CVE-2021-38003, CVE-2025-25249, CVE-2026-19490, CVE-2026-20079, CVE-2026-20316, CVE-2026-42016, CVE-2026-42018, CVE-2026-67277, CVE-2026-69414, CVE-2026-78224, CVE-2026-81578, CVE-2026-81821, CVE-2026-81822, CVE-2026-81823, CVE-2026-81824, CVE-2026-82078, CVE-2026-82329, CVE-2026-82578, CVE-2026-82583, CVE-2026-85102, CVE-2026-85103, CVE-2026-86060, CVE-2026-87020
IP Addresses:
45.142.193.132
Get tomorrow's brief in your inbox
Today: Cisco firewalls are under attack by state-sponsored groups and Qilin ransomware, CISA added exploited vulnerabilities with a September 12 federal deadline, and a Russian actor used AI agents to compromise 440+ PaperCut instances across 48 countries. Patch Cisco FMC, PaperCut, Check Point VPN, and MikroTik routers immediately.
Cisco FMC Exploited by State-Sponsored Groups and Qilin Ransomware (CVE-2026-20316, CVE-2026-20079)
Cisco disclosed three threat clusters exploiting FMC vulnerabilities: UAT-12197 used CVE-2026-20079 (CVSS 10.0 authentication bypass) to deploy JSP web shells and harvest credentials. UAT-11823 exploited both flaws to deliver Cyclops Blink malware (attributed to Russian APT Sandworm). UAT-11988 exploited CVE-2026-20316 (CVSS 5.3 static credential) for Qilin ransomware deployment, using legitimate FMC tooling for reconnaissance, credential theft, and endpoint targeting. CVE-2026-20079 added to CISA KEV with September 12 deadline. CVE-2026-20316 was added in July with an August 1 deadline (now past). Comprehensive hardening release scheduled next week.
PaperCut Attacker Uses AI Agents to Compromise 440+ Instances (CVE-2026-81578, CVE-2026-82078)
A Russian-speaking threat actor used hundreds of AI agents powered by OpenAI Codex and DeepSeek to exploit PaperCut flaws (authentication bypass + RCE) and compromise at least 440 instances across 395 organizations in 48 countries. The attacker built exploits in a lab environment with Active Directory, then deployed AI agents to automate exploitation at scale. Attack timeline: empty workspace to first RCE in under 4 hours, 11 organizations compromised in 26 seconds. One US high school went from initial access to domain admin in 7 minutes. The attacker gained domain admin access in 12 cases, deployed Mimikatz/SharpHound/Certipy/Rubeus/Impacket, and avoided targets in Russia, China, Hong Kong, Thailand, Iran, and 23 other countries. End goals unclear. IP address: 45.142.193.132. Activity tracked since early July 2026. PaperCut released maintenance releases 26.0.5, 25.0.13, 24.1.10 replacing all emergency patches. CVE-2026-81578 and CVE-2026-82078 added to CISA KEV with September 14 deadline.
Check Point VPN Flaws Enable Unauthenticated RCE (CVE-2026-85102, CVE-2026-85103)
Check Point patched two critical VPN certificate handling vulnerabilities (both CVSS 9.8) in Security Gateways and Security Management Server. CVE-2026-85102 is improper certificate trust validation during VPN negotiation. CVE-2026-85103 is heap-based buffer overflow in ASN.1 certificate decoding. Both allow unauthenticated remote code execution "under specific conditions" (not disclosed). Affected versions: R82.10 with JHF Take 43 or below, R82 with JHF Take 125 or below, R81.20 with JHF Take 165 or below. Fixes available via Live Patch (automatic rollout started September 9) or Jumbo Hotfix. Check Point found both flaws internally, no evidence of exploitation.
CISA Adds Four Exploited Vulnerabilities to KEV Catalog
CISA added CVE-2026-20079 (Cisco FMC authentication bypass, CVSS 10.0), CVE-2026-19490 (Citrix NetScaler authentication bypass, CVSS 9.3), CVE-2025-25249 (Fortinet heap overflow, CVSS 7.3), CVE-2026-67277 and CVE-2026-86060 (MikroTik RouterOS vulnerabilities) to KEV catalog. Federal agencies must patch by September 12 (Cisco/Citrix/Fortinet) and September 13 (MikroTik) under BOD 26-04.
Fortinet Flaw Exploited to Deploy PivotC2 RAT (CVE-2025-25249)
SOCRadar reported a Russian-speaking threat actor exploited CVE-2025-25249 (Fortinet heap overflow) to deploy PivotC2, a Node.js RAT, on 178 FortiGate devices across 3,000+ scanned targets. PivotC2 provides interactive shells, file transfers, SOCKS5/HTTP proxy tunneling, port forwarding, CIDR scanning, and FortiGate credential decryption. Auto-mode flag enables autonomous operations. Attack chain: shell script exploit → reverse shell → JavaScript payload → PivotC2 deployment. Earliest evidence of exploitation dates to July 2026. CISA added CVE-2025-25249 to KEV catalog with September 12 deadline.
Conti Ransomware Developer Sentenced to 4 Years
Oleksii Lytvynenko, a Ukrainian national, was sentenced to 4 years in federal prison for his role as a Conti ransomware developer and intruder. Lytvynenko joined Conti in September 2021, developed malware, and held data on 12 victims (8 in the US). He and co-conspirators extorted $634,000 in Bitcoin from two Tennessee victims, including a government entity that resulted in compromise of a sheriff's department, EMS, and local police. When arrested in Ireland in July 2023, Lytvynenko was asleep with an open laptop running Cobalt Strike. Conti disbanded in 2022 after a massive leak; members rebranded as Zeon, Black Basta, Quantum/Royal/BlackSuit.
SOCRadar tracked PivotC2 RAT C2 infrastructure and attack patterns targeting FortiGate instances. GreyNoise tracked IP 45.142.193.132 conducting PaperCut exploitation attempts and port scanning targeting Palo Alto, Ubiquiti, Citrix, SonicWall, and Proxmox VE since early July 2026. Cisco Talos identified UAT-12197, UAT-11823 (Sandworm/Cyclops Blink), and UAT-11988 (Qilin ransomware) exploiting FMC instances with web shells, JAR command executors, Netcat reverse shells, and bash scripts.
Voice Callers Exploit BYOD to Reach Microsoft 365 Corporate Data
Microsoft tracks two threat actors (Storm-3032, Storm-3121) calling or texting employees' personal devices, impersonating IT helpdesk, and tricking them into updating authentication methods (passkey, MFA, SSO). Attacks use AiTM techniques and device-code phishing flows to steal credentials and session tokens. Once inside, attackers exploit Microsoft Graph API to enumerate corporate data, identify high-value targets, and exfiltrate SharePoint/OneDrive/Teams content. Likely passing access to extortion groups like ShinyHunters. Since May 2026, targeting employees' personal phones bypasses corporate email gateways and EDR.
AI-Themed Phishing Campaigns Target ChatGPT, Copilot, DeepSeek, Claude Users
Microsoft Threat Intelligence tracks campaigns impersonating ChatGPT, Copilot, DeepSeek, and Claude to deliver phishing, malware, and malvertising. One ChatGPT-themed campaign sent 100,000 phishing emails in a single day harvesting credit card data. Storm-3075 used AI-themed malvertising to distribute Vidar stealer via fake Windows plugins. Fraudulent DeepSeek installers distributed through GitHub. Claude-themed campaign harvested credentials via AiTM techniques. Campaigns exploit user curiosity around new AI model releases and policy updates.
Microsoft Promotes AI Invoice Fraud Campaign Using Generative AI
Microsoft detected a campaign sending 1 million+ AI-generated executive impersonation emails (87.7% targeting US) between August 3-5. Attackers impersonated CEOs and included fabricated ServiceNow invoices requesting $50,000 ACH payments. Emails contained CEO signatures, forwarded email threads, and professional invoices with ServiceNow branding. Sent via third-party email services. Strong indicators of generative AI use in email template creation. Neither the impersonated companies nor ServiceNow were compromised.
JFrog Artifactory Flaws Chained for Admin Takeover (CVE-2026-42018, CVE-2026-42016)
Attackers chained two JFrog Artifactory flaws to gain administrator control and plant backdoors on self-hosted servers. CVE-2026-42018 (unauthenticated anonymous token retrieval) and CVE-2026-42016 (token scope escalation) allowed attackers to exchange anonymous tokens for admin tokens in under 5 minutes. Wiz observed attacks between August 15 and September 8. Attackers created admin accounts, installed malicious Groovy plugins via plugin framework, executed shell commands, dropped binaries over HTTP to /tmp, and deployed custom Rust backdoors with C2 channels. A third flaw, CVE-2026-82329 (CVSS 9.8 auth bypass), was exploited separately September 1-8. CISA added CVE-2026-82329 to KEV on September 2 with September 5 deadline. Fastly counted 406,000 exploitation attempts on September 2.
ShieldCrash Bypasses Microsoft Defender Patches (CVE-2026-69414)
Nightmare-Eclipse released ShieldCrash, a bypass for September's CVE-2026-69414 patches. The exploit demonstrates arbitrary file read as SYSTEM on fully patched Windows systems. ShieldCrash bypasses the fix for ShieldBreak, which itself bypassed the fix for RoguePlanet. All three exploit the Microsoft Malware Protection Engine in Windows Defender. The researcher claims Microsoft missed a spot where the original vulnerability can still be triggered. This is the latest in a series of monthly zero-day releases from Nightmare-Eclipse targeting Microsoft.
ShinyHunters Breach McKesson Medical Supplier, Expose 6.4M Records
ShinyHunters claimed a breach of McKesson, a major medical supplier, exposing 6.4 million records. No additional details available at press time.
China-Linked UNC3569 Exploited Sogou Input Method for GRAYRABBIT Backdoor (CVE-2021-38003)
UNC3569 (China-nexus hacker-for-hire group tracked by Google) exploited a flaw in Sogou Input Method (455M+ users, 70% market share in China) to deploy GRAYRABBIT backdoor. The attack chained sgbiz: link handler abuse, unfiltered command-line arguments, and a 2020 Chromium browser (version 80) with sandbox and same-origin policy disabled. Clicking a crafted link led to code execution with user privileges. Tencent fixed the flaw in April 2026 but did not upgrade the Chromium version or enable sandbox protections. UNC3569 has targeted government, education, technology, and finance sectors in East and Southeast Asia since 2021.
Trezor and BitBox Targeted in Newsletter Phishing Campaign
Hackers breached the email service provider for hardware crypto-wallet makers Trezor and BitBox, sending phishing emails from official accounts. The phishing emails urged users to update their wallets or verify seed phrases.
Citrix NetScaler Authentication Bypass (CVE-2026-19490)
Citrix patched critical authentication bypass (CVSS 9.3) in NetScaler ADC and NetScaler Gateway when configured as AAA virtual server or Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy). Rapid7 warned of imminent exploitation when the flaw was patched August 19. Previdian recorded 56 exploitation attempts since September 3, with 36 attempts on September 8 alone. CISA added to KEV on September 10 with September 12 deadline.
AVEVA Pipeline Integrity Monitor ICS Vulnerabilities
CISA published advisory for AVEVA Pipeline Integrity Monitor <=2025_SP1_P1 with four vulnerabilities: CVE-2026-81821 (hard-coded crypto key allows password decryption), CVE-2026-81822 (weak password hashes enable brute-force), CVE-2026-81823 (unauthenticated read operations), and CVE-2026-81824 (information disclosure). Successful exploitation could allow password leakage, privilege escalation to PIMBoards admin, or information disclosure.
NextGen Healthcare Mirth Connect Medical Device Flaws
CISA published advisory for NextGen Healthcare Mirth Connect <=v4.7.1 with three vulnerabilities: CVE-2026-82583 (authenticated SQL injection via Database Connector API), CVE-2026-78224 (XXE in XSLT Transformer Step), and CVE-2026-82578 (XXE in XML batch processing XPath). Exploitation could allow credential disclosure, arbitrary file write, data exfiltration, or denial-of-service.
Orthanc DICOM Server Heap Overflow (CVE-2026-87020)
CISA published advisory for Orthanc DICOM Server <1.13.0 with integer overflow in pitch/buffer-size computation leading to heap out-of-bounds write when decoding attacker-supplied PNG images. Exploitation causes crash and denial-of-service.
Google Play Early Access Abused for Deceptive Apps
Bitdefender reported thousands of deceptive apps abusing Google Play Early Access to push fake casino games, reward apps, and misleading utilities. Early Access apps cannot receive public reviews or ratings, allowing deceptive apps to gain traction without trust signals. One fake GTA clone ("Vice Streets: Open World") reached 1M+ downloads. Apps promoted via AI-generated celebrity deepfakes on TikTok and Facebook. Revenue model: ad fraud. Casino-style apps bypass licensing, geofencing, and age verification by masquerading as casual games.
Android Banking Malware Gigabud Uses Work Profiles to Hide (Indonesia)
Group-IB reported Gigabud banking trojan (active since 2022, linked to GoldFactory) now installs Vwork (modified Shelter app) to create Android work profiles and clone tampered banking apps inside. The work profile hides the trojan from banking app malware checks. Gigabud is a RAT that captures keystrokes via fake overlays, steals lock screen codes, and executes transactions via Accessibility while displaying black screen. Group-IB confirmed 1,469 compromised devices and 1,281 logins in Indonesia (February-July 2026), estimated $9M losses. Targets: Brazil, Colombia, Egypt, Indonesia, Laos, Mexico, Morocco, Philippines, Thailand, Türkiye, and one GCC country.
Today's brief is dominated by AI-assisted attacks (PaperCut exploitation using AI agents, Microsoft's AI-generated invoice fraud), critical infrastructure under siege (Cisco FMC exploited by state-sponsored and ransomware groups), and authentication bypass vulnerabilities across enterprise VPN and network appliances (Check Point, Citrix, MikroTik). The PaperCut campaign demonstrates how AI agents compress attack timelines from hours to minutes. The Cisco FMC compromise shows convergence of APT and ransomware TTPs targeting the same infrastructure. BYOD exploitation (Microsoft Storm campaigns) highlights the security gap when corporate authentication reaches personal devices. Early warning indicators from CISA KEV additions (four vulnerabilities with September 12-13 deadlines) signal escalating exploitation of network perimeter devices.