DragonForce Hid Inside Microsoft Teams and Nobody Noticed for Two Months

Multiple high-risk incidents and active exploits reported across enterprise, cloud and mobile environments. DragonForce ransomware operators covertly routed C2 through Microsoft Teams relay servers to evade detection for 1–2 months. CISA added the Widget Factory Joomla Content Editor flaw (CVE-2026-48907, CVSS 10.0) to its Known Exploited Vulnerabilities catalog; Cisco confirmed active exploitation of CVE-2026-20262 (Catalyst SD‑WAN Manager arbitrary file write). Defused Cyber observed active exploitation of three critical FortiSandbox vulnerabilities. Additional notable threats include the Ro