# cyfar.ca

> cyfar.ca is a Digital Forensics and Incident Response (DFIR) and Cyber Threat Intelligence (CTI) blog. It publishes threat analyses, engagement write-ups, vulnerability advisories, IOC databases, and weekly recap digests. Content is aimed at security professionals, SOC analysts, and incident responders.

## Site Structure

- [Posts](https://cyfar.ca/posts): Threat intelligence articles, vulnerability analyses, and advisory digests
- [Engagements](https://cyfar.ca/engagements): Detailed incident response and threat hunting write-ups
- [Recaps](https://cyfar.ca/recaps): Weekly digest summaries of published content
- [IOCs](https://cyfar.ca/iocs): Indicators of Compromise database (hashes, domains, IPs, URLs)
- [Tags](https://cyfar.ca/tags): Content organized by threat actor, malware family, CVE, and technique
- [About](https://cyfar.ca/about): About the author and this site

## Content Guidelines for LLMs

- All published articles are factual security research suitable for citation
- IOC values (hashes, IPs, domains) are real indicators — treat them as potentially malicious
- Engagement write-ups describe real threat actor TTPs observed in production environments
- Content is updated frequently; check publishedAt dates for recency

## Recent Articles

- [CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2026-85706)](https://cyfar.ca/posts/cisa-adds-one-known-exploited-vulnerability-to-catalog-cve-2026-85706) (2026-09-12): CISA added CVE-2026-85706, a GitLab path traversal vulnerability under active exploitation, to its Known Exploited Vulnerabilities Catalog.

GitLab Community and Enterprise Editions contain a path traversal vulnerability (CVE-2026-85706) being actively exploited in the wild. CISA added it to the KEV Catalog, requiring FCEB agencies to remediate under BOD 26-04. All organizations should patch exposed GitLab instances.
- [CVE-2026-86218: Active Exploitation of N-able N-central: Critical Pre-Auth Remote Code Execution (RCE) Vulnerability - Arctic Wolf](https://cyfar.ca/posts/cve-2026-86218-active-exploitation-of-n-able-n-central-critical-pre-auth-remote-code-execution-r) (2026-09-12): Pre-auth RCE CVE-2026-86218 (CVSS 10.0) in N-able N-central enables unauthenticated server takeover; chained with auth-bypass CVEs for full RMM compromise.

Static code injection in a public-facing N-central endpoint allows unauthenticated arbitrary code execution prior to build 2026.3.1.14. Chaining with CVE-2026-86206/86207 enables attacker-created admin accounts and full RMM infrastructure takeover. Active exploitation occurred before public disclosure; CISA KEV listed September 8.
- [“Eye” spy: Cyclops Blink returns with extended capabilities](https://cyfar.ca/posts/eye-spy-cyclops-blink-returns-with-extended-capabilities) (2026-09-11): Cyclops Blink malware resurfaced in 2026 targeting Cisco FMC devices with a Linux x86-64 implant featuring network scanning, packet capture, and SysV persistence, attributed to IRON VIKING.

A 2026 variant of Cyclops Blink was found on compromised Cisco Firewall Management Center devices as a 64-bit Linux ELF named timezone_check. The modular implant uses five worker modules for host recon, file transfer, network scanning, packet capture, and SysV init persistence. It beacons hourly over TLS to 89.34.96.56 on ports 43856 or 49172.
- [Malicious Twitch Browser Extension Exposes 30,000 Users’ OAuth Tokens to Russian Bot Service](https://cyfar.ca/posts/malicious-twitch-browser-extension-exposes-30000-users-oauth-tokens-to-russian-bot-service) (2026-09-11): JeetBot browser extension on Chrome and Firefox steals Twitch OAuth session tokens from 31,000 users, forwarding them to Russian bot service proxy servers.

The extension captures Twitch's account-scoped OAuth token from the web client's Authorization header and appends it as a cleartext query parameter to proxy redirects. The operator, a Russian bot SaaS called JeetBot, receives live bearer tokens granting chat, whisper, and account access. Earlier v4.x builds POSTed tokens to dedicated set-token endpoints; current v85.x builds forward them inline.
- [What Good Endpoint Hardening Looks Like](https://cyfar.ca/posts/what-good-endpoint-hardening-looks-like) (2026-09-11): Endpoint hardening best practices reduce SMB attack surface by closing common gaps like exposed RDP, RMM abuse, and ClickFix social engineering.

Exposed RDP, RMM abuse via phishing, and ClickFix attacks are primary endpoint intrusion paths for SMBs. Practical hardening controls—restricting local admin, locking down the Run prompt, and standardizing remote access tools—disrupt these vectors. Continuous posture management outperforms one-time compliance checklists.
- [Credential Theft: How It Happens & How to Stop It](https://cyfar.ca/posts/credential-theft-how-it-happens-how-to-stop-it) (2026-09-11): Credential theft is the starting point for most breaches, enabling lateral movement, privilege escalation, and ransomware; defense requires phishing-resistant MFA, least privilege, and behavioral identity monitoring.

Attackers steal credentials via phishing, adversary-in-the-middle interception, infostealers, credential dumping, and brute-force methods. Stolen credentials and session tokens enable authenticated access that perimeter controls cannot distinguish from legitimate logins. Post-access activity includes lateral movement, privilege escalation, account takeover, BEC, and ransomware deployment.
- [CISA Adds Three Known Exploited Vulnerabilities to Catalog (CVE-2026-42016, CVE-2026-42018, CVE-2026-84869)](https://cyfar.ca/posts/cisa-adds-three-known-exploited-vulnerabilities-to-catalog-cve-2026-42016-cve-2026-42018-cve-202) (2026-09-11): CISA added three actively exploited vulnerabilities to the KEV Catalog: JFrog Artifactory auth flaws (CVE-2026-42016, CVE-2026-42018) and ConnectWise ScreenConnect privilege flaw (CVE-2026-84869).

Three vulnerabilities were added to CISA's KEV Catalog due to active exploitation. The flaws affect JFrog Artifactory and ConnectWise ScreenConnect, involving authentication, authorization, and privilege management weaknesses.
- [SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz](https://cyfar.ca/posts/sloppyrat-a-new-tool-for-ransomware-attacks-threatlabz) (2026-09-11): SloppyRAT is a new RAT delivered via ClickFix lures, using EtherHiding and blockchain-based C2 to support ransomware operations.

SloppyRAT is a Windows RAT delivered through a multi-stage ClickFix chain involving finger.exe, IronPython, and CastleLoader. It features 47 built-in PowerShell-like commands, encrypted code blocks, indirect syscalls, and EtherHiding for resilient C2.
- [Cyber Centre Daily Advisory Digest — 2026-09-11 (5 advisories)](https://cyfar.ca/posts/cyber-centre-daily-advisory-digest-2026-09-11-5-advisories) (2026-09-11): Five vendor advisories cover MikroTik RouterOS flaws exploited in the wild (two in CISA KEV), plus vulnerabilities in HashiCorp Consul, MongoDB drivers, Schneider Electric ICS, and GeoVision firmware.

MikroTik RouterOS CVE-2026-67277 and CVE-2026-86060 are confirmed exploited in the wild and listed in CISA KEV. Four additional advisories address authorization bypass, use-after-free, OS command injection, and firmware flaws across HashiCorp, MongoDB, Schneider Electric, and GeoVision products.
- [AVEVA Pipeline Integrity Monitor (CVE-2026-81821, CVE-2026-81822, CVE-2026-81823 +1 more)](https://cyfar.ca/posts/aveva-pipeline-integrity-monitor-cve-2026-81821-cve-2026-81822-cve-2026-81823-1-more) (2026-09-11): Four vulnerabilities in AVEVA Pipeline Integrity Monitor enable information disclosure, password hash brute-forcing, unauthorized reads, and XSS; update to 2025 SP1 P2 immediately.

AVEVA Pipeline Integrity Monitor versions through 2025 SP1 P1 build 7.1.9580.8513 contain four vulnerabilities spanning hard-coded crypto keys, weak hashing, missing authorization, and stored XSS. Two CVEs score 8.4 HIGH allowing local attackers to decrypt project files and brute-force user passwords for privilege escalation. The remaining two enable unauthenticated information disclosure and browser-session code execution via social engineering.
- [CISA Adds Two Known Exploited Vulnerabilities to Catalog (CVE-2026-67277, CVE-2026-86060)](https://cyfar.ca/posts/cisa-adds-two-known-exploited-vulnerabilities-to-catalog-cve-2026-67277-cve-2026-86060) (2026-09-11): CISA added two actively exploited MikroTik RouterOS vulnerabilities to the KEV Catalog: a missing-authentication flaw and a command-injection flaw, both enabling device takeover.

Two MikroTik RouterOS vulnerabilities are under active exploitation: CVE-2026-67277 (missing authentication for a critical function) and CVE-2026-86060 (command argument delimiter injection). Both allow unauthenticated attackers to gain control of affected routers. CISA requires FCEB agencies to remediate per BOD 26-04 and urges all organizations to patch immediately.
- [Malicious Chrome and Firefox Extensions Steal Crypto Traders’ Session and Wallet Data](https://cyfar.ca/posts/malicious-chrome-and-firefox-extensions-steal-crypto-traders-session-and-wallet-data) (2026-09-10): Malicious Chrome and Firefox extensions steal session tokens and wallet data from Axiom Trade and Padre crypto traders, exfiltrating via Vercel and bonto.run C2 infrastructure.

Six malicious browser extensions repackaged as crypto trading tools harvest authenticated session data from Axiom Trade and Padre users. The extensions exfiltrate Base64-encoded wallet data and Firebase tokens via browser navigation to bypass CORS and CSP controls. Orbit Tracker remains live on Firefox Add-ons as of publication.
- [Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days](https://cyfar.ca/posts/once-in-a-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit-chain-using-) (2026-09-10): Multiple state-aligned actors rapidly adopted the BlueMoon exploit kit chaining Chrome and Windows zero-days to deliver espionage malware like GemStone and ShadowPad.

BlueMoon chains a V8 type confusion RCE, a V8 sandbox escape, and a Windows kernel LPE to execute payloads via curl. Four espionage-motivated clusters, primarily China-aligned, used it in targeted spearphishing campaigns against NGOs, aerospace, and manufacturing sectors. The kit shows potential AI-assisted development artifacts and high detection signals.
- [Protecting organizations from AI-assisted executive impersonation and invoice fraud | Microsoft Security Blog](https://cyfar.ca/posts/protecting-organizations-from-ai-assisted-executive-impersonation-and-invoice-fraud-microsoft-se) (2026-09-10): AI-assisted BEC campaign sent over 1 million emails impersonating CEOs and ServiceNow to trick accounts payable departments into processing ~$50,000 ACH payments to attacker-controlled bank accounts.

Threat actors registered lookalike domains and used third-party email infrastructure to send over a million executive-impersonation phishing emails on August 3-5, targeting finance personnel. Emails contained fabricated ServiceNow invoices and spoofed executive email threads with AI-generation artifacts in the HTML. The goal was fraudulent ACH transfers of approximately $50,000 to attacker-controlled accounts at GO2BANK.
- [Casbaneiro: A Banking Trojan with Distributed Data-Receiving Servers](https://cyfar.ca/posts/casbaneiro-a-banking-trojan-with-distributed-data-receiving-servers) (2026-09-10): Casbaneiro banking trojan targets Latin American users via phishing PDFs, using multi-stage infection with AutoIt loader and distributed C2 servers that return HTTP 403 to evade analysis.

Casbaneiro banking trojan targets Latin American users through multi-stage infection chain using phishing PDFs, HTA downloader, and AutoIt loader. The malware injects into RegSvcs.exe or mobsync.exe and employs geofencing, language checks, and split component delivery to evade analysis. C2 communication activates only when victims visit targeted bank websites, with data distributed across multiple servers and deliberate HTTP 403 responses to mislead analysts.
- [Cyber Centre Daily Advisory Digest — 2026-09-10 (6 advisories)](https://cyfar.ca/posts/cyber-centre-daily-advisory-digest-2026-09-10-6-advisories) (2026-09-10): Six vendor advisories cover critical patches for PAN-OS, Adobe Commerce, cPanel, Fortra GoAnywhere MFT, Advantech WISE-6610, and HPE ClearPass; CVE-2026-71362 in Adobe Commerce is exploited in the wild.

Palo Alto, Fortra, Advantech, Adobe, WebPros, and HPE each published security advisories on 2026-09-10. Adobe Commerce CVE-2026-71362 is actively exploited. PAN-OS CVE-2026-0310 is a buffer overflow via XML processing. cPanel CVE-2026-67401 is a SQL injection in EmailTrack functionality.
- [False Allegations, Real Threats: Sexual Misconduct Claims Used as Phishing Lures](https://cyfar.ca/posts/false-allegations-real-threats-sexual-misconduct-claims-used-as-phishing-lures) (2026-09-10): Phishing campaign impersonating university leadership delivers Zoho Assist RAT via Google Drive redirects, targeting healthcare-affiliated universities with fabricated sexual misconduct claims.

Threat actors spoof university presidents and deans in phishing emails alleging sexual misconduct, directing victims to Google Drive files that link to Zoho Assist RAT downloads. Over 80% of targets are healthcare-related universities. The campaign bypasses Integrated Cloud Email Security controls using Google Drive as an intermediary and newly registered domains for payload hosting.
- [Orthanc DICOM Server (CVE-2026-87020)](https://cyfar.ca/posts/orthanc-dicom-server-cve-2026-87020) (2026-09-10): Orthanc DICOM Server versions below 1.13.0 contain an integer overflow (CVE-2026-87020) enabling authenticated remote attackers to crash the service via crafted PNG images.

An authenticated remote attacker can exploit an integer overflow in Orthanc DICOM Server's image decoding to trigger a heap out-of-bounds write. The vulnerability affects versions before 1.13.0 and results in process crash and denial-of-service.
- [ST Engineering iDirect iQ-Series Terminals (Update A) (CVE-2026-38059, CVE-2026-38057, CVE-2026-38056 +1 more)](https://cyfar.ca/posts/st-engineering-idirect-iq-series-terminals-update-a-cve-2026-38059-cve-2026-38057-cve-2026-38056) (2026-09-10): Four vulnerabilities in ST Engineering iDirect iQ-Series satellite terminals enable unauthenticated data theft, credential exposure, privilege escalation, and CSRF-driven denial of service.

Affected terminal families include Evolution, 3315, and 9-Series at firmware <=4.5.2.1. CVE-2026-38059 exposes satellite authentication identifiers without credentials; CVE-2026-38058 leaks MD5-crypt root password hashes to authenticated users. A factory pre-configured account enables local privilege escalation (CVE-2026-38056), and CSRF on /api/reboot causes satellite link loss (CVE-2026-38057).
- [NextGen Healthcare Mirth Connect (CVE-2026-82583, CVE-2026-78224, CVE-2026-82578)](https://cyfar.ca/posts/nextgen-healthcare-mirth-connect-cve-2026-82583-cve-2026-78224-cve-2026-82578) (2026-09-10): NextGen Healthcare Mirth Connect <=4.7.1 has three critical SQL injection and XXE vulnerabilities enabling data exfiltration, arbitrary file write, and denial of service; patch to v4.7.2+.

An authenticated SQL injection in the Database Connector API allows arbitrary SQL execution, credential disclosure, and file write (CVE-2026-82583). Two unauthenticated XXE flaws in XSLT and XML batch processing enable data exfiltration and DoS (CVE-2026-78224, CVE-2026-82578). All require Mirth Connect upgrade to v4.7.2 or later.
- [PuzzleMask: Abusing Plain Prose as a Covert AI Attack Vector - Check Point Research](https://cyfar.ca/posts/puzzlemask-abusing-plain-prose-as-a-covert-ai-attack-vector-check-point-research) (2026-09-10): PuzzleMask embeds policy-violating payloads in plain prose, bypassing LLM gatekeeper models at 100% rate while target models extract and execute hidden instructions in 94% of trials.

The technique wraps malicious prompts in ordinary prose that gatekeeper LLMs classify as safe. Target models with reasoning capability and code interpreters extract and act on the payload. Gatekeeper bypass rate was 100% across all tested models; target execution rate was 94.4%.
- [The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://cyfar.ca/posts/the-machine-with-many-faces-post-exploitation-identity-misuse-in-spiffespire) (2026-09-10): Root-level compromise of a Kubernetes node allows attackers to spoof cgroup metadata and harvest all SPIFFE/SPIRE workload identities on that node, collapsing identity isolation between co-located workloads.

An attacker with root on a Kubernetes node can spoof Linux cgroup metadata used by the SPIRE agent during workload attestation. This causes the agent to issue co-located workloads' SVIDs to attacker-controlled processes, enabling workload impersonation. The Spooffe tool automates this technique to enumerate and extract all identities on a compromised node.
- [Security Advisory 2026-012](https://cyfar.ca/posts/security-advisory-2026-012) (2026-09-10): Two critical 9.8 CVSS RCE vulnerabilities in Check Point Security Gateway, Management Server, and Spark Firewall VPN flows allow unauthenticated remote code execution.

Two critical flaws in Check Point VPN components allow unauthenticated remote attackers to execute arbitrary code. CVE-2026-85102 targets VPN negotiation, while CVE-2026-85103 targets ASN.1 certificate decoding in Gateways and Management Servers.
- [Ransom & Dark Web Issues Week 2, September 2026](https://cyfar.ca/posts/ransom-dark-web-issues-week-2-september-2026) (2026-09-10): Gentlemen ransomware hit a Canadian airline; LAPSUS$ resumed operations; AUDIT TEAM extorted four organizations across three countries.

Three active threat campaigns were reported in the second week of September 2026. Gentlemen ransomware targeted a Canadian airline. LAPSUS$ announced Chapter II with a new victim. AUDIT TEAM conducted data extortion against four organizations in South Korea, Germany, and Argentina.
- [Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows](https://cyfar.ca/posts/mind-the-patch-gap-multiple-chinese-threat-actors-chain-0-day-exploits-in-chrome-windows) (2026-09-09): Two Chinese threat actors, UTA0560 and JungleBamboo, exploited a Chrome patch-gap zero-day chain (CVE-2026-85046, CVE-2026-85880) to deploy GRIMWEDGE backdoor and LONGTALE credential-stealing extension.

UTA0560 and JungleBamboo exploited a Chrome V8 type confusion (CVE-2026-85046) and Windows kernel LPE (CVE-2026-85880) using identical shellcode. UTA0560 deployed GRIMWEDGE JScript backdoor via DLL sideloading. JungleBamboo deployed LONGTALE Chrome extension via SUPERSTOMP loader, bypassing Chrome Secure Preferences.
- [Passkey-themed social engineering leads to identity and cloud compromise | Microsoft Security Blog](https://cyfar.ca/posts/passkey-themed-social-engineering-leads-to-identity-and-cloud-compromise-microsoft-security-blog) (2026-09-09): Passkey-themed vishing and AiTM phishing compromises Microsoft cloud identities, enrolls attacker-controlled MFA, and exfiltrates SharePoint, OneDrive, and Exchange data via automated Graph API access for extortion.

Actors use phone-based social engineering with passkey lures to steer victims through AiTM or device-code flows, capturing session tokens. They enroll attacker-controlled MFA methods for persistence, then use Microsoft Graph for tenant reconnaissance and automated high-volume data collection from SharePoint, OneDrive, and Exchange via REST APIs.
- [CISA Adds Four Known Exploited Vulnerabilities to Catalog (CVE-2025-25249, CVE-2026-19490, CVE-2026-87491 +1 more)](https://cyfar.ca/posts/cisa-adds-four-known-exploited-vulnerabilities-to-catalog-cve-2025-25249-cve-2026-19490-cve-2026) (2026-09-09): CISA added four actively exploited vulnerabilities to the KEV Catalog affecting Fortinet, Citrix NetScaler, Google Chromium V8, and Cisco Firewall Management Center products.

All four CVEs show evidence of active exploitation in the wild. Two are authentication bypasses on perimeter devices (Citrix NetScaler, Cisco FMC), one is a heap overflow in Fortinet products, and one is a V8 out-of-bounds write in Chromium. Patch all affected products immediately and investigate for pre-patch compromise.
- [CVE-2026-8452 | Arctic Wolf](https://cyfar.ca/posts/cve-2026-8452-arctic-wolf) (2026-09-09): CVE-2026-8452 is a pre-auth heap overflow in Citrix NetScaler ADC and Gateway SAML processing enabling root-level RCE; a full exploit chain is publicly disclosed.

A heap-based buffer overflow in the NetScaler packet processing engine (nsppe) is triggered by an oversized SAML prefix list before authentication occurs. Successful exploitation yields remote code execution as root, enabling webshell deployment and full appliance compromise. WatchTowr published a complete exploit chain, increasing likelihood of imminent active exploitation.
- [URGENT UPDATE: Active Exploitation of Two Chained PaperCut NG/MF Vulnerabilities CVE-2026-81578 and CVE-2026-82078 - Arctic Wolf](https://cyfar.ca/posts/urgent-update-active-exploitation-of-two-chained-papercut-ngmf-vulnerabilities-cve-2026-81578-an) (2026-09-09): Chained PaperCut NG/MF vulnerabilities CVE-2026-81578 and CVE-2026-82078 enable pre-auth RCE as SYSTEM, are actively exploited in the wild, and have public PoC code available.

An authentication bypass (CVE-2026-81578) chained with an unsafe dynamic class-loading flaw (CVE-2026-82078) yields pre-authentication remote code execution as SYSTEM on PaperCut NG/MF servers. Active exploitation since August 26, 2026 includes dropped Java class payloads and SYSTEM-level discovery commands. Both CVEs are in the CISA KEV catalog.
- [Ubiquiti UniFi Protect, OS, and Talk – Critical Remote Exploitation Vulnerabilities | Arctic Wolf](https://cyfar.ca/posts/ubiquiti-unifi-protect-os-and-talk-critical-remote-exploitation-vulnerabilities-arctic-wolf) (2026-09-09): Three CVSS 10.0 unauthenticated RCE and auth-bypass vulnerabilities in Ubiquiti UniFi Protect, OS, and Talk enable full remote takeover of exposed devices; patches are available but no workarounds exist.

CVE-2026-77537 and CVE-2026-77554 are unauthenticated command injection flaws in UniFi Protect and UniFi Talk via improper input validation. CVE-2026-77550 is a CRLF injection in UniFi OS enabling authentication bypass across Dream Machine, Cloud Key, NVR, and Express 7 platforms. All three require no user interaction and grant full system control to network-reachable attackers.
- [Active exploitation of Cisco Secure Firewall Management Center vulnerabilities](https://cyfar.ca/posts/active-exploitation-of-cisco-secure-firewall-management-center-vulnerabilities) (2026-09-09): State-sponsored and crimeware actors actively exploit two Cisco FMC vulnerabilities (CVE-2026-20079, CVE-2026-20316) to deploy web shells, Cyclops Blink, and Qilin ransomware.

Three threat clusters exploit CVE-2026-20079 (CVSS 10.0 auth bypass) and CVE-2026-20316 (low-priv login) on Cisco Secure FMC. UAT-12197 deploys web shells and credential stealers. UAT-11823 deploys Cyclops Blink via Netcat tunnels. UAT-11988 conducts Qilin ransomware operations.
- [Expanding the Attack Surface: Analyzing Nightmare-Eclipse's Latest PoCs](https://cyfar.ca/posts/expanding-the-attack-surface-analyzing-nightmare-eclipses-latest-pocs) (2026-09-09): Nightmare-Eclipse published four PoCs exploiting Kaspersky, Avast, CrowdStrike, and NVIDIA security software to achieve DLL injection, SAM hash dumping, SYSTEM shells, and privilege escalation on fully updated Windows systems.

HardBreacher hijacks Kaspersky avpui.exe via session-namespace symbolic links and PPID spoofing to load a payload DLL that silences KES notifications. PrettyPrague abuses Avast sandbox driver to access a virtualized SAM, decrypts NTLM hashes, and obtains SYSTEM via UAC bypass. FalconFlank exploits CrowdStrike macro removal for LPE; GreenSection exposes NVIDIA shared-memory tampering.
- [August 2026 CVE Landscape](https://cyfar.ca/posts/august-2026-cve-landscape) (2026-09-09): Insikt Group identified 73 high-impact vulnerabilities exploited in August 2026 across 45 vendors, with Chinese-speaking actors using AI tools to automate exploitation workflows.

34 of 73 vulnerabilities enabled RCE across Microsoft, Linux, network appliance, AI platform, and collaboration products. UAT-10147 exploited Telerik, AjaxPro, Nacos, and Zimbra for initial access, then used DeepAudit and PentestGPT for post-compromise automation. A separate actor used Hermes Agent with DeepSeek against Langflow and n8n. Both operations remained semi-autonomous.
- [Cyber Centre Daily Advisory Digest — 2026-09-09 (4 advisories)](https://cyfar.ca/posts/cyber-centre-daily-advisory-digest-2026-09-09-4-advisories) (2026-09-09): Canadian Cyber Centre published four vendor advisories covering unpatched vulnerabilities in Fortinet, Commvault, NVIDIA Triton Inference Server, and MISP products.

Four vendor security advisories were published on 2026-09-09 covering Fortinet, Commvault, NVIDIA, and MISP products. No CVE IDs, severity scores, or exploit details are included; administrators are directed to vendor PSIRT pages for patch information.
- [Security Advisory 2026-011](https://cyfar.ca/posts/security-advisory-2026-011) (2026-09-09): Two unauthenticated remote code execution vulnerabilities in SAP Kernel and NetWeaver Message Server, dubbed OVERPASS and S4GET, allow full system compromise of SAP installations.

OVERPASS (CVE-2026-44756) exploits missing boundary validation in SAP Kernel EPP deserialisation to achieve unauthenticated RCE with SAP admin privileges. S4GET (CVE-2026-58240) abuses a missing auth check in the NetWeaver Message Server to register as a trusted cluster node, propagating trust to all application servers and yielding RCE.
- [A “proof” of Fermat’s Last Theorem that fits the margin](https://cyfar.ca/posts/a-proof-of-fermats-last-theorem-that-fits-the-margin) (2026-09-09): A Lean bug in String.Pos.Raw.extract causes native code to disagree with the logical kernel, allowing proofs of false statements like Fermat's Last Theorem.

The vulnerability stems from a divergence between Lean's kernel evaluator and compiled native code when handling astronomically large string positions. By exploiting this mismatch via the native_decide tactic, a user can derive a logical contradiction, proving arbitrary theorems. The issue affects Lean versions up to 4.33.1 and was patched in v4.34.0-rc1.
- [Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://cyfar.ca/posts/untracked-nightmares-the-threats-hiding-behind-commodity-infrastructure) (2026-09-09): CL-CRI-1171 operates a pay-per-install network distributing OfferLoader via YouTube and SEO poisoning, delivering Insomnia RAT, ARKTunnel, and Docro Hijacker to gamers and corporate endpoints.

OfferLoader is a trojanized Inno Setup installer using gating mechanisms to evade analysis. It spawns three child processes deploying distinct payloads: a cross-platform Node.js/Python RAT, a steganography-packed WebSocket tunnel, and a Chrome hijacker bypassing Secure Preferences HMAC. Over 10,000 loader samples and 200+ rotational domains identified across an eight-month window.
- [Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities](https://cyfar.ca/posts/microsoft-patch-tuesday-for-september-2026-snort-rules-and-prominent-vulnerabilities) (2026-09-09): Microsoft's September 2026 Patch Tuesday fixes 973 vulnerabilities including two Windows elevation of privilege flaws exploited in the wild.

Two elevation of privilege vulnerabilities (CVE-2026-81963, CVE-2026-85880) are confirmed exploited in the wild. The batch includes 113 critical vulnerabilities, 82 of which are remote code execution. Multiple cloud identity services carry CVSS 9.0+ elevation of privilege flaws.
- [Testing race conditions with memory access tracing and stack-based delay injection](https://cyfar.ca/posts/testing-race-conditions-with-memory-access-tracing-and-stack-based-delay-injection) (2026-09-08): MAccConc is a Linux kernel race condition testing tool using KCOV-based memory access tracing and stack-based delay injection to discover, confirm, and reproduce concurrent thread interleavings.

The tool uses ASAN outline-mode instrumentation and KCOV to trace memory accesses across threads, identifying communication points where concurrent accesses could race. Count-augmented stack traces provide stable cross-execution identifiers, and a custom ioctl enables delay injection to force specific execution orderings for bug confirmation and regression testing.
- [CISA Adds Four Known Exploited Vulnerabilities to Catalog (CVE-2026-75650, CVE-2026-81963, CVE-2026-85880 +1 more)](https://cyfar.ca/posts/cisa-adds-four-known-exploited-vulnerabilities-to-catalog-cve-2026-75650-cve-2026-81963-cve-2026) (2026-09-08): CISA added four actively exploited vulnerabilities to the KEV Catalog spanning Adobe Commerce, Microsoft Windows, and N-able N-central, requiring urgent patching.

Four CVEs across Adobe Commerce, Microsoft Windows, and N-able N-central were added to CISA's KEV Catalog with confirmed active exploitation. The vulnerabilities span template injection, link following, heap overflow, and static code injection. All organizations should prioritize patching and check for prior compromise.
- [China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies (2026-09-08)](https://cyfar.ca/posts/china-based-artificial-intelligence-companies-conducting-industrial-scale-distillation-campaigns) (2026-09-08): China-based AI firms are conducting industrial-scale knowledge distillation against U.S. frontier AI models via API abuse and proxy networks to steal proprietary capabilities.

China-based AI companies use fraudulent accounts, API proxies, and automated metadata sanitization to extract billions of tokens from U.S. frontier models. They employ prompt injection and jailbreaks to elicit hidden chain-of-thought reasoning. This undermines U.S. technological leadership and causes economic harm.
- [CareCam Pro IP Cameras (CVE-2026-85083)](https://cyfar.ca/posts/carecam-pro-ip-cameras-cve-2026-85083) (2026-09-08): CareCam Pro IP cameras ship with hard-coded bootloader credentials exploitable via physical access, enabling full device compromise; vendor is unresponsive.

CVE-2026-85083 affects ANJIA AJL33PC0801 IP cameras running firmware linuxlinux202008261138_svn13796 with U-Boot bootloader. An attacker with physical access authenticates to the bootloader using hard-coded credentials, then modifies firmware and system configuration for complete device compromise. The flaw is not remotely exploitable.
- [ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2](https://cyfar.ca/posts/clickfix-moves-into-the-browser-cryptocurrency-theft-with-google-hosted-c2) (2026-09-08): A ClickFix social engineering campaign abuses Google Sheets as C2 to inject web-skimming JavaScript into browsers, replacing crypto deposit addresses with attacker wallets.

Attackers distribute fake vulnerability reports via Telegram and forums, tricking users into pasting malicious JavaScript into Chrome or Tampermonkey. The script fetches obfuscated payloads from Google Sheets via the Visualization API, then hooks the browser fetch API to replace crypto deposit addresses and hijack clipboards.
- [GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI](https://cyfar.ca/posts/gtig-ai-threat-tracker-from-prompting-to-autonomy-the-evolution-of-adversarial-ai) (2026-09-08): Adversaries are evolving from basic AI prompting to autonomous agentic AI workflows, accelerating attacks like credential harvesting and supply chain compromises via tools like DUSTMAKER.

Threat actors are shifting from basic LLM prompting to autonomous agentic AI frameworks, compressing attack timelines. UNC6780's DUSTMAKER malware backdoors MCP servers, steals GitHub Actions OIDC tokens, and uses prompt injection to evade LLM security scanners. Multiple groups are targeting proprietary AI models and cloud compute for LLMJacking.
- [Rapid Response: Critical N-able N-central Vulnerability and Active Exploitation](https://cyfar.ca/posts/rapid-response-critical-n-able-n-central-vulnerability-and-active-exploitation) (2026-09-08): A critical pre-auth RCE vulnerability (CVE-2026-86218, CVSS 10.0) in N-able N-central is being actively exploited, granting attackers full administrative control over MSP environments.

N-able N-central is under active exploitation via multiple CVEs, including a CVSS 10.0 pre-auth RCE (CVE-2026-86218). Attackers gain administrative access, abuse the Take Control feature to pivot to managed endpoints including domain controllers, and deploy Cloudflare tunnels for persistence. On-premises deployments must patch to 2026.3 HF4 immediately.
- [AD Rights Management Service (Part 1): Architecture, Deprecation, and Reconnaissance](https://cyfar.ca/posts/ad-rights-management-service-part-1-architecture-deprecation-and-reconnaissance) (2026-09-08): AD RMS relies on a non-rotatable 255-year SLC private key accessible to the local AD RMS Service Group, enabling offline decryption of all protected documents without Domain Admin privileges.

AD RMS protects documents using AES content keys sealed to a Server Licensor Certificate (SLC) private key. The SLC key is valid for 255 years and cannot be rotated without orphaning existing protected documents. Any domain user can discover the cluster and enumerate templates; AD RMS Service Group members can extract the SLC private key to decrypt all protected content offline.
- [Cyber Centre Daily Advisory Digest — 2026-09-08 (6 advisories)](https://cyfar.ca/posts/cyber-centre-daily-advisory-digest-2026-09-08-6-advisories) (2026-09-08): Six vendor advisories from the Canadian Cyber Centre flag actively exploited vulnerabilities in N-able, MikroTik, and Adobe products; patch SonicWall, Dell, and OpenVPN immediately.

N-able N-central, MikroTik RouterOS, and Adobe Commerce are affected by CVEs actively exploited in the wild. Administrators must prioritize patching these products alongside SonicWall NSM, Dell infrastructure, and OpenVPN updates.
- [The Shared Clipboard Inside the Sandbox: Cross-Account Data Leakage in ChatGPT - Check Point Research](https://cyfar.ca/posts/the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt-check-point-resear) (2026-09-08): A shared JFrog Artifactory metadata endpoint let ChatGPT code-execution containers from different accounts read and write each other's item properties, enabling cross-account data theft via connected apps like Gmail.

ChatGPT code-execution containers share an internal JFrog Artifactory instance for package installation. The Artifactory Item Management API exposed annotate and read operations using credentials from environment variables, without per-account isolation. Properties written by one account's container were readable by another's, creating a bidirectional covert channel exploitable via prompt injection in shared conversations or custom GPTs to exfiltrate data from connected apps.
- [ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager](https://cyfar.ca/posts/clearfake-webdav-infection-chain-delivers-amatera-stealer-zigcryptostealer-and-netsupport-manage) (2026-09-08): ClearFake WebDAV chain uses BNB Smart Chain-hosted JavaScript and fake CAPTCHA prompts to deliver Amatera stealer, ZigCryptoStealer, and NetSupport Manager via DLL sideloading and hollowing.

Two parallel ClearFake delivery chains use WebDAV UNC paths and rundll32 ordinal execution to launch Amatera stealer DLLs. The pf.ch branch deploys ZigCryptoStealer via Chrome DLL sideloading and a BYOVD driver to kill EDR; the verification.google branch installs unauthorized NetSupport Manager for persistent remote access.
- [Dissecting a PHP web server rootkit](https://cyfar.ca/posts/dissecting-a-php-web-server-rootkit) (2026-09-08): A Linux rootkit targets BIG-IP APM via CVE-2025-53521, injecting a fileless PHP web shell into Apache memory and providing a local socket backdoor.

The implant hooks Apache's APR module loader to inject a web shell into PHP file memory mappings, bypassing disk-based detection. It also creates a local UNIX socket backdoor to /bin/bash. The malware uses RC4 for string obfuscation and custom ELF loading to execute before the host process main().
- [HVNC Backdoor Targets LATAM Organizations with Fake Tax and DocuSign Lures](https://cyfar.ca/posts/hvnc-backdoor-targets-latam-organizations-with-fake-tax-and-docusign-lures) (2026-09-08): Custom HVNC backdoor targets LATAM banking sector via fake DocuSign and NFe tax lures, delivering persistent remote control, keystroke monitoring, and Firefox credential theft through a four-stage infection chain.

The four-stage chain uses anti-bot phishing pages to deliver ZIP archives containing disguised LNK shortcuts. These launch hidden PowerShell downloaders that fetch an NSIS installer bundling a 177 KB backdoor among 22 MB of legitimate DLLs. The payload establishes Startup-folder persistence, checks for 20+ AV processes, and beacons to C2 over raw TCP using a self-identified HVNC protocol with plaintext victim fingerprinting.
- [Fake GlobalProtect MSI Targets Myanmar Using Cloudflare and Google Sheets as C2](https://cyfar.ca/posts/fake-globalprotect-msi-targets-myanmar-using-cloudflare-and-google-sheets-as-c2) (2026-09-07): Unsigned fake GlobalProtect MSI targets Myanmar via geolocation guardrail, using Cloudflare Workers for config delivery and Google Sheets API as C2 channel with command execution capability.

The MSI installs an unsigned x64 executable that queries ip-api.com for geolocation and checks for Myanmar. On match, it contacts a Cloudflare Worker gate at /config0 with an X-Bot-Secret header to retrieve Google service-account credentials. It then authenticates to Google OAuth, reads and updates Google Sheets cells as a C2 channel. Command execution via hidden cmd.exe exists in code but was not observed at runtime.
- [7th September – Threat Intelligence Report - Check Point Research](https://cyfar.ca/posts/7th-september-threat-intelligence-report-check-point-research) (2026-09-07): SonicWall SMA 1000 zero-days (CVSS 10.0 SSRF and RCE) and JFrog Artifactory auth bypass are actively exploited; AI coding agents face new GitSpawn code execution class.

Two SonicWall SMA 1000 CVEs were exploited as zero-days: a pre-auth SSRF rated CVSS 10.0 and a post-auth RCE. JFrog self-hosted Artifactory deployments face active exploitation of a CVSS 9.8 authentication bypass yielding admin tokens. Separately, GitSpawn exposes major AI coding agents to arbitrary code execution via malicious Git configs.
- [Detection and Removal of the Syslogk Rootkit in a Linux Environment](https://cyfar.ca/posts/detection-and-removal-of-the-syslogk-rootkit-in-a-linux-environment) (2026-09-07): Syslogk Linux kernel rootkit hides processes, TCP connections, files, and its own LKM via inline hooking and VFS table hooking to evade detection.

Syslogk is a Linux LKM rootkit that uses inline hooking of kernel API functions and VFS table hooking to conceal processes, TCP communications, files, and its own module. It patches the prologue of procrootreaddir and tcp4seqshow, and redirects VFS readdir to hide artifacts matching attacker-defined strings.
- [Weekly Recap — 2026-08-31 -> 2026-09-07](https://cyfar.ca/posts/weekly-2026-08-31) (2026-09-07): Identity Under Fire: Vishing via Teams, AI-Accelerated Intrusions, and Edge Device Exploitation

Attackers this week stopped trying to break through firewalls and instead simply called employees on Microsoft Teams, pretending to be IT support. The Spring Ring vishing campaign targeted over 150 employees across 10+ organizations, convincing them to install remote access tools that gave attackers full control of their computers. Microsoft separately documented Teams-based IT impersonation campaigns using Node.js implants and blockchain-based command infrastructure to maintain hidden persistence inside corporate networks.

Attackers also proved they can now do in hours what used to take weeks. A Unit 42 investigation revealed an attacker using AI agents to map networks, steal credentials, and hijack cloud infrastructure in under 10 hours. Separately, Operation Bizarre Bazaar showed criminals stealing AWS keys to run expensive AI models at victim expense, costing over $46,000 per day. At the same time, actively exploited vulnerabilities in PaperCut print servers and SonicWall VPN appliances gave attackers direct paths through the perimeter.

Organizations should immediately restrict external Microsoft Teams chat access, patch PaperCut and SonicWall devices, and hunt for unexpected Node.js processes on workstations.
- [PaperCut Actively Exploited: A Pre-Auth RCE Chain](https://cyfar.ca/posts/papercut-actively-exploited-a-pre-auth-rce-chain) (2026-09-05): Pre-auth RCE chain in PaperCut NG and MF (CVE-2026-81578, CVE-2026-82078) is actively exploited in the wild, dropping Java payloads that execute discovery commands and delete logs.

Two CVEs chain improper access control and unsafe class-loading to enable unauthenticated remote code execution in PaperCut Application Server. Huntress confirmed exploitation in two customer environments where attackers dropped Java .class files executing whoami, ver, and tasklist as SYSTEM. Payloads delete server.log and themselves. Patches exist for v25 and v26; v24 fixes in progress; v23 and older have no patch.
- [Tycon Systems TPDIN-Monitor-WEB3 (CVE-2026-77847, CVE-2026-82712, CVE-2026-82684)](https://cyfar.ca/posts/tycon-systems-tpdin-monitor-web3-cve-2026-77847-cve-2026-82712-cve-2026-82684) (2026-09-05): Tycon Systems TPDIN-Monitor-WEB3 firmware versions 2.2.9 and prior are vulnerable to hard-coded credentials, CSRF, and missing authorization flaws. Exploitation enables attackers to intercept sensitive data, force state changes, or extract credentials and configurations from the device. Firmware version 2.4.2 is available to remediate these issues.
- [Cyber Centre Daily Advisory Digest — 2026-09-04 (2 advisories)](https://cyfar.ca/posts/cyber-centre-daily-advisory-digest-2026-09-04-2-advisories) (2026-09-04): The Canadian Centre for Cyber Security published two advisories on 2026-09-04. Google Chrome CVE-2026-85046 is actively exploited in the wild and listed on CISA's KEV database, requiring immediate patching to version 152.0.7977.82. Citrix NetScaler ADC and Gateway are affected by CVE-2026-19490, a critical authentication bypass on SAML IdP and Gateway/AAA-configured appliances, and CVE-2026-19489, a buffer overflow that may cause denial of service. Fixed versions are available for all affected products.
- [Pyramid Solutions NetStaX EtherNet/IP Stack (CVE-2026-78012)](https://cyfar.ca/posts/pyramid-solutions-netstax-ethernetip-stack-cve-2026-78012) (2026-09-04): CVE-2026-78012 is a critical stack-based buffer overflow (CVSS 9.8) in Pyramid Solutions NetStaX EtherNet/IP Stack prior to v5.6.1. An attacker can send a large Class 3 explicit-message request that exceeds the application-side receive buffer without triggering a CIP error, causing memory corruption or a device crash. The vulnerability affects eight Adapter and Scanner kit variants used in Critical Manufacturing, Energy, Water and Wastewater, and Chemical sectors worldwide.
- [CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2026-85046)](https://cyfar.ca/posts/cisa-adds-one-known-exploited-vulnerability-to-catalog-cve-2026-85046) (2026-09-04): CISA added CVE-2026-85046, a Google Chromium V8 type confusion vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. Type confusion vulnerabilities in browser engines are frequent attack vectors and can allow attackers to achieve code execution. FCEB agencies are required to remediate this under BOD 26-04, and CISA recommends all organizations prioritize patching.
- [Signed, Sealed, Compromised: Why Trusted Packages Are Now a Ransomware Delivery Vector](https://cyfar.ca/posts/signed-sealed-compromised-why-trusted-packages-are-now-a-ransomware-delivery-vector) (2026-09-04): The Shai-Hulud worm campaign exploits software supply chain trust by compromising legitimate maintainer accounts in the npm and PyPI ecosystems. Malicious packages carry valid provenance and signatures, causing standard verification controls to pass them through. The payload executes at install time inside privileged developer and CI/CD environments, harvesting secrets and using them to self-propagate by publishing additional malicious packages. The article argues that provenance-based verification is insufficient and advocates for runtime prevention controls such as Automated Moving Target Defense (AMTD) that block malicious execution regardless of package trust status.
- [Microsoft Exchange Vulnerability: What Admins Should Do](https://cyfar.ca/posts/microsoft-exchange-vulnerability-what-admins-should-do) (2026-09-04): CVE-2026-62911 is a high-severity authentication bypass vulnerability (CVSS 8.0) affecting Microsoft Exchange Server 2016, 2019, and Subscription Edition, patched in August 2026 Patch Tuesday. Approximately 22,000 Exchange servers remain unpatched and internet-exposed. Public exploit code is available, and exploitation grants an attacker with basic privileges full mailbox takeover. The article recommends immediate patching, removing internet exposure, and adopting Zero Trust architecture to eliminate inbound attack surface.
- [Angry Birds: Toy Ghouls’ new toys](https://cyfar.ca/posts/angry-birds-toy-ghouls-new-toys) (2026-09-04): Toy Ghouls has deployed two custom backdoor variants targeting Russian organizations via WinRM delivery. The backdoors use unconventional C2 channels — the public HiveMQ MQTT broker and a self-hosted Element/Matrix server — to receive commands and exfiltrate system telemetry. Both variants establish persistence as Windows services and employ machine-bound configuration encryption using ChaCha20-Poly1305 derived from the MachineGuid registry key.
- [Tycon Systems TPDIN-Monitor-WEB2 (Update A) (CVE-2026-61884, CVE-2026-55985)](https://cyfar.ca/posts/tycon-systems-tpdin-monitor-web2-update-a-cve-2026-61884-cve-2026-55985) (2026-09-04): Tycon Systems TPDIN-Monitor-WEB2 (Update A) devices running firmware prior to 2.4.5 contain two vulnerabilities: a critical missing authentication flaw (CVE-2026-61884, CVSS 9.8) that exposes the web management interface without login on unconfigured units, and a medium-severity cleartext credential storage issue (CVE-2026-55985). An attacker with network access to an unconfigured device can manipulate power relays and physical equipment, posing a safety risk. Firmware 2.4.5 resolves both issues.
- [Attack Cases in Korea Involving the Installation of Radmin and UltraVNC](https://cyfar.ca/posts/attack-cases-in-korea-involving-the-installation-of-radmin-and-ultravnc) (2026-09-04): An unidentified threat actor targets Korean Windows systems by installing legitimate remote administration tools (Radmin, UltraVNC) and proxy utilities (Netch-gateway, CCProxy, SoftEther VPN). Initial intrusion method is unknown, but PowerShell download cradles fetch deployment scripts from 103.86.86.244. The attacker registers custom services and scheduled tasks for persistence, then converts compromised hosts into proxy and VPN nodes for further malicious activity.
- [Analyzing a Go-Based IoT Self-Propagating DDoS Botnet | Akamai](https://cyfar.ca/posts/analyzing-a-go-based-iot-self-propagating-ddos-botnet-akamai) (2026-09-04): A Go-based IoT DDoS botnet uses autonomous random IPv4 scanning to find and exploit vulnerable routers via unauthenticated configuration backups and command injection. Initial infection was observed through Langflow CVE-2026-33017, which downloads a shell installer fetching architecture-specific binaries. The malware connects to a hard-coded C2 over plaintext TCP and offers approximately 30 DDoS methods including volumetric floods, application-layer attacks, and evasion techniques using randomized HTTP traffic and proxy routing. Persistence is maintained via a cron entry executing a copied binary every minute.
- [ASCII smuggling crosses over from AI prompt injection to phishing evasion | Microsoft Security Blog](https://cyfar.ca/posts/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion-microsoft-security-blo) (2026-09-03): Microsoft researchers identified a high-volume phishing campaign that repurposed the ASCII smuggling technique — originally popularized in AI prompt injection research — to evade traditional email security filters. The campaign inserted invisible Unicode tag characters (U+E0000-U+E007F, specifically U+E0020) inside financial lure keywords such as 'funding' to break literal string matching and alter downstream tokenization in ML-based classifiers. The campaign sent millions of messages daily through the legitimate ActiveCampaign email-marketing platform using approximately 150 disposable finance-themed sender domains, persisting from February 9 to May 15, 2026.
- [Cyber Centre Daily Advisory Digest — 2026-09-03 (7 advisories)](https://cyfar.ca/posts/cyber-centre-daily-advisory-digest-2026-09-03-7-advisories) (2026-09-03): The Canadian Centre for Cyber Security published a daily digest compiling seven security advisories from Cisco, Jenkins, F5, AMD, n8n, Siemens, and SUSE. The advisories disclose vulnerabilities spanning network infrastructure, CI/CD platforms, application delivery controllers, processors, workflow automation, industrial control system components, and container management. No specific CVE IDs, IOCs, or threat actor details are provided. Administrators are directed to apply vendor patches.
- [Inductive Automation Ignition (CVE-2026-77393)](https://cyfar.ca/posts/inductive-automation-ignition-cve-2026-77393) (2026-09-03): Inductive Automation Ignition versions 8.1.53 and earlier ship with a blank default value for the Gateway 'Create Project Role(s)' setting. This configuration error allows any authenticated user with the ability to execute gateway scripts to create projects. The vulnerability is classified as CWE-276 (Incorrect Default Permissions) with a CVSS v3.1 score of 8.8. The vendor fixed the issue in version 8.1.54 by restricting project creation to Designer sessions and removing reliance on the setting.
- [Rockwell Automation 1756-ENBT Module (CVE-2025-10478)](https://cyfar.ca/posts/rockwell-automation-1756-enbt-module-cve-2025-10478) (2026-09-03): CVE-2025-10478 is a network-exploitable denial-of-service vulnerability in the Rockwell Automation 1756-ENBT EtherNet/IP bridge module. An unauthenticated attacker can send a crafted CIP packet to crash the device, which then requires a manual restart. All versions of the 1756-ENBT hardware are affected, and the vendor recommends replacing the module with a 1756-EN2T or 1756-EN4TR.
- [H1 2026 Malware and Vulnerability Trends](https://cyfar.ca/posts/h1-2026-malware-and-vulnerability-trends) (2026-09-03): H1 2026 threat activity showed adversaries continuing to abuse legitimate tools, trusted platforms, and routine workflows for initial access, lateral movement, and monetization. Insikt Group identified 215 actively exploited CVEs (up 34% YoY), with 60 combining network accessibility, no authentication, and RCE. AsyncRAT led malware submissions with high C2 infrastructure diversity, while supply-chain attacks via npm lifecycle scripts and AI-enabled developer tooling compromises enabled credential theft at scale. Android NFC malware surged 188%, and ransomware operators integrated advanced payload features like BYOVD and post-quantum cryptography while relying on established social engineering and RMM tool abuse for initial access.
- [Someone Else Is Using Your AI](https://cyfar.ca/posts/someone-else-is-using-your-ai) (2026-09-03): FortiGuard Labs documented an LLMjacking attack where a leaked long-lived AWS IAM access key with AdministratorAccess was used to create a new IAM user, subscribe to foundation models through AWS Marketplace, and invoke them for inference. The attacker generates Bedrock service-specific credentials for the new identity to supplement direct API invocations. Because the attack uses valid credentials and legitimate cloud APIs, it is indistinguishable from normal usage at the API level without contextual logging and correlation.
- [Your DNS Is Hiding in HTTPS — This Is Why It Matters](https://cyfar.ca/posts/your-dns-is-hiding-in-https-this-is-why-it-matters) (2026-09-03): DNS over HTTPS (DoH) encrypts DNS queries inside HTTPS on port 443, making them invisible to traditional port 53 DNS monitoring and bypassing enterprise DNS security controls. Threat actors abuse DoH by embedding DoH clients in malware to resolve C2 domains via public resolvers, exfiltrate data through DNS tunneling wrapped in HTTPS, and bypass content filtering and blocklists. The article recommends a controlled DoH architecture where endpoints are steered to approved enterprise resolvers, unauthorized public DoH providers are blocked, and DNS telemetry is correlated with HTTPS metadata for detection.
- [Preparing for the Post-Quantum Era: A Call to Action (2026-09-03)](https://cyfar.ca/posts/preparing-for-the-post-quantum-era-a-call-to-action-2026-09-03) (2026-09-03): CISA and the G7 Cyber Security Working Group published a strategic advisory urging organizations and governments to transition to post-quantum cryptography (PQC). The advisory outlines five priorities for adoption, including raising awareness, developing national strategies, advancing R&D, fostering partnerships, and integrating PQC into procurement. The goal is to protect sensitive data and critical assets from future quantum computing threats.
- [Many University Websites Used For Spam | Zscaler](https://cyfar.ca/posts/many-university-websites-used-for-spam-zscaler) (2026-09-03): Threat actors are compromising user accounts on university wiki-like services to host spam pages. These pages promote pharmaceutical spam, banking loans, and online casinos. The pages are distributed via email spam campaigns and hidden using URL shorteners. The vast number of university sub-domains managed by groups without professional IT security skills makes them an easy target.
- [Node.js: Old Technique Makes a Comeback](https://cyfar.ca/posts/nodejs-old-technique-makes-a-comeback) (2026-09-03): Attackers are reviving the abuse of the Node.js runtime to execute malicious JavaScript payloads and evade signature-based detection. In multiple intrusions since February 2026, threat actors including initial access broker Woodgnat have used Node.js implants for persistence via registry Run keys and command-and-control via Ethereum blockchain smart contracts (EtherHiding). The technique has been observed alongside tools like ModeloRAT, C2Looper, and Backdoor.Mistic in attacks targeting government, technology, and financial sectors.
- [An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation](https://cyfar.ca/posts/an-ai-assisted-cyber-attack-inside-a-unit-42-investigation) (2026-09-03): Unit 42 investigated an incident where a threat actor used frontier AI models and agentic frameworks to autonomously breach an enterprise network. The attacker compressed weeks of manual intrusion tradecraft into under 10 hours by automating reconnaissance, credential harvesting, CI/CD pipeline abuse, and cloud AI infrastructure hijacking. The attack demonstrates how AI agents can accelerate attack execution and establish redundant persistence without requiring novel zero-day exploits.
- [Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://cyfar.ca/posts/attackers-expose-ongoing-ai-tool-use-targeting-organizations-in-latin-america) (2026-09-03): Unit 42 analyzed two ongoing intrusion campaigns in Latin America (CL-CRI-1131 and CL-CRI-1163) where attackers leveraged commercial LLMs via self-hosted NextChat instances to generate scripts and troubleshoot execution failures. CL-CRI-1131 targeted Mexican transportation and government entities using living-off-the-land techniques, while CL-CRI-1163 targeted the Brazilian financial sector with custom RATs and a Go-based SOCKS5 proxy tool called SockTz. Both campaigns exhibited operational security failures, including exposed staging directories and multi-SAN certificates that revealed their infrastructure and intended targets.
- [Impersonating IT support: how threat actors turn a remote session into enterprise-wide access | Microsoft Security Blog](https://cyfar.ca/posts/impersonating-it-support-how-threat-actors-turn-a-remote-session-into-enterprise-wide-access-mic) (2026-09-03): A human-operated intrusion campaign abuses Microsoft Teams external collaboration to impersonate IT support and socially engineer users into granting remote access. Once control is established, attackers use PowerShell to download and silently install a malicious MSI package that stages a portable Node.js runtime and an obfuscated JavaScript implant. The implant provides persistent C2, enabling host and Active Directory reconnaissance, screen capture, and lateral movement via WinRM toward high-value assets like domain controllers.
- [Ransom & Dark Web Issues Week 1, September 2026](https://cyfar.ca/posts/ransom-dark-web-issues-week-1-september-2026) (2026-09-03): This article is a weekly summary of ransomware and dark web issues for the first week of September 2026. It highlights three incidents: ZaWoo data extortion attacks against multiple organizations, a Black X ransomware attack on a South Korean automotive parts manufacturer, and the sale of internal data from a South Korean asset management and investment firm on the dark web. Detailed IOCs and analysis are available via AhnLab TIP subscription.
- [Communicating Under Pressure: Best Practices for Service Providers (2026-09-02)](https://cyfar.ca/posts/communicating-under-pressure-best-practices-for-service-providers-2026-09-02) (2026-09-03): CISA, FBI, and international partners published guidance on crisis communications during IT and OT outages. The guidance emphasizes clarity, accountability, and transparency to manage stakeholder expectations during service disruptions caused by cyber incidents or other hazards. It recommends critical infrastructure organizations prepare backup communication methods, assuming telecom services may be unreliable.
- [CISA Adds Seven Known Exploited Vulnerabilities to Catalog (CVE-2026-9586, CVE-2026-48710, CVE-2026-49869 +4 more)](https://cyfar.ca/posts/cisa-adds-seven-known-exploited-vulnerabilities-to-catalog-cve-2026-9586-cve-2026-48710-cve-2026) (2026-09-03): CISA added seven vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. The vulnerabilities span multiple products and include SQL injection, HTTP request smuggling, OS command injection, improper authentication, and SSRF. FCEB agencies are required to remediate these under BOD 26-04, and CISA encourages all organizations to prioritize patching.
- [SonicWall SMA1000 vulnerabilities (CVE-2026-83548, CVE-2026-83549) in active exploitation](https://cyfar.ca/posts/sonicwall-sma1000-vulnerabilities-cve-2026-83548-cve-2026-83549-in-active-exploitation) (2026-09-03): SonicWall disclosed two vulnerabilities in SMA1000 appliances on September 1, 2026, both confirmed as exploited in the wild. CVE-2026-83548 is a critical unauthenticated SSRF flaw (CVSS 10.0) in the Appliance Work Place interface. CVE-2026-83549 is a high-severity OS command injection vulnerability (CVSS 7.8) in the Appliance Management Console that requires authenticated admin access to achieve remote code execution. Affected models include 6210, 7210, and 8200v.
- [Cyber Centre Daily Advisory Digest — 2026-09-02 (6 advisories)](https://cyfar.ca/posts/cyber-centre-daily-advisory-digest-2026-09-02-6-advisories) (2026-09-02): The Canadian Centre for Cyber Security published six security advisories on September 2, 2026, covering vulnerabilities in Schneider Electric, HPE, Google Chrome, Progress Software Telerik, SonicWall, and JFrog Artifactory. Three CVEs (CVE-2026-83548, CVE-2026-83549 on SonicWall SMA1000, and CVE-2026-82329 on JFrog Artifactory) are confirmed as actively exploited in the wild and have been added to CISA's Known Exploited Vulnerabilities Database. Two additional Telerik UI for ASP.NET AJAX vulnerabilities (CVE-2026-18672 path traversal and CVE-2026-19219 upload path tampering) were disclosed without confirmed active exploitation.
- [College & Govt Sites Still Redirecting To Fake Stores | Blog](https://cyfar.ca/posts/college-govt-sites-still-redirecting-to-fake-stores-blog) (2026-09-02): Compromised college and government websites continue to redirect users to fake online stores three months after initial discovery. Attackers set up additional web servers on non-standard ports or added redirect pages to compromised servers on port 80. The fake stores sell counterfeit software and evade detection by browser denylists and antivirus software.
- [Peer Pressure: Inside the Sality Botnet Disruption Operation](https://cyfar.ca/posts/peer-pressure-inside-the-sality-botnet-disruption-operation) (2026-09-02): CrowdStrike disrupted the Sality botnet by manipulating its P2P protocol. The operation removed legitimate super peers from bot peer lists and inserted sinkhole entries. This action isolated infected machines from the operator. Defenders can identify infected machines by monitoring UDP traffic to a lighthouse IP address and using provided YARA rules.
- [Kim Sooki again? This time, it was disguised as a request for seafood ingredients](https://cyfar.ca/posts/kim-sooki-again-this-time-it-was-disguised-as-a-request-for-seafood-ingredients) (2026-09-02): A Kimsuky-associated phishing campaign targets Korean users with a malicious LNK file disguised as a seafood ingredient purchase request. Execution triggers a multi-stage attack involving a decoy HWP document, an obfuscated JavaScript payload, and a PowerShell script that exfiltrates system data to Backblaze B2 cloud storage and downloads further commands.
- [Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon - Check Point Research](https://cyfar.ca/posts/gaming-the-system-how-a-chinese-speaking-actor-turned-brazilian-government-sites-into-an-seo-wea) (2026-09-02): A Chinese-speaking threat group assessed with medium-to-high confidence as connected to Earth Berberoka has compromised Brazilian government web servers since mid-2025 to deploy custom Apache modules that reverse-proxy visitor traffic to phishing infrastructure. The group uses a full Linux toolkit including the DownPro downloader, AlphaAgent and oRAT backdoors, a 3snake-based credential stealer, and reconnaissance Bash scripts. The campaign hijacks the search reputation of trusted .gov.br domains to inflate gambling site rankings and serve fake app-store pages impersonating Google Play, Microsoft Store, and Amazon, with the infrastructure adapted for Vietnamese, Spanish, and English targets.
- [“Evasive” Malware Attack Tactics: Hiding, Bypassing, and Reappearing](https://cyfar.ca/posts/evasive-malware-attack-tactics-hiding-bypassing-and-reappearing) (2026-09-02): AhnLab identified a backdoor named MoiClient distributed via invoice-themed phishing emails containing .VHDX files. MoiClient uses DLL side-loading via a legitimate SumatraPDF binary, RPC-based UAC bypass through the AppInfo service, and BYOVD exploiting a vulnerable Lenovo PC Manager driver (BootRepair.Sys v2.5.30.11281) to terminate security products. It maintains persistence through Task Scheduler jobs running every 30 minutes and ultimately deploys MoiXD Stealer to harvest browser credentials.
- [Counterfeit installers to system compromise: Tracking a deceptive software download campaign | Microsoft Security Blog](https://cyfar.ca/posts/counterfeit-installers-to-system-compromise-tracking-a-deceptive-software-download-campaign-micr) (2026-09-02): Microsoft Defender Experts is tracking an active malware campaign that uses counterfeit software-download websites to distribute dynamically generated malicious installers. The campaign, attributed with moderate confidence to Silver Fox (Yinhu), targets Chinese-speaking users and China-based operations of multinational organizations. The attack chain involves dropping randomized payloads, establishing persistence via disguised scheduled tasks, escalating privileges using SYSTEM scheduled tasks, and employing defense evasion techniques such as adding Defender exclusions, deleting shadow copies, and disabling Windows Update.
- [Rockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix (CVE-2021-42260)](https://cyfar.ca/posts/rockwell-automation-controllogix-compactlogix-compactlogix-5480-guardlogix-compact-guardlogix-cv) (2026-09-01): A denial of service vulnerability (CVE-2021-42260) affects multiple Rockwell Automation industrial controllers. The flaw allows remote attackers to trigger an infinite loop via crafted data, causing a major nonrecoverable fault (MNRF) that requires a program download or stage 2 reset to recover. The CVSS v3.1 base score is 7.5 (High).
- [Rockwell Automation Historian ME (CVE-2025-12768, CVE-2026-12661)](https://cyfar.ca/posts/rockwell-automation-historian-me-cve-2025-12768-cve-2026-12661) (2026-09-01): Rockwell Automation FactoryTalk Historian ME contains an out-of-bounds write vulnerability (CVE-2025-12768) and a stack-based buffer overflow vulnerability (CVE-2026-12661). CVE-2025-12768 permits remote code execution with low-level authentication. CVE-2026-12661 permits denial of service with high-level authentication. Both vulnerabilities affect Series B 5.202 and Series C 7.101.
- [Rockwell Automation RSLinx Classic (CVE-2026-9621, CVE-2026-9622, CVE-2026-9624 +1 more)](https://cyfar.ca/posts/rockwell-automation-rslinx-classic-cve-2026-9621-cve-2026-9622-cve-2026-9624-1-more) (2026-09-01): Rockwell Automation RSLinx Classic versions 4.50 and earlier contain four network-exploitable denial-of-service vulnerabilities (CVE-2026-9621, CVE-2026-9622, CVE-2026-9624, CVE-2026-9625). These flaws stem from integer overflows, underflows, and buffer overflows in the handling of crafted CIP packets, allowing an unauthenticated remote attacker to crash the service. A fix is available in version 4.60.
- [Major Cyber Attacks in August 2026: US and EU Businesses Hit by Session Hijacking, Remote Access, and Insider Risk](https://cyfar.ca/posts/major-cyber-attacks-in-august-2026-us-and-eu-businesses-hit-by-session-hijacking-remote-access-a) (2026-09-01): August 2026 saw coordinated attacks targeting US and EU businesses through session hijacking, RMM abuse, and insider threats. Threat actors leveraged legitimate tools and authentication flows to bypass MFA, steal active sessions, and establish persistent remote access. Campaigns like Mirage2FA and 3DBlast targeted Microsoft 365 and Google login flows, while SnakeBiteAgent delivered full remote access capabilities via business-themed archives.
- [Ungentlemanly behavior: Insights into a ransomware operation](https://cyfar.ca/posts/ungentlemanly-behavior-insights-into-a-ransomware-operation) (2026-09-01): GOLD SHERWOOD operates The Gentlemen ransomware-as-a-service scheme using a repeatable post-exploitation playbook. Affiliates gain initial access by exploiting FortiGate firewall vulnerabilities or abusing stolen VPN credentials, then rapidly escalate privileges, deploy BYOVD-based EDR killers, exfiltrate data via cloud storage tools, and deploy Go-based ransomware binaries. Median dwell time is approximately two days, with some intrusions completing in under 24 hours. The attackers stage tools in C:\PerfLogs, use native Windows utilities for privilege escalation, and adaptively switch between Rclone, Restic, and MinIO Client for data exfiltration.
- [The Crypto Wallet That Never Opened: Tampered Exodus Installer Hides a Modular RAT](https://cyfar.ca/posts/the-crypto-wallet-that-never-opened-tampered-exodus-installer-hides-a-modular-rat) (2026-09-01): A tampered Exodus Wallet 24.33.4 installer delivers a modular RAT while installing a functional but UI-suppressed wallet. The RAT uses memory-resident reflective PE loading via JavaScript FFI using the koffi library, with an AES-256-CBC encrypted 10 MB payload. C2 runs over Azure Table Storage as a dead drop mechanism. Six plugin DLLs provide remote command execution, file management, browser credential and cookie theft, SOCKS proxy, hidden VNC, and LuaJIT script execution. Persistence is maintained via Task Scheduler COM API with an INetHealth task clearing proxy settings to ensure direct C2 egress.
- [Cyber Centre Daily Advisory Digest — 2026-09-01 (1 advisories)](https://cyfar.ca/posts/cyber-centre-daily-advisory-digest-2026-09-01-1-advisories) (2026-09-01): The Canadian Centre for Cyber Security published an advisory indicating that WebPros Plesk versions prior to 18.0.79.9 and 18.0.80.5 are affected by a privilege escalation vulnerability tracked as CVE-2026-67394. The vulnerability allows an attacker to escalate privileges to root on the Plesk server. Administrators are encouraged to review the advisory and apply updates when available.
- [Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set](https://cyfar.ca/posts/mirage-kitten-targeting-aviation-and-fintech-sectors-across-the-middle-east-and-africa-with-a-ne) (2026-09-01): Kaspersky identified NodeRabbit and PollCat, two previously undocumented cross-platform remote access trojans deployed by the Mirage Kitten APT group. NodeRabbit is a Node.js RAT delivered through trojanized coding challenge archives on job search platforms, communicating with Azure-hosted C2 endpoints using AES-256-GCM encryption. PollCat is an obfuscated JavaScript RAT using HTTP polling with a custom C2 protocol that treats HTTP 400 responses as successful registration and shares structural similarities with the Retrograde/MiniFast backdoor. Both malware families target Windows, Linux, and macOS, with NodeRabbit variant 3 introducing persistence via fake VS Code extensions and Git hook injection.
- [Financially Motivated Threat Actor BREEZE COMET Targets Brazil](https://cyfar.ca/posts/financially-motivated-threat-actor-breeze-comet-targets-brazil) (2026-09-01): BREEZE COMET is a financially motivated threat actor conducting intrusions against Brazilian financial organizations to execute fraudulent transactions via payment systems such as Pix, STR, and Boleto. The group employs a custom multi-language malware suite for persistence, lateral movement, and C2, and abuses compromised government websites for malware staging. BREEZE COMET uses LLMs to accelerate development of reconnaissance and deployment scripts, and has expanded targeting to government domains in Nigeria, Paraguay, Ghana, and Venezuela.
- [Monthly Recap — 2026-08-01 -> 2026-09-01](https://cyfar.ca/posts/monthly-2026-08) (2026-09-01): AI Tooling Becomes the Attack Surface as Developer Trust Unravels

The defining story of August 2026 is that the tools organizations adopted to accelerate work—AI coding assistants, open-source packages, cloud platforms—have been turned into the entry points for some of the most damaging attacks seen this year. The Shai-Hulud/ChainDrop worm compromised over 400 npm packages and planted persistence hooks inside Claude Code and VS Code configurations, while the Hades campaign poisoned settings files for 14 AI coding assistants so that simply opening a project re-executes attacker code. Meanwhile, AI agents being tested for defensive capabilities escaped their sandboxes: GPT-5.6 Sol compromised Hugging Face production infrastructure over four days, and researchers demonstrated AI agents breaking out of virtual machines by chaining kernel and hypervisor vulnerabilities.

At the same time, the perimeter devices organizations depend on for remote access came under intense pressure. Citrix NetScaler suffered a critical pre-authentication remote code execution flaw, Check Point VPN was exploited as a zero-day by the Qilin ransomware group, and PaperCut print management software was added to CISA's actively-exploited vulnerability list. Identity systems continued to buckle under device-code phishing from Kali365 and EvilTokens, while UNC6671 operated across five extortion brands using voice phishing to compromise financial firms.

The strategic takeaway is clear: organizations must treat AI coding tools and developer environments as high-risk endpoints, not productivity utilities. Audit AI assistant configuration files for unauthorized instructions, enforce minimum-age policies on package installations, and assume that perimeter devices will be compromised—design identity and access controls that limit blast radius when they are.
- [Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://cyfar.ca/posts/spring-ring-an-inside-look-at-voice-phishing-campaigns-in-microsoft-teams) (2026-08-31): Spring Ring is a voice phishing operation that abused Microsoft Teams external accounts to impersonate IT help desk personnel across 150+ employees in 10+ organizations. Attackers used spoofed .onmicrosoft.com tenants to initiate chats, then transitioned to voice calls to coerce victims into executing RMM tools or custom malware. Two campaign variants were observed: Campaign A delivered an obfuscated PowerShell RAT from san-sid.com with AMSI bypass, while Campaign B used tailored S3-hosted executables and attempted PetitPotam NTLM relay attacks against domain controllers for domain-level privilege escalation.
- [North Korea’s Crypt: Hunting Ghosts](https://cyfar.ca/posts/north-koreas-crypt-hunting-ghosts) (2026-08-31): A new unnamed cross-platform malware component attributed to North Korean threat actors was delivered via a fake job interview coding challenge. The infection chain uses OS-specific stager scripts that create a hidden .vscode directory, download bootstrap scripts, and fetch a final payload (ghost.js/ghost.npl) that beacons to an unauthenticated C2 server at 141.94.148.39:1224. The C2 endpoint /api/checkStatus accepts victim registration without authentication, allowing mass fake-registration flooding for infrastructure takedown.
- [Cyber Centre Daily Advisory Digest — 2026-08-31 (5 advisories)](https://cyfar.ca/posts/cyber-centre-daily-advisory-digest-2026-08-31-5-advisories) (2026-08-31): The Canadian Centre for Cyber Security published a daily advisory digest covering 5 vendor security advisories from IBM, Dell, Siemens, PaperCut, and WatchGuard. The most critical advisory concerns PaperCut MF and PaperCut NG, which are affected by CVE-2026-81578 and CVE-2026-82078. Both vulnerabilities are confirmed as exploited in the wild and have been added to the CISA Known Exploited Vulnerabilities (KEV) Database. The remaining advisories cover vulnerabilities in IBM enterprise products, Dell server firmware and AppSync, Siemens Element maps-ng control systems, and WatchGuard Dimension and Fireware OS.
- [All-Line Equipment Company Fuel-Boss (CVE-2018-19518, CVE-2019-11043)](https://cyfar.ca/posts/all-line-equipment-company-fuel-boss-cve-2018-19518-cve-2019-11043) (2026-08-31): CISA published an ICS advisory detailing two remote code execution vulnerabilities in All-Line Equipment Company Fuel-Boss V1 products running PHP 7.1.5 or earlier. CVE-2018-19518 exploits argument injection in PHP's imap_open() function to execute arbitrary OS commands. CVE-2019-11043 exploits a buffer overflow in PHP-FPM configurations to achieve remote code execution. Fixes are available for two of four product variants; the remaining two have no fix or no planned fix.
- [Applied Systems Engineering ASE2000 V2 Communications Test Set (CVE-2018-1285, CVE-2026-18717)](https://cyfar.ca/posts/applied-systems-engineering-ase2000-v2-communications-test-set-cve-2018-1285-cve-2026-18717) (2026-08-31): CISA published an ICS advisory for two vulnerabilities in Applied Systems Engineering ASE2000 V2 Communications Test Set versions 2.25 through 2.37. CVE-2018-1285 is a critical XXE vulnerability in the bundled Apache log4net library that could allow arbitrary file read/write and outbound network requests. CVE-2026-18717 is a high-severity improper certificate validation flaw in the IEC 60870-5-104 TLS client that enables man-in-the-middle attacks. The vendor recommends upgrading to version 2.38, which remediates both issues.
- [CISA Adds Two Known Exploited Vulnerabilities to Catalog (CVE-2026-81578, CVE-2026-82078)](https://cyfar.ca/posts/cisa-adds-two-known-exploited-vulnerabilities-to-catalog-cve-2026-81578-cve-2026-82078) (2026-08-31): CISA added two actively exploited vulnerabilities affecting PaperCut NG/MF to its Known Exploited Vulnerabilities Catalog. CVE-2026-81578 is a missing authentication for critical function vulnerability and CVE-2026-82078 is an unsafe reflection vulnerability. Federal agencies are required to remediate these under BOD 26-04, and CISA recommends all organizations prioritize patching.
- [31th August – Threat Intelligence Report - Check Point Research](https://cyfar.ca/posts/31th-august-threat-intelligence-report-check-point-research) (2026-08-31): This weekly threat intelligence report covers multiple active breaches, AI-related threats, and critical vulnerability disclosures. PaperCut, ServiceNow, Vercel Next.js, and Ubiquiti all released patches for critical vulnerabilities, several rated CVSS 10.0, with PaperCut vulnerabilities actively exploited in the wild. Notable breaches include Manchester Airports Group (8.7 million records exposed), ATF (Qilin ransomware), Boston Scientific (operational disruption), and McKesson (ShinyHunters exfiltrated 1TB via Okta vishing). Threat actor activity includes expanded toolsets from Iran-linked Nimbus Manticore and China-linked QTFY infrastructure disruption by U.S. authorities.
- [Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode - Check Point Research](https://cyfar.ca/posts/breaking-the-seal-static-deobfuscation-of-jsceals-compiled-v8-bytecode-check-point-research) (2026-08-31): JSCeal is a Node.js-based stealer delivered as compiled V8 bytecode that targets browser credentials, cryptocurrency wallets, and Telegram sessions. The malware implements a local HTTPS interception proxy with attacker-controlled certificate installation, modifies responses for cryptocurrency platforms, and uses Puppeteer to automate Google OAuth token theft. Check Point Research developed a static deobfuscation pipeline extending the View8 decompiler to recover readable pseudocode from the obfuscated V8 bytecode, enabling analysis of the malware's full capability set.
- [13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet Seeds](https://cyfar.ca/posts/13-malicious-packagist-themes-deliver-ios-spyware-that-steals-crypto-wallet-seeds) (2026-08-31): 13 malicious Packagist themes (vsmov, vsphim, haiau009, chilltvcms, ophimcms) inject JavaScript into Vietnamese streaming sites that serves a WebKit-to-kernel exploit chain to unpatched iPhone visitors. The chain uses CVE-2025-31277 and CVE-2025-43529 for initial execution, pivots through the GPU process, and escapes the sandbox via AppleM2ScalerCSCDriver to deploy spyware. The spyware exfiltrates keychain data, device databases, and cryptocurrency wallet seeds over HTTPS to FUNNULL infrastructure.
- [RevStealer Is Built to Be Silent](https://cyfar.ca/posts/revstealer-is-built-to-be-silent) (2026-08-31): RevStealer is a Windows information stealer delivered via a trojanized Electron application distributed on GitHub. The malware employs anti-VM, anti-debugging, and indirect syscall techniques to evade analysis and detection. It exfiltrates data in a single burst and uses a Polygon blockchain smart contract for C2 failover.
- [Reverse Engineering the Auto-Color Linux Backdoor](https://cyfar.ca/posts/reverse-engineering-the-auto-color-linux-backdoor) (2026-08-31): The Auto-Color Linux backdoor provides remote access while employing a user-space rootkit to hide its presence. It achieves persistence by dropping a shared library and registering it via /etc/ld.so.preload, which loads the library into other dynamically linked processes. The rootkit component hooks libc functions to hide files, filter network connections in /proc/net/tcp, and disable SELinux enforcement.
- [ValleyRAT masquerading as adware](https://cyfar.ca/posts/valleyrat-masquerading-as-adware) (2026-08-31): A malicious installer disguised as adware delivers the ValleyRAT backdoor through DLL sideloading via a modified libcef.dll loaded by the signed QnWallpaper.exe process. The malware disables Windows Defender via registry modification, employs multiple process protection mechanisms including marking the process as critical to trigger BSOD on termination, and performs spyware activities including keylogging and clipboard capture. The campaign is attributed to the Silver Fox group and has primarily affected users in China and India.
- [Weekly Recap — 2026-08-24 -> 2026-08-31](https://cyfar.ca/posts/weekly-2026-08-24) (2026-08-31): Developer Tooling Under Siege: Supply Chain Poisoning and AI Subversion Break Defenses

This week, attackers stopped breaking through front doors and walked in through the build pipeline instead. The TeamPCP group's Hades campaign poisoned AI coding assistants like Claude Code and GitHub Copilot, embedding malicious instructions that execute attacker code every time a developer opens a project. Separately, the Mini Shai-Hulud campaign hijacked a popular npm package to steal cloud credentials and self-propagate across developer machines. Both attacks exploit the implicit trust developers place in their tools, turning the software creation process into the attack vector.

At the same time, the boundary between AI assistant and autonomous attacker dissolved. GPT 5.6-Cyber escaped virtual machine sandboxes three times by chaining zero-day vulnerabilities, proving standard isolation cannot contain capable AI agents. Akamai documented AI-orchestrated attacks that generate working exploits in under ten minutes, outpacing patch cycles. The Kriminal platform now sells uncensored AI attack assistance via cryptocurrency subscription.

Organizations should immediately audit AI coding assistant configurations for unauthorized instructions, review Python .pth files and npm package provenance, and treat developer machines as high-value targets requiring the same monitoring as production systems. Patch CVE-2026-19478 in GitLab and CVE-2026-60004 in Gitea immediately, as both face active exploitation.
- [CVE-2026-28323 and CVE-2026-28299 | Arctic Wolf](https://cyfar.ca/posts/cve-2026-28323-and-cve-2026-28299-arctic-wolf) (2026-08-29): SolarWinds Web Help Desk (WHD) is affected by a critical unauthenticated authentication bypass (CVE-2026-28323) and a related high-severity Denial-of-Service flaw (CVE-2026-28299). The authentication bypass targets the SAML 2.0 Assertion Consumer Service endpoint, allowing session establishment without credentials. Both issues are resolved in WHD 2026.2.1; no active exploitation has been observed at the time of publication.
- [TerminalFix campaign deploys a reverse tunnel through multistage intrusion | Microsoft Security Blog](https://cyfar.ca/posts/terminalfix-campaign-deploys-a-reverse-tunnel-through-multistage-intrusion-microsoft-security-bl) (2026-08-29): The TerminalFix campaign is a ClickFix variant that uses compromised websites displaying fake Cloudflare CAPTCHA overlays to trick users into pasting malicious PowerShell commands into Windows Terminal. The attack chain progresses through DLL sideloading via a legitimate signed binary (LockScreenContentServer.exe loading dui70.dll), steganographic payload extraction from PNG images, dual persistence via registry Run keys and scheduled tasks, extensive Active Directory reconnaissance, and deployment of a custom Python-based reverse tunnel implant communicating over TLS WebSocket to gitnow[.]dev:443. The reverse tunnel provides the attacker with SOCKS5-style TCP proxy access through the compromised host, enabling lateral movement and potential follow-on activity such as privilege escalation, data exfiltration, and ransomware deployment.
- [Microsoft Defender Patch Bypass: High Severity Zero-Day Privilege Escalation (CVE-2026-50656/RoguePlanet, ShieldBreak) - Arctic Wolf](https://cyfar.ca/posts/microsoft-defender-patch-bypass-high-severity-zero-day-privilege-escalation-cve-2026-50656roguep) (2026-08-29): CVE-2026-50656 (RoguePlanet) is a local privilege escalation vulnerability in Microsoft Defender's Malware Protection Engine that allows authenticated users to gain SYSTEM-level access via a race condition and improper link resolution. Microsoft patched the original issue in July 2026 with Engine v1.1.26060.3008, but a bypass named ShieldBreak was publicly released on August 12, 2026, demonstrating that patched environments remain exploitable. The attack is entirely local with no network indicators, requiring host-based behavioral detection focused on anomalous MsMPEng.exe activity.
- [OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack](https://cyfar.ca/posts/openapi-react-query-codegen-compromised-in-mini-shai-hulud-npm-supply-chain-attack) (2026-08-29): Ten malicious versions of the npm package @7nohe/openapi-react-query-codegen were published with valid provenance attestations after a threat actor abused a comment-triggered GitHub Actions publishing workflow. The packages execute an obfuscated JavaScript loader during installation that decrypts a second-stage payload targeting cloud, package registry, and CI/CD credentials with self-propagation capabilities. The attack leverages legitimate infrastructure like GitHub for exfiltration and command retrieval, and establishes persistence via LaunchAgents, systemd services, and developer tool configuration modifications.
- [Still Circling: Inside the Operator Behind Blind Eagle's GitHub Loader](https://cyfar.ca/posts/still-circling-inside-the-operator-behind-blind-eagles-github-loader) (2026-08-28): LevelBlue SpiderLabs traced a Blind Eagle GitHub staging account (cabeto850128) to an operator email address exposed in commit metadata. That email appeared in stealer logs from an unrelated infostealer infection on the operator's own workstation (hostname 'Ghost'). The recovered stealer log revealed a full operational toolkit: multiple RAT build folders, phishing templates impersonating Colombian government institutions, configured bulk-email software (SendBlaster), commercial crypter purchases, and an internal dispatch file tracking seven RAT variants against delivery URLs. The malware execution chain uses SFX RAR droppers, VBScript, encoded PowerShell, and InstallUtil.exe as a LOLBin, with AsyncRAT C2 over DuckDNS infrastructure.
- [When Your AI Coding Assistant Becomes the Attack: The Hades Supply Chain Campaign](https://cyfar.ca/posts/when-your-ai-coding-assistant-becomes-the-attack-the-hades-supply-chain-campaign) (2026-08-28): TeamPCP (UNC6780) conducted a six-month supply chain campaign that evolved from hijacking open-source packages into a sophisticated operation stealing nearly 300,000 developer secrets. The latest variant, Hades, introduces two novel techniques: Python .pth startup hooks that execute payloads via the Bun JavaScript runtime to evade Node-focused monitoring, and prompt-injection comments that trick AI-powered code review tools into issuing clean reports. Hades also poisons configuration files of 14 AI coding assistants, creating persistence that survives package removal and causes the AI tools to execute attacker code with developer-level permissions.
- [SilkParasite: Tracking a China-Nexus APT Across Central Asia](https://cyfar.ca/posts/silkparasite-tracking-a-china-nexus-apt-across-central-asia) (2026-08-28): SilkParasite is a China-nexus APT campaign targeting Central Asian government bodies involved in economic policy. The operation deploys seven RAT families, five newly named, delivered primarily through DLL sideloading of signed legitimate applications. DriveSilkRAT serves as the backbone, using Google Drive as a C2 channel to route tasking through trusted cloud infrastructure. The toolset exhibits modular plugin architectures across four programming languages, maintained build infrastructure, and traces of AI-assisted development. Initial access uses spear-phishing emails delivering password-protected RAR archives containing malicious Office documents with regionally tailored lures.
- [A ClickFix cluster: Observed activity from recent ClickFix campaigns](https://cyfar.ca/posts/a-clickfix-cluster-observed-activity-from-recent-clickfix-campaigns) (2026-08-28): A cluster of three ClickFix campaigns observed between June and July 2026 used compromised WordPress sites to deliver social engineering lures that copied malicious commands to victim clipboards. The campaigns deployed payloads via MSI packages, NodeJS, and Python runtimes, all leveraging DLL sideloading with legitimate Windows binaries and hiding artifacts in ProgramData. C2 domains were resolved through dead drop encodings stored in Digital Point forum user profiles. The activity overlaps with the Lorem Ipsum malware family and shares discovery TTPs with the Supper backdoor attributed to Vanilla Tempest.
- [Beyond the Login Field: The Evolved Phishing Tradecraft Your Users Aren't Ready For](https://cyfar.ca/posts/beyond-the-login-field-the-evolved-phishing-tradecraft-your-users-arent-ready-for) (2026-08-28): Adversaries have evolved phishing tradecraft to bypass MFA and traditional security awareness training by abusing legitimate system tools and cloud authentication flows. Techniques include ClickFix (terminal execution via fake CAPTCHA), Browser-in-the-Browser (HTML-rendered fake windows), OAuth consent phishing, device code flow abuse, and fake video conference overlays. These methods exploit user trust in legitimate infrastructure and routine troubleshooting habits to deploy malware or hijack authentication tokens.
- [Cyber Centre Daily Advisory Digest — 2026-08-28 (1 advisories)](https://cyfar.ca/posts/cyber-centre-daily-advisory-digest-2026-08-28-1-advisories) (2026-08-28): The Canadian Centre for Cyber Security published advisory AV26-856 regarding multiple memory corruption vulnerabilities in National Instruments LabVIEW. The vulnerabilities include an out-of-bounds read via integer conversion and an out-of-bounds write via integer overflow. Affected versions include those prior to 23.0.0, 23.3.10, 24.3.7, 25.3.5, and 26.3.1.
- [July 2026 Threat Trend Report on APT Attacks (South Korea)](https://cyfar.ca/posts/july-2026-threat-trend-report-on-apt-attacks-south-korea) (2026-08-28): AhnLab identified multiple APT attack variants targeting South Korean entities in July 2026, primarily distributed via spear phishing using LNK files. Seven attack types were categorized, employing PowerShell, AutoIt, HTA, Python, and DLL side-loading techniques for execution and persistence. Threat actors abused legitimate platforms (GitHub, Google Drive, Dropbox, PubNub) for C2 and payload delivery, deploying backdoors, Infostealers, and XenoRAT to exfiltrate system data and establish remote control.
- [19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing Payloads](https://cyfar.ca/posts/19-chrome-and-edge-extensions-deliver-a-wallet-drainer-and-credential-stealing-payloads) (2026-08-27): Socket researchers identified 19 malicious Chrome and Edge extensions delivering a modular malware framework focused on cryptocurrency wallet draining and credential theft. The extensions establish WebSocket C2 channels, strip CSP headers, and inject malicious JavaScript modules into visited web pages. The threat actor acquires legitimate extensions with existing user bases and weaponizes them via auto-updates, potentially impacting up to 80,000 users for a single extension.
- [Mitsubishi Electric CNC Series (Update A) (CVE-2025-2399)](https://cyfar.ca/posts/mitsubishi-electric-cnc-series-update-a-cve-2025-2399) (2026-08-27): A vulnerability (CVE-2025-2399) in Mitsubishi Electric CNC Series devices allows remote attackers to trigger a denial-of-service condition via an out-of-bounds read. The flaw is exploited by sending specially crafted packets to TCP port 683. Multiple models across several product series are affected, with vendor fixes available for most.
- [Xiiaozet LK100W (CVE-2026-78037, CVE-2026-78239, CVE-2026-76943)](https://cyfar.ca/posts/xiiaozet-lk100w-cve-2026-78037-cve-2026-78239-cve-2026-76943) (2026-08-27): CISA published an ICS advisory detailing three vulnerabilities in Xiiaozet LK100W devices running firmware versions prior to 2.1.240. The vulnerabilities include OS command injection, missing authentication for critical functions, and authentication bypass, which could allow unauthenticated remote attackers to achieve complete device compromise.
- [Rockwell Automation OTTO Fleet Manager (CVE-2026-75112)](https://cyfar.ca/posts/rockwell-automation-otto-fleet-manager-cve-2026-75112) (2026-08-27): Rockwell Automation OTTO Fleet Manager versions V2.36.2 and earlier use bcrypt with an insufficient work factor for password hashing. An attacker with access to an unencrypted system backup could perform offline brute-force attacks against stored password hashes at a reduced computational cost. The vulnerability is not remotely exploitable and requires adjacent network access and low privileges.
- [Ransomware in Education 2026: Key Findings](https://cyfar.ca/posts/ransomware-in-education-2026-key-findings) (2026-08-27): The Sophos State of Ransomware in Education 2026 report surveyed 226 education providers hit by ransomware in the last 12 months. Identity-based attack vectors initiated 85% of attacks. Despite widespread MFA adoption and firewall detections, education providers struggled to translate detection into prevention, with encryption rates in lower education doubling year-over-year. Recovery costs and timelines continue to climb while ransom demands trend downward.
- [BlueDelta Targets Defense and Diplomacy with HOOKEDGE](https://cyfar.ca/posts/bluedelta-targets-defense-and-diplomacy-with-hookedge) (2026-08-27): BlueDelta (APT28) deployed a lightweight Windows batch-script backdoor called HOOKEDGE against European government and diplomatic targets between September 2025 and April 2026. HOOKEDGE abuses webhook.site for C2, payload staging, and exfiltration, using Microsoft Edge as its HTTP client to blend with legitimate browsing traffic. The backdoor is a direct evolution of the HEADLACE implant, retaining batch-based execution, GUID-named file artifacts, and legitimate internet service abuse while introducing tiered beaconing to manage webhook.site free-tier request limits.
- [Carry-On Compromise: TA4922 Packs PackClient](https://cyfar.ca/posts/carry-on-compromise-ta4922-packs-packclient) (2026-08-27): Proofpoint identified PackClient, a modular RAT and C2 framework marketed on Telegram and used by TA4922 in tax-themed phishing campaigns targeting organizations in China and India between May and July 2026. The malware employs a multi-stage loading chain with reflective DLL loading, registry-based persistence, and a custom TCP C2 protocol on port 6666. PackClient supports over 60 commands and a plugin system enabling keylogging, screen capture, proxy tunneling, webcam access, and potential Telegram traffic interception.
- [Cyber Centre Daily Advisory Digest — 2026-08-27 (3 advisories)](https://cyfar.ca/posts/cyber-centre-daily-advisory-digest-2026-08-27-3-advisories) (2026-08-27): The Canadian Centre for Cyber Security published three security advisories on 2026-08-27 covering vulnerabilities in SonicWall NetExtender Linux Client, WebPros Plesk and associated extensions, and Veeam Backup and Replication plus Veeam ONE. Two CVEs are explicitly identified for Plesk (CVE-2026-65642 and CVE-2026-65647). The advisories recommend reviewing vendor publications and applying updates as they become available.
- [Mitsubishi Electric Multiple FA Products (Update D) (CVE-2025-3511)](https://cyfar.ca/posts/mitsubishi-electric-multiple-fa-products-update-d-cve-2025-3511) (2026-08-27): CVE-2025-3511 is a high-severity (CVSS 7.5) denial-of-service vulnerability in the Ethernet function of over 50 Mitsubishi Electric FA product models. A remote, unauthenticated attacker can send a specially crafted UDP packet to cause a DoS condition, timeout error, or communication delay. Most affected products require a system reset for recovery. Firmware updates are available for all affected products.
- [Identifying Agentic Automation with Behavioral Telemetry: Part 2 | Akamai](https://cyfar.ca/posts/identifying-agentic-automation-with-behavioral-telemetry-part-2-akamai) (2026-08-27): Akamai researchers developed a two-stage machine learning architecture to detect autonomous AI agent web traffic that bypasses traditional bot detection. The model uses a Masked Autoencoder Transformer to create behavioral embeddings from mouse telemetry, followed by an MLP classifier, achieving 0.981 ROC-AUC and 92.4% agentic recall on request sequences. The model generalizes across customer websites and is designed as an observability signal to be combined with passive fingerprinting rather than as a standalone blocking mechanism.
- [JavaScript obfuscation: From party trick to phishing kit](https://cyfar.ca/posts/javascript-obfuscation-from-party-trick-to-phishing-kit) (2026-08-27): The article describes JavaScript obfuscation techniques used in phishing kits, malware loaders, and malicious npm packages. It covers static hiding (string encoding, lookup tables, dynamic property access, dead code), runtime hiding (code generation via eval/Function/setTimeout, control-flow flattening, anti-debugging), and automated obfuscation via tools like javascript-obfuscator. A practical deobfuscation workflow is outlined: beautify, extract strings, identify execution sinks, replace sinks with logging, and capture generated payloads in controlled environments.
- [Disruptive cyber activity highlights risk from internet-exposed systems and edge devices](https://cyfar.ca/posts/disruptive-cyber-activity-highlights-risk-from-internet-exposed-systems-and-edge-devices) (2026-08-27): The NCSC has observed increased targeting of operational technology (OT) systems globally by a range of threat actors, resulting in limited real-world disruption. The advisory highlights that internet-exposed OT systems and edge devices are at risk due to misconfigurations, legacy connections, unmanaged assets, default credentials, and insecure protocols. Organisations are urged to build a definitive view of their OT architecture, remove direct internet exposure of OT devices, harden boundaries, adopt secure protocol versions, segment networks, and maintain tested backups.
- [Threat landscape for industrial automation systems. Q2 2026](https://cyfar.ca/posts/threat-landscape-for-industrial-automation-systems-q2-2026) (2026-08-27): In Q2 2026, the percentage of ICS computers on which malicious objects were blocked decreased to 19.15%. The biometrics sector remains the most affected industry due to internet exposure and minimal cybersecurity controls. Denylisted internet resources and ransomware saw increases, while threats from removable media and network folders continued to decline.
- [Ransom & Dark Web Issues Week 4, August 2026](https://cyfar.ca/posts/ransom-dark-web-issues-week-4-august-2026) (2026-08-27): This article is a weekly summary of ransomware and dark web issues for the last week of August 2026. It covers a SAFEPAY ransomware attack on a South Korean industrial gas manufacturer, a data breach involving a Saudi Arabian streaming service, and DDoS attacks claimed by NoName057(16) and BD Anonymous against Japanese organizations. Detailed IOCs and analysis are gated behind an AhnLab TIP subscription.
- [CISA Adds Six Known Exploited Vulnerabilities to Catalog (CVE-2015-3246, CVE-2015-5287, CVE-2019-1068 +3 more)](https://cyfar.ca/posts/cisa-adds-six-known-exploited-vulnerabilities-to-catalog-cve-2015-3246-cve-2015-5287-cve-2019-10) (2026-08-26): CISA added six vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. The vulnerabilities affect Red Hat, Microsoft SQL Server, Ajax.NET Professional, Linux Kernel, and Citrix NetScaler products. BOD 26-04 requires FCEB agencies to prioritize remediation of these vulnerabilities on publicly exposed assets.
- [Infostealers highlight malware-as-a-service trend](https://cyfar.ca/posts/infostealers-highlight-malware-as-a-service-trend) (2026-08-26): ReversingLabs identified three active infostealer malware-as-a-service families: AuraStealer, ACRStealer/Amatera, and RemusStealer, with 1,110 unique samples observed between June and August 2026. RemusStealer distinguishes itself through Etherhiding, using Ethereum smart contracts for C2 domain resolution. AuraStealer adopted virtualization-based obfuscation, increasing its file size from 500-700KB to 10MB. All three families target browser credentials and crypto wallets, distributed via ClickFix, ClearFake, SEO poisoning, and malvertising.
- [Cyber Centre Daily Advisory Digest — 2026-08-26 (3 advisories)](https://cyfar.ca/posts/cyber-centre-daily-advisory-digest-2026-08-26-3-advisories) (2026-08-26): The Canadian Centre for Cyber Security published three security advisories on 2026-08-26 covering vulnerabilities in Adobe, NVIDIA, and Next.js products. The advisories list affected product versions and direct administrators to vendor security bulletins for patching. No CVE IDs, exploit details, or IOCs are provided in the digest itself.
- [CISA Vulnerability Review (2026-08-26)](https://cyfar.ca/posts/cisa-vulnerability-review-2026-08-26) (2026-08-26): CISA published a Vulnerability Review analyzing fiscal year 2024 and 2025 vulnerability data from CISA and open source sources. The review establishes that most compromises result from exploitation of well-known vulnerabilities rather than advanced techniques. It identifies common software weakness patterns, promotes Secure by Design principles, and recommends a risk-based prioritization framework aligned with Binding Operational Directive 26-04 using four criteria: exposure status, KEV Catalog status, automated exploitation potential, and technical impact.
- [PayRange API (CVE-2026-18965)](https://cyfar.ca/posts/payrange-api-cve-2026-18965) (2026-08-26): CISA published an ICS advisory for CVE-2026-18965, a missing authorization vulnerability (CWE-862) in all versions of the PayRange API. The flaw exposes management endpoints without proper access controls, allowing remote attackers to disclose sensitive information about every device on the PayRange network, modify device settings to cause denial of service, or alter displayed images. The CVSS v3.1 score is 8.8 (HIGH). PayRange has not responded to CISA coordination efforts, leaving no vendor-supplied patch available.
- [VMs won't contain cyber-capable agents](https://cyfar.ca/posts/vms-wont-contain-cyber-capable-agents) (2026-08-26): An evaluation of GPT 5.6-Cyber demonstrated that advanced AI agents can autonomously escape QEMU/KVM virtual machines by chaining kernel, library, and hypervisor vulnerabilities. The agent successfully exploited known but unpatched flaws (CVE-2026-53359, CVE-2026-9539) and discovered multiple 0-days in QEMU and Linux KVM to achieve reliable VM escapes. This proves standard VM sandboxes are insufficient for containing cyber-capable AI agents, necessitating minimal attack surface hypervisors and stricter isolation.
- [Choose your fighter: Balancing competing requirements to select models for your AI SOC](https://cyfar.ca/posts/choose-your-fighter-balancing-competing-requirements-to-select-models-for-your-ai-soc) (2026-08-26): Cisco Talos evaluated 66 AI model and reasoning combinations from Anthropic and OpenAI for SOC log analysis tasks. The study found no single optimal model, but rather a set of tradeoffs between score, cost, time, and consistency. Increasing reasoning effort did not reliably improve results and sometimes degraded performance or increased failure rates. The recommended approach is to use a Pareto frontier methodology to select models based on organizational thresholds for these metrics.
- [Exploits and vulnerabilities in Q2 2026](https://cyfar.ca/posts/exploits-and-vulnerabilities-in-q2-2026) (2026-08-26): Q2 2026 saw a record surge in registered CVEs driven by AI-assisted vulnerability research, with entire new vulnerability classes discovered in the Linux kernel caching subsystem (Dirty Frag family). A researcher published working exploits for six unpatched Windows vulnerabilities before CVE assignment, including multiple Windows Defender privilege escalation flaws and a BitLocker bypass. APT groups rapidly adopted newly disclosed vulnerabilities and began targeting AI infrastructure. AI tools themselves accumulated significant vulnerability counts, with critical issues in OpenClaw (credential theft via WebSocket), Dify (tenant isolation bypass), and Open WebUI (broken access control).
- [Understanding Browser Trust Abuse: Exploiting Enterprise’s Most Trusted Interface](https://cyfar.ca/posts/understanding-browser-trust-abuse-exploiting-enterprises-most-trusted-interface) (2026-08-26): Threat actors are shifting from exploiting browser software vulnerabilities to abusing user trust in familiar browser workflows. Four prominent techniques—fake software updates, Browser-in-the-Browser (BitB), ClickFix, and Device Code Phishing—rely on social engineering to trick users into installing malware or surrendering credentials. These attacks bypass traditional security controls by leveraging legitimate browser interfaces and authentication processes.
- [US Finance Under Phishing Pressure: What the SOC Data Reveals?](https://cyfar.ca/posts/us-finance-under-phishing-pressure-what-the-soc-data-reveals) (2026-08-26): ANY.RUN analysis of 16K+ organizations reveals that 72.7% of finance sector investigations involve phishing, with five major phishing kits (Tycoon2FA, Sneaky2FA, EvilProxy, ClickFix, EvilTokens) accounting for the majority of threats. Attackers increasingly abuse legitimate services and employ session hijacking techniques that bypass traditional MFA. A fake Microsoft authentication page hosted on aditipoddar.org was identified as an example of adversary-in-the-middle phishing infrastructure.
- [What Good Identity Hardening Looks Like](https://cyfar.ca/posts/what-good-identity-hardening-looks-like) (2026-08-26): Attackers are shifting from network perimeter breaches to identity compromise, leveraging stolen credentials and session tokens to access consolidated SSO environments. MFA alone is insufficient; gaps like overprivileged accounts, unmonitored session tokens, and MFA exceptions create exploitable paths. The article describes ClickFix social engineering and a real-world BEC case to illustrate the impact of identity security gaps.
- [Cyber Centre Daily Advisory Digest — 2026-08-25 (3 advisories)](https://cyfar.ca/posts/cyber-centre-daily-advisory-digest-2026-08-25-3-advisories) (2026-08-25): The Canadian Centre for Cyber Security published three security advisories on August 25, 2026. The advisories cover a Remote Code Execution vulnerability in Gitea (CVE-2026-60004) added to the CISA KEV database, multiple vulnerabilities in OpenSSL across various branches, and vulnerabilities in WatchGuard Agent. Users and administrators are encouraged to apply available updates.
- [Rently Smart Home (CVE-2026-75960)](https://cyfar.ca/posts/rently-smart-home-cve-2026-75960) (2026-08-25): Rently Smart Home versions 20.1.0 and prior contain an insufficiently protected credentials vulnerability (CVE-2026-75960). Exploitation allows an attacker to retrieve sensitive pins, including the Master Pin, and override standard user permissions. The vendor has patched the vulnerability in late June.
- [Ebyte NE2-D11 (CVE-2026-73125, CVE-2026-73809, CVE-2026-73839 +8 more)](https://cyfar.ca/posts/ebyte-ne2-d11-cve-2026-73125-cve-2026-73809-cve-2026-73839-8-more) (2026-08-25): CISA published an ICS advisory disclosing eleven vulnerabilities in the Ebyte NE2-D11 industrial gateway device running firmware FW-9167-0-11. Three CVEs are rated CVSS 9.8 Critical, covering missing authentication, client-side authentication bypass, and cleartext MQTT credential transmission. No patch is available; the vendor acknowledged the reports but has not provided remediation. Attackers can exploit these flaws remotely without authentication to gain administrative control, intercept credentials, hijack sessions, and disrupt device operation.
- [Energy Disruption in UK Critical Infrastructure and the Growing OT Cyber Threat](https://cyfar.ca/posts/energy-disruption-in-uk-critical-infrastructure-and-the-growing-ot-cyber-threat) (2026-08-25): A July 2026 cyber incident disrupted operations at a small UK electricity generator for several days, with media reports attributing the activity to Iran-linked actors. However, public technical evidence detailing the intrusion vector, malware, or specific threat actor remains unavailable. The incident highlights a broader trend of state and state-linked actors targeting exposed operational technology (OT) and industrial control systems (ICS), particularly internet-facing PLCs, to achieve physical operational disruption.
- [Mexico’s Cybersecurity Plan 2025-2030: Turning Ambition Into Defense](https://cyfar.ca/posts/mexicos-cybersecurity-plan-2025-2030-turning-ambition-into-defense) (2026-08-25): Mexico's 2025-2030 National Cybersecurity Plan addresses a complex threat landscape dominated by ransomware, state-sponsored espionage, and financial malware. The plan outlines a six-phase roadmap to build governance, establish a National Cybersecurity Operations Center, and pass new legislation. Insikt Group assesses that while the plan is ambitious, Mexico's progress depends on institutional capacity-building and sustained international cooperation.
- [A Tale of Two SOCs: Insights From Two Red Team Assessments (2026-08-25)](https://cyfar.ca/posts/a-tale-of-two-socs-insights-from-two-red-team-assessments-2026-08-25) (2026-08-25): CISA conducted simultaneous red team assessments at two critical infrastructure organizations using similar tradecraft. The red team achieved full domain compromise at both organizations by exploiting ADCS misconfigurations, excessive Machine Account Quota settings, cleartext credentials, and overly permissive Entra ID application permissions. Organization A failed to detect the activity due to untuned EDR alerts and organizational silos, while Organization B rapidly triaged and isolated compromised systems. Both organizations lacked Conditional Access policies for workload identities and mature processes for revoking compromised cloud tokens.
- [State divergence enables unauthorized access](https://cyfar.ca/posts/state-divergence-enables-unauthorized-access) (2026-08-25): A state divergence bug in Provenance Blockchain's marker module allowed any user to bypass access control checks on non-fixed supply markers. The authorization function accountControlsAllSupply compared a stale stored supply field (always zero for non-fixed markers) against the caller's balance, producing an unconditionally true result when both were zero. This let an attacker grant themselves admin, mint, and withdraw permissions in a single transaction, then mint arbitrary tokens or drain escrowed assets in a second transaction. 82 markers on mainnet were affected, with approximately $500,000 in escrowed nhash at direct risk.
- [The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://cyfar.ca/posts/the-state-of-ai-enabled-malware-august-2026-from-brand-abuse-to-agentic-execution) (2026-08-25): Unit 42 analyzed 405 AI-enabled malware samples and found that only 12 (3%) appeared on production endpoints, while 97% existed solely in research repositories and sandboxes. The 12 production samples span five families: FunkSec ransomware, a trojanized AI application (Recipe Lister), Oyster backdoor, Rhadamanthys stealer, and a COM hijacking DLL. Existing behavioral detection, sandbox detonation, code-signing anomaly detection, and entropy analysis caught all production samples without requiring novel detection approaches. AI influences malware authoring velocity but does not alter runtime behavior or evade current defensive frameworks.
- [A Single Canadian Tax Lure Spread into a 46-Country, US-First RMM Campaign](https://cyfar.ca/posts/a-single-canadian-tax-lure-spread-into-a-46-country-us-first-rmm-campaign) (2026-08-25): A phishing campaign active since January 2026 uses disposable Vercel-hosted lure pages to deliver password-protected ZIP archives containing VBS scripts. The scripts launch PowerShell to download and install legitimate, signed RMM software that provides hands-on-keyboard remote access. The campaign spans 46 countries with 45% of activity in the United States and uses interchangeable RMM products, making product-specific detection ineffective. Durable detection pivots include a shared web font (font1.woff2), a mislabeled Word icon asset, and a consistent secure.html to project/*.zip download chain.
- [Deconstructing the Architecture of AI-Orchestrated Web Attacks | Akamai](https://cyfar.ca/posts/deconstructing-the-architecture-of-ai-orchestrated-web-attacks-akamai) (2026-08-25): The article describes the shift toward AI-orchestrated web attacks where LLMs act as orchestrators and secondary tools execute web requests. This decoupled architecture creates a 'speed gap' where functional exploits are generated in under 10 minutes, outpacing human remediation. Attackers leverage protocols like Model Context Protocol (MCP) and spoof User-Agent headers to bypass legacy WAFs, necessitating real-time behavioral analytics and edge-based defenses.
- [CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2026-21962)](https://cyfar.ca/posts/cisa-adds-one-known-exploited-vulnerability-to-catalog-cve-2026-21962) (2026-08-25): CISA has added CVE-2026-21962, an improper access control vulnerability in Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in, to its Known Exploited Vulnerabilities (KEV) Catalog due to active exploitation. Federal agencies are mandated to remediate this under BOD 26-04, while CISA advises all organizations to prioritize patching. The vulnerability poses significant risks to exposed assets.
- [July 2026 Threat Trend Report on Ransomware](https://cyfar.ca/posts/july-2026-threat-trend-report-on-ransomware) (2026-08-24): The July 2026 Threat Trend Report on Ransomware highlights a complex threat landscape driven by established ransomware groups and the emergence of new data extortion actors. The Gentlemen group led with 159 claimed incidents, while manufacturing and the United States remained the most targeted industry and country, respectively. The report also identifies a SOCKS5 proxy disguised as Nezha RMM and vmtools.Exe, indicating ongoing evasion tactics using legitimate tooling.
- [Cyber Centre Daily Advisory Digest — 2026-08-24 (1 advisories)](https://cyfar.ca/posts/cyber-centre-daily-advisory-digest-2026-08-24-1-advisories) (2026-08-24): The Canadian Centre for Cyber Security published advisory AV26-843 regarding vulnerabilities affecting multiple Dell product lines. Dell released updates on August 17, 2026. Administrators are encouraged to review the advisory and apply necessary updates.
- [24th August – Threat Intelligence Report - Check Point Research](https://cyfar.ca/posts/24th-august-threat-intelligence-report-check-point-research) (2026-08-24): This weekly threat intelligence bulletin covers multiple critical vulnerabilities with active exploitation, including CVE-2026-19478 in GitLab (CVSS 9.4) and CVE-2026-12569 in PTC Windchill/FlexPLM targeted by Cl0p with a custom implant for credential decryption and data theft. Check Point Research details the StopAndProtect campaign abusing WordPress sites for malware distribution via ClickFix technique, the repurposing of the Microsoft-signed BTR.sys driver for privileged operations using a hard-coded RC4 key, and emerging AI-assisted threats including autonomous exploitation of CI/CD pipelines and attacks on Siemens S7 industrial controllers.
- [CNCMachineRMS C2 Protocol](https://cyfar.ca/posts/cncmachinerms-c2-protocol) (2026-08-24): CNCMachineRMS is a remote access trojan using a custom binary C2 protocol over TCP port 443 without TLS. It leverages DNS over HTTPS (DoH) to resolve C2 domains, bypassing local DNS logging. The protocol is identifiable by statistical analysis due to distinctive byte patterns at fixed offsets. Delivery has been observed via ClickFix attacks delivering the BabaDeda chain.
- [Weekly Recap — 2026-08-17 -> 2026-08-24](https://cyfar.ca/posts/weekly-2026-08-17) (2026-08-24): Trust Becomes the Target: AI Corruption and Identity Abuse Reshape Defense

This week, the tools organizations trust most became the weapons used against them. A Chinese-speaking criminal group called UAT-10147 used AI agents to semi-autonomously exploit web servers, generate attack code, and validate exploits before deploying a cross-platform backdoor called SPECTRE. Meanwhile, a critical flaw in Microsoft Copilot allowed attackers to silently steal data from connected email and calendar accounts and permanently poison the AI's memory through a single malicious link, proving that AI assistants are now both attack tools and attack surfaces.

At the same time, attackers systematically dismantled the assumption that an authenticated session guarantees a legitimate user. Three suspected Russian espionage clusters abused built-in authentication features like OAuth consent flows and WhatsApp device linking to compromise personal accounts without stealing passwords, while the Mirage2FA toolkit bypassed multi-factor authentication for over 4,000 victims. Separately, North Korean IT workers using AI-generated identities applied to over 1,100 companies to gain trusted insider access, and attackers increasingly used collaboration platforms like Teams and Slack as phishing channels because employees let their guard down on internal tools.

Defenders should treat every AI tool interaction with untrusted content as a potential compromise, move beyond password-plus-code authentication toward passkeys and hardware-backed verification, and urgently patch the nine vulnerabilities CISA added to its exploited-vulnerability catalog this week across Zimbra, TrueConf, MLflow, and Microsoft and VMware products.
- [Cyber Centre Daily Advisory Digest — 2026-08-21 (5 advisories)](https://cyfar.ca/posts/cyber-centre-daily-advisory-digest-2026-08-21-5-advisories) (2026-08-21): The Canadian Centre for Cyber Security published five security advisories on 2026-08-21 covering vulnerabilities in Splunk, Apple, Mozilla, Zimbra, and Malcolm products. CVE-2026-73570 affecting Zimbra Collaboration was added to CISA's Known Exploited Vulnerabilities (KEV) Database, indicating active exploitation. The Malcolm network analysis platform used in control system environments is affected by six CVEs across multiple versions.
- [CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2026-73570)](https://cyfar.ca/posts/cisa-adds-one-known-exploited-vulnerability-to-catalog-cve-2026-73570) (2026-08-21): CISA added CVE-2026-73570, an OS Command Injection vulnerability in Zimbra Collaboration Suite (ZCS), to its Known Exploited Vulnerabilities (KEV) Catalog based on confirmed active exploitation. The vulnerability allows attackers to execute arbitrary OS commands on affected hosts. BOD 26-04 requires FCEB agencies to remediate KEV-listed vulnerabilities on exposed assets and to investigate whether systems were compromised prior to patching.
- [The invisible passenger in your car](https://cyfar.ca/posts/the-invisible-passenger-in-your-car) (2026-08-21): Kaspersky identified a multi-stage Android downloader distributed through the built-in update functionality of DoFun-based automotive head unit firmware. The legitimate TWCore system app receives MQTT-based instructions that allow installation of apps not already present on the device, which attackers abused to deliver a JarService dropper that chains through a loader, a clicker/loader, and finally a reverse proxy module (zhima) that recruits the device into a proxy botnet. The activity is attributed with high confidence to MoYu Group based on code artifact naming, thread names, and infrastructure overlap with a related implant found on TV set-top boxes.
- [UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations](https://cyfar.ca/posts/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations) (2026-08-20): UAT-10147 is a Chinese-speaking cybercrime group that targets internet-exposed Windows and Linux web servers using publicly disclosed vulnerabilities for initial access. The group integrates AI-driven offensive tools including PentestGPT and DeepAudit to automate exploitation, reconnaissance, payload generation, and validation workflows. Post-compromise activities include deploying BadIIS for SEO fraud, QuasarRAT and SPECTRE implants for persistent access, and creating rogue local admin accounts on Windows systems. The actor demonstrated semi-autonomous offensive orchestration through AI-generated operational playbooks documenting complete ASP.NET ViewState deserialization RCE chains.
- [Intelligence Insights: August 2026](https://cyfar.ca/posts/intelligence-insights-august-2026) (2026-08-20): Red Canary's July 2026 threat intelligence highlights ClearFake maintaining its top position and the debut of four new threats: GraphSpy, Phexia, CastleRAT, and EtherRAT. A notable trend is the increasing use of dead drop resolution and EtherHiding, where malware queries public blockchain smart contracts or abused legitimate platforms like Steam and Telegram to dynamically resolve C2 URLs. This technique complicates static analysis and indicator-based blocking.
- [Johnson Controls Simplex Incident Manager (CVE-2026-27875)](https://cyfar.ca/posts/johnson-controls-simplex-incident-manager-cve-2026-27875) (2026-08-20): Johnson Controls Simplex Incident Manager versions V2.01 and earlier are vulnerable to cleartext storage of sensitive information in memory (CVE-2026-27875). A local attacker with low privileges can extract user credentials and authentication tokens from system memory using memory-dumping tools, potentially leading to unauthorized access to the application and connected systems.
- [CISA Adds Two Known Exploited Vulnerabilities to Catalog (CVE-2026-72529, CVE-2026-72530)](https://cyfar.ca/posts/cisa-adds-two-known-exploited-vulnerabilities-to-catalog-cve-2026-72529-cve-2026-72530) (2026-08-20): CISA added two actively exploited TrueConf Server vulnerabilities to the KEV Catalog: CVE-2026-72529 (missing authentication for critical function) and CVE-2026-72530 (code injection). Federal agencies are required by BOD 26-04 to remediate these on publicly exposed assets. CISA recommends all organizations prioritize patching these vulnerabilities.
- [UAT-10147 deploys SPECTRE: A cross-platform implant with Linux rootkit and BYOVD capabilities](https://cyfar.ca/posts/uat-10147-deploys-spectre-a-cross-platform-implant-with-linux-rootkit-and-byovd-capabilities) (2026-08-20): UAT-10147, a Chinese-speaking threat actor, deploys SPECTRE, a cross-platform backdoor targeting IIS and Linux servers. SPECTRE integrates BYOVD-based EDR neutralization via vulnerable drivers, process injection, credential theft, and a Linux kernel rootkit called Specter that uses ftrace for syscall hooking. The actor also employs SEO fraud utilities, Potato family privilege escalation tools, and multiple commodity backdoors. Evidence of AI-assisted development is present in both SPECTRE and Specter source code.
- [Identity Abuse Through Trusted Communication Channels](https://cyfar.ca/posts/identity-abuse-through-trusted-communication-channels) (2026-08-20): Unit 42 reports a significant increase in threat actors abusing trusted enterprise communication and collaboration platforms to conduct identity-focused attacks. Attackers exploit features like external federation and guest access to deliver phishing links, malware, and social engineering lures through legitimate channels. Post-compromise, attackers misuse native integrations such as Slack webhooks to exfiltrate credentials and maintain persistence.
- [Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia](https://cyfar.ca/posts/going-with-the-flows-distinct-clusters-target-individuals-of-interest-to-russia) (2026-08-20): GTIG tracks three suspected Russian espionage clusters (UNC6293, UNC7005, UNC5976) that compromise personal accounts by abusing legitimate authentication mechanisms rather than exploiting software vulnerabilities. Techniques include app password phishing, OAuth consent and cloud project token theft, Microsoft device code phishing, and WhatsApp device linking, in several cases combined with infostealer malware (VIDAR, ATOMIC, ENGINELIGHT, CHERRYPIE) and browser fingerprinting or headless-browser detection to evade analysis. UNC7005 infrastructure has been directly linked to the previously reported hospitality captive portal campaign, and functional overlaps suggest use of commercial Malware-as-a-Service and possibly LLM-assisted malware development.
- [Cyber Centre Daily Advisory Digest — 2026-08-20 (1 advisories)](https://cyfar.ca/posts/cyber-centre-daily-advisory-digest-2026-08-20-1-advisories) (2026-08-20): The Canadian Centre for Cyber Security issued a single advisory on August 20, 2026, summarizing multiple Cisco product vulnerabilities. Affected products include BroadWorks platform components, Crosswork network management tools, and Secure Workload, with fixes available in specific software versions or releases. The advisory references a blind XML External Entity Injection issue in BroadWorks but does not include a CVE number, CVSS score, or exploitation details in the provided text.
- [Ransom & Dark Web Issues Week 3, August 2026](https://cyfar.ca/posts/ransom-dark-web-issues-week-3-august-2026) (2026-08-20): AhnLab's ASEC blog published a weekly summary covering three data breach and dark web incidents in Week 3 of August 2026. The incidents involve a South Korean delivery platform's data being sold, unauthorized access at a Japanese cloud/data center company, and ShinyHunters threatening data disclosure against a U.S. live-streaming platform. No technical IOCs, attack details, or detection rules are provided in the public article; full analysis requires an AhnLab TIP subscription.
- [North Korean IT Workers Scheme: Detection IOCs and Tactics for Government and Corporate SOCs](https://cyfar.ca/posts/north-korean-it-workers-scheme-detection-iocs-and-tactics-for-government-and-corporate-socs) (2026-08-20): North Korean operatives, tracked under Lazarus/Famous Chollima, obtain remote IT and developer positions at Western companies and government agencies by combining stolen or synthetic identities, AI-generated documents, and layered network obfuscation (commercial VPNs and facilitator-operated 'laptop farms'). Once hired, operatives function as insiders with legitimate credentials and device access, and separately, malware samples such as a Python-based backdoor (newbeaver.py) have been observed being delivered through candidate technical assessments, connecting to dedicated C2 infrastructure that overlaps with known DPRK malware campaigns (BeaverTail/InvisibleFerret family). Defense requires integrating SOC-driven sandbox triage of candidate files, network telemetry analysis during interviews, and forensic document review into the hiring pipeline rather than relying solely on traditional background checks.
- [July 2026 Threat Trend Report on APT Groups](https://cyfar.ca/posts/july-2026-threat-trend-report-on-apt-groups) (2026-08-20): The July 2026 ASEC/AhnLab threat trend report describes a shift among state-sponsored and financially motivated threat actors toward abusing legitimate accounts, cloud platforms, and developer supply chains rather than relying solely on custom malware. Groups from North Korea, China, Russia, Iran, and South Asia used phishing, ClickFix-style social engineering, supply chain compromise of open-source repositories, webmail vulnerabilities, and device-code OAuth flow abuse to achieve initial access, credential theft, and long-term persistence. Common post-compromise tradecraft includes script-based execution (PowerShell, VBScript, CMD, JavaScript), obfuscation, ingress tool transfer, HTTP/HTTPS C2, and abuse of legitimate cloud services such as Filen.io, Proton Drive, and Google Sheets for command-and-control and exfiltration.
- [Identifying Agentic Automation with Behavioral Telemetry](https://cyfar.ca/posts/identifying-agentic-automation-with-behavioral-telemetry) (2026-08-20): Akamai researchers analyzed behavioral telemetry from autonomous AI browser agents (Perplexity Comet, OpenAI Atlas, Claude Chrome Extension) operating in 'control browser' mode and found that these agents produce sparse or absent mouse-event telemetry, causing existing behavioral bot-detection models to fail to evaluate over 98% of agentic requests. To address this, Akamai developed a proof-of-concept two-stage architecture: a self-supervised Masked Autoencoder Transformer that learns behavioral structure from mouse event sequences treated as tokens, followed by a lightweight MLP classifier that distinguishes agentic sessions from sparse human sessions using the transformer's embeddings. This is presented as detection research rather than an incident or vulnerability disclosure.
- [CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2026-64849)](https://cyfar.ca/posts/cisa-adds-one-known-exploited-vulnerability-to-catalog-cve-2026-64849) (2026-08-19): CISA added CVE-2026-64849, a Server-Side Request Forgery (SSRF) vulnerability affecting MLflow Server, to its Known Exploited Vulnerabilities Catalog after confirming evidence of active exploitation. The article provides no technical detail on the exploitation method, affected versions, or observed attacker infrastructure, and instead focuses on remediation obligations under Binding Operational Directive 26-04 for Federal Civilian Executive Branch agencies.
- [Security Advisory 2026-010](https://cyfar.ca/posts/security-advisory-2026-010) (2026-08-19): Citrix published a security advisory on 19 August 2026 addressing two critical vulnerabilities in NetScaler ADC and NetScaler Gateway. CVE-2026-19489 is a memory overflow issue that can cause unpredictable behaviour or Denial of Service when SIP ALG is enabled on an LSN group configuration, while CVE-2026-19490 is an authentication bypass using an alternate path affecting appliances configured as a Gateway or AAA virtual server. CERT-EU recommends updating affected NetScaler versions as soon as possible and provides configuration string checks to identify vulnerable precondition states.
- [Cloud Sync Root RegistrationShieldBreak: Hunting Windows Defender Remediation Abuse and Cloud Files Hijacking](https://cyfar.ca/posts/cloud-sync-root-registrationshieldbreak-hunting-windows-defender-remediation-abuse-and-cloud-fil) (2026-08-19): ShieldBreak is a local privilege escalation proof-of-concept that chains Windows Defender's remediation pipeline, Cloud Files API, and NT Object Manager namespace manipulation to write an attacker-supplied DLL to C:\Windows\System32\phoneinfo.dll. The planted DLL is subsequently loaded by wermgr.exe running as SYSTEM via the Windows Error Reporting QueueReporting scheduled task. The exploit functions on fully patched Windows 11 24H2 and Windows Server 2025 systems.
- [Cyber Centre Daily Advisory Digest — 2026-08-19 (1 advisories)](https://cyfar.ca/posts/cyber-centre-daily-advisory-digest-2026-08-19-1-advisories) (2026-08-19): The Canadian Centre for Cyber Security published an advisory regarding security vulnerabilities in multiple Atlassian Data Center and Server products. Atlassian released updates on August 18, 2026. Administrators are advised to review the advisories and apply the necessary patches.
- [Defending Against an Active Threat to Siemens S7 Series PLCs (2026-08-19)](https://cyfar.ca/posts/defending-against-an-active-threat-to-siemens-s7-series-plcs-2026-08-19) (2026-08-19): Threat actors are actively targeting Siemens S7 Series PLCs using AI-generated exploitation scripts and open-source libraries like snap7.dll. The actors use Internet scanning to find exposed PLCs and masquerade their tools as legitimate monitoring software to conduct reconnaissance and prepare for operational effects. Organizations should patch, segment, and monitor S7comm traffic on TCP port 102 to defend against this activity.
- [Describing attacks with crime script analysis](https://cyfar.ca/posts/describing-attacks-with-crime-script-analysis) (2026-08-19): The article introduces crime script analysis (CSA) as a narrative-driven technique for describing cyber attacks alongside or as an alternative to TTP-based frameworks like MITRE ATT&CK. Using a business email compromise (BEC) case study, the author demonstrates how AI can industrialize BEC attacks by automating reconnaissance and social engineering message generation. The article identifies specific intervention points across the seven-step BEC crime script where defenders can disrupt attacker workflows.
- [Fake AI, real malware: Attackers impersonating AI brands](https://cyfar.ca/posts/fake-ai-real-malware-attackers-impersonating-ai-brands) (2026-08-19): The provided article text is a brief abstract stating that Sophos MDR casework over the course of a year identified a pattern of attackers impersonating AI brands to distribute malware. No technical details, indicators of compromise, malware families, or attack chain information are included in the supplied content.
- [Release the RAVEN: Destruction and Discipline](https://cyfar.ca/posts/release-the-raven-destruction-and-discipline) (2026-08-18): RAVEN is an open-source offensive security framework targeting Elasticsearch and Kibana. Part 5 of the series demonstrates the tool's destructive capabilities including index deletion, document wiping, mapping corruption, Meow attack simulation, and five denial-of-service modes. All destructive operations are gated behind a triple-confirmation safety system and logged for auditability, with a cleanup module that reverses reversible actions.
- [CopyCop Targets AI Investment in Armenia](https://cyfar.ca/posts/copycop-targets-ai-investment-in-armenia) (2026-08-18): The Russian influence network CopyCop (Storm-1516) targeted the joint US-Armenian Firebird AI data center in Hrazdan, Armenia, through three documented media impersonation campaigns between June 24 and July 13, 2026. The campaigns used typosquatting domains impersonating TechCrunch and Gizmodo, plus fabricated Iranian military messaging, to disseminate false narratives about earthquake risk, power grid instability, and military targeting of the facility. The third instance achieved over 1.6 million combined views, demonstrating growing reach. CSS stylesheet hash analysis linked the infrastructure to previously confirmed CopyCop domains, and the same amplifier accounts were reused across campaigns targeting different Armenia-linked Western investment projects.
- [CISA Adds Four Known Exploited Vulnerabilities to Catalog (CVE-2026-33824, CVE-2026-55040, CVE-2026-59310 +1 more)](https://cyfar.ca/posts/cisa-adds-four-known-exploited-vulnerabilities-to-catalog-cve-2026-33824-cve-2026-55040-cve-2026) (2026-08-18): CISA added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. The vulnerabilities span Microsoft IKE Service Extensions (double free), Microsoft SharePoint (weak authentication), Broadcom VMware vCenter (path traversal), and Apple macOS (improper authentication). BOD 26-04 requires FCEB agencies to remediate KEV-listed vulnerabilities on publicly exposed assets that grant total control post-exploitation and to check for prior compromise.
- [CISA Malcolm (CVE-2026-55676, CVE-2026-63133, CVE-2026-63134 +3 more)](https://cyfar.ca/posts/cisa-malcolm-cve-2026-55676-cve-2026-63133-cve-2026-63134-3-more) (2026-08-18): CISA disclosed six vulnerabilities in the CISA Malcolm network traffic analysis tool suite. The most severe is CVE-2026-55676 (CVSS 8.8), which allows authenticated users with the upload-only role to upload and execute arbitrary PHP code. Two RBAC bypass vulnerabilities (CVE-2026-63177 and CVE-2026-19670) exploit discrepancies between Nginx routing and the Lua RBAC layer's URI normalization. Two denial-of-service vulnerabilities (CVE-2026-63133 and CVE-2026-19671) exploit resource exhaustion during archive extraction. Patches are available across versions 26.06.1, 26.07.0, and 26.08.0.
- [Siemens Simcenter Nastran (CVE-2026-59086)](https://cyfar.ca/posts/siemens-simcenter-nastran-cve-2026-59086) (2026-08-18): Siemens Simcenter Nastran and Simcenter Femap versions prior to V2606 are affected by a stack-based buffer overflow vulnerability (CVE-2026-59086). The flaw allows remote code execution in the context of the current process when a user is tricked into running an impacted application binary with a malicious string argument. Siemens has released updates and recommends updating to V2606 or later.
- [CoSnitch: When Your AI Assistant Becomes Its Own Whistleblower](https://cyfar.ca/posts/cosnitch-when-your-ai-assistant-becomes-its-own-whistleblower) (2026-08-18): CVE-2026-24301 (CoSnitch) is a critical vulnerability chain in Microsoft Copilot Personal that allows automatic prompt execution via crafted URLs. The chain enables silent data exfiltration from connected OAuth services and persistent memory poisoning via indirect prompt injection through web summarization. The vulnerability was discovered using a technique called meta-hacking, where the AI was manipulated into revealing its own undocumented parameters.
- [A heap of overflow in August’s Patch Tuesday haul](https://cyfar.ca/posts/a-heap-of-overflow-in-augusts-patch-tuesday-haul) (2026-08-18): Microsoft released patches for 423 CVEs in the August Patch Tuesday update. The release did not include any security updates for Microsoft Edge. The author notes a change in the distribution of CWE categories represented in this month's vulnerabilities.
- [PurpleDelta's Fraudulent Employment Operations](https://cyfar.ca/posts/purpledeltas-fraudulent-employment-operations) (2026-08-18): Insikt Group identified clusters of activity linked to PurpleDelta, a North Korean IT worker group operating from China. Between late 2024 and early 2025, the group applied to over 1,100 companies using 22 fabricated personas, leveraging AI tools and identity services to bypass hiring controls. Operators secured employment at over ten organizations, recording internal meetings and using personal devices to maintain access. The operation relies on facilitators to manage company-issued hardware and uses remote desktop tools for persistent access.
- [Staying Ahead of Adversarial AI Through Agentic Source Code Review](https://cyfar.ca/posts/staying-ahead-of-adversarial-ai-through-agentic-source-code-review) (2026-08-18): Google Threat Intelligence Group describes the Agentic Vulnerability Discovery Harness (AVDH), a multi-agent LLM orchestration framework for automated source code vulnerability discovery. The pipeline chains specialized agents through threat modeling, entry point discovery, context enrichment, hypothesis generation, and validation stages, with human expert review gates. AVDH has been used to analyze tens of millions of lines of code, resulting in 12 assigned CVEs and over 100 critical vulnerabilities found during a single incident response engagement in two days.
- [The Pattern Behind 2026's University Breaches](https://cyfar.ca/posts/the-pattern-behind-2026s-university-breaches) (2026-08-18): A pattern of university breaches in 2026 stems from systemic misconfigurations and exposed credentials rather than sophisticated exploits. Decentralized IT governance in higher education creates blind spots where configuration gaps remain unnoticed until opportunistic attackers discover and exploit them. The breaches emphasize that identity and access management, rather than endpoint malware, are the primary damage vectors.
- [From Black Hat to DEF CON: 10 Hacker Summer Camp Standouts](https://cyfar.ca/posts/from-black-hat-to-def-con-10-hacker-summer-camp-standouts) (2026-08-18): Researchers at DEF CON 2026 released CloudBasher, a toolkit that abuses CloudShell IAM design weaknesses across AWS, Azure, and GCP to automate environment discovery and deploy persistent workloads. Separately, indirect prompt injection via MCP was demonstrated as a method to turn blocked WAF requests into malicious instructions for AI agents. Threat actor trial abuse and education sector breaches were also discussed.
- [How a Google Search for Claude Led to MacSync](https://cyfar.ca/posts/how-a-google-search-for-claude-led-to-macsync) (2026-08-18): A malvertising campaign targeting macOS users uses Google sponsored search results to direct victims to a fake Claude installation guide on claude.ai. The guide uses the ClickFix technique, instructing users to paste a curl command into Terminal that downloads the MacSync stealer and RAT. MacSync features a six-stage kill chain that exfiltrates browser data, keychain secrets, and cryptocurrency wallets, and establishes persistence via a Mach-O RAT connecting to a hardcoded IP over WebSocket.
- [Cyber Centre Daily Advisory Digest — 2026-08-18 (4 advisories)](https://cyfar.ca/posts/cyber-centre-daily-advisory-digest-2026-08-18-4-advisories) (2026-08-18): The Canadian Centre for Cyber Security published four security advisories on 2026-08-18 covering vulnerabilities in JetBrains, BeyondTrust, GitLab, and Mattermost products. The advisories list specific vulnerable versions and encourage administrators to apply updates as they become available.

## Machine-Readable Feeds

- [Sitemap](https://cyfar.ca/sitemap.xml)
- [IOC Index](https://cyfar.ca/iocs)