5 · The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthorized modification and disclosure of data due to every one of NVD · CVE-2026-7456 · 6.5 · The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_disconnect()` function inNVD · CVE-2026-67623 · 8.8 · Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmoNVD · CVE-2026-17506 · 7.2 · The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 not_found_url tracking parameter in versions up to, and CISA KEV · CVE-2026-18556 · 7.4 · N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability · Added 2026-08-04 · Due 2026-08-07CISA KEV · CVE-2026-34486 · 9.8 · Apache Tomcat Missing Encryption of Sensitive Data Vulnerability · Added 2026-08-04 · Due 2026-08-07NVD · CVE-2026-7529 · 7.5 · The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthorized modification and disclosure of data due to every one of NVD · CVE-2026-7456 · 6.5 · The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_disconnect()` function inNVD · CVE-2026-67623 · 8.8 · Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmoNVD · CVE-2026-17506 · 7.2 · The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 not_found_url tracking parameter in versions up to, and CISA KEV · CVE-2026-18556 · 7.4 · N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability · Added 2026-08-04 · Due 2026-08-07CISA KEV · CVE-2026-34486 · 9.8 · Apache Tomcat Missing Encryption of Sensitive Data Vulnerability · Added 2026-08-04 · Due 2026-08-07

Threat Actors · TA578

· ATT&CK GroupG1038

Techniques

Software

Tactics

Aliases

Description

TA578 is a threat actor that has used contact forms and email to initiate communications with victims and to distribute malware including Latrodectus, IcedID, and Bumblebee.(Citation: Latrodectus APR 2024)(Citation: Bitsight Latrodectus June 2024)

Tactic Coverage

execution (2)resource development (1)reconnaissance (1)

Techniques Used (4)

T1059.007JavaScript

execution

T1204.001Malicious Link

execution

T1583.006Web Services

resource development

T1594Search Victim-Owned Websites

reconnaissance

Software Used (3)

S1039Bumblebeemalware S0483IcedIDmalware S1160Latrodectusmalware

References (3)

https://attack.mitre.org/groups/G1038 https://www.bitsight.com/blog/latrodectus-are-you-coming-back https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice