Cisco published the advisory for CVE-2026-20230 on June 3. The flaw is in the WebDialer service of Unified CM, which fails to validate input parameters in specific HTTP requests. An unauthenticated attacker can exploit this to force the application to make HTTP requests to internal administrative services on the loopback interface. Those internal services handle tasks including diagnostic logging, configuration synchronisation, and file management. By passing payload parameters to these internal endpoints, the attacker can write files to the underlying system directory, such as /etc/cron.d/, where the system’s cron daemon executes them automatically under root permissions.

The vulnerability only affects deployments where the WebDialer service is enabled. WebDialer is disabled by default but is commonly enabled in enterprise deployments. To check, navigate to Cisco Unified Serviceability, select Control Center under Feature Services, and look for Cisco WebDialer Web Service in the CTI Services section. If it shows Started, the system is exposed. Fixed versions are 14SU6 for release 14 and 15SU5 for release 15.

Working proof-of-concept exploit code was already public by June 4. Cisco’s PSIRT confirmed awareness of the PoC but had not confirmed active exploitation at time of disclosure. Given the specificity and quality of the PoC, that window is likely short.

The U.S. Department of Justice announced on June 4 the results of Disruption Week, a coordinated operation that began May 18, 2026, targeting the infrastructure used by transnational cybercrime groups based in Southeast Asia to conduct fraud against Americans. The operation led to the takedown of millions of social media, email, and internet access accounts used by those groups, and private sector entities voluntarily froze over $3.8 million in cryptocurrency involved in laundering funds stolen from American victims.

The groups targeted operate large-scale fraud operations including business email compromise, investment fraud, and romance scams, using the accounts taken down to contact and deceive victims. Southeast Asia-based cybercrime groups of this type have been responsible for a significant share of fraud losses reported to the FBI Internet Crime Complaint Center in recent years, operating out of compounds in countries including Myanmar, Cambodia, and Laos where local law enforcement cooperation has historically been limited.

The voluntary cryptocurrency freezes by private sector participants represent the kind of real-time government-private sector coordination that can act faster than formal legal processes. The operation follows a similar model to Operation Saffron and the First VPN disruption, both of which involved coordinated multi-party takedowns of infrastructure rather than arrests of specific individuals.

SentinelOne found source code, compiled binaries, deployment state logs, internet scanners, exploitation tooling, and a live Sliver configuration after the PCPJack operator left two open directories on a command-and-control server at 213.136.80[.]73 with no authentication. The infrastructure was still running when SentinelOne found it.

PCPJack is a credential theft framework that SentinelOne first identified in April 2026 targeting cloud service credentials. The framework is designed to harvest authentication material from cloud platforms, move laterally within cloud environments using stolen credentials, and exfiltrate data. The Sliver configuration found on the open C2 is particularly notable: Sliver is a legitimate open-source command-and-control framework widely used by both red teams and threat actors, and a live configuration exposes the specific communication channels, authentication keys, and operator infrastructure used in this campaign.

The open directory contents effectively provided SentinelOne with a complete operational dossier on PCPJack, including how it is built, how it is deployed, and what infrastructure it uses. SentinelOne has published indicators of compromise derived from the exposed material to assist organisations in detecting PCPJack activity in their environments.