7 mincritical
14th September – Threat Intelligence Report - Check Point Research
Microsoft patches 974 flaws including two actively exploited zero-days; GitLab and MikroTik fix critical CVEs; GoldFactory and BlueMoon campaigns target banking and browser users. Microsoft's September 2026 Patch Tuesday addresses 974 vulnerabilities including two actively exploited privilege escalation zero-days. GitLab fixed a CVSS 10.0 unauthenticated path traversal flaw. MikroTik patched two chainable RouterOS bugs enabling passwordless SSH and full admin takeover. The GoldFactory group abused Android Work Profiles to clone banking apps, and BlueMoon combined V8 and Windows flaws for browser-to-system compromise.
Sens:■ Immediate
IOCs7
7cve
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Patch Microsoft Windows immediately for CVE-2026-85880 and CVE-2026-81963
- Update GitLab to 19.1.8, 19.2.6, or 19.3.2 to fix CVE-2026-85706
- Update MikroTik RouterOS to fix CVE-2026-67276 and CVE-2026-86060
- Patch Metabase instances for CVE-2026-72898
Key Takeaways
- Microsoft Patch Tuesday set a record with 974 vulnerabilities, including two actively exploited zero-days.
- GitLab CVE-2026-85706 allows unauthenticated arbitrary file read via repository commits API; CVSS 10.0.
- MikroTik CVE-2026-67276 and CVE-2026-86060 chain for passwordless SSH and full admin on RouterOS.
- GoldFactory's Vwork tool clones banking apps via Android Work Profile; 1,469 devices compromised in Indonesia.
- BlueMoon exploit chain combines two Chromium V8 bugs with a Windows flaw for sandbox escape and privilege escalation.
Attack Chain
- Initial Access: Attackers exploit CVE-2026-72898 SQL injection in Metabase to access internal database at Mathspace
- Initial Access: Criminals use stolen credentials from police officer's device to access Florida DMV records
- Execution: GoldFactory deploys Vwork tool to clone banking apps via Android Work Profile functionality
- Exploitation: BlueMoon chains two Chromium V8 type confusion bugs with a Windows flaw for sandbox escape
- Privilege Escalation: CVE-2026-85880 and CVE-2026-81963 actively exploited for local privilege escalation to SYSTEM
- Persistence: MikroTik RouterOS bugs chained for passwordless SSH access and full admin control of exposed routers
Affected Systems
- Microsoft Windows (September 2026 Patch Tuesday)
- GitLab Community and Enterprise Editions 18.7–19.3.1
- MikroTik RouterOS
- Google Chrome (Chromium V8 engine)
- Metabase self-hosted instances
- Android devices (GoldFactory banking fraud)
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-72898 | Metabase | SQL injection exploited to access internal reporting database at Mathspace. | |
| CVE-2026-85880 | Microsoft Windows | High | Actively exploited zero-day allowing local attackers to elevate privileges to SYSTEM. |
| CVE-2026-81963 | Microsoft Windows Update Stack | High | Actively exploited zero-day allowing local privilege escalation to SYSTEM. |
| CVE-2026-85706 | GitLab Community and Enterprise Editions | Critical | Unauthenticated path traversal via repository commits API allowing arbitrary file read. |
| CVE-2026-67276 | MikroTik RouterOS | Chainable with CVE-2026-86060 to obtain passwordless SSH access and elevate to admin. | |
| CVE-2026-86060 | MikroTik RouterOS | Chainable with CVE-2026-67276 for passwordless SSH and full administrator escalation. | |
| CVE-2026-85046 | Google Chrome (Chromium V8) | Type confusion in V8 engine used in BlueMoon exploit chain for browser compromise. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Privilege escalation and browser exploit chains produce process-level telemetry; router and database exploitation may lack endpoint visibility. |
| Network Visibility | Medium | Router SSH access and Metabase SQL injection generate network logs; encrypted channels and cloned app traffic may evade detection. |
| Detection Difficulty | Hard | Diverse attack surfaces from browser exploits to router takeover require multi-layer telemetry and correlation across endpoints, network, and applications. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Local privilege escalation activity on Windows via CVE-2026-85880 or CVE-2026-81963 (T1068) manifesting as unusual SYSTEM-level process creation from non-admin contexts. | Windows Security Event ID 4688 with process lineage | Privilege Escalation | Low — SYSTEM token from standard user is anomalous |
| Unauthenticated path traversal against GitLab commits API (T1190) producing file read requests for non-repository paths. | GitLab access logs and reverse proxy logs | Initial Access | Low — traversal patterns in API paths are rare |
| Android Work Profile creation followed by banking app cloning behavior (T1212) indicating GoldFactory Vwork tool deployment. | Android MDM work profile and app install logs | Execution | Medium — legitimate work profile use is common |
| Chromium V8 type confusion exploitation (T1055) producing child processes with unexpected parent relationships or crash dumps preceding code execution. | Process telemetry and browser crash logs | Exploitation | Medium — browser crashes occur normally |
Required Log Sources
- Windows Event Logs (Security)
- Process creation and command-line logs
- Web application firewall logs
- Router SSH and admin logs
- DNS query logs
- Android MDM or EDR logs
Key Behavioral Indicators
- Standard user context spawning SYSTEM-level processes on Windows
- GitLab API requests containing path traversal sequences in commit endpoints
- New Android Work Profile creation followed by banking app installation
- Chromium process crash followed by unexpected child process execution
- RouterOS SSH login without password from new source IP
- Metabase SQL queries accessing non-application databases
Control Gaps
- Network IPS may not detect encrypted router SSH sessions using stolen credentials
- Endpoint detection lacks visibility into Android Work Profile app cloning
- WAF rules may not catch Metabase SQL injection via internal reporting interfaces
- Browser exploit chains bypass sandbox controls when combined with OS flaws
False Positive Assessment
Low — Exploit chains and zero-day activity described are specific and unlikely to match benign behavior in most environments.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Restrict RouterOS SSH access to management networks only
- Disable GitLab repository commits API for unauthenticated users if patching is delayed
- Deploy Check Point IPS signatures for referenced CVEs
- Monitor exposed router configurations for unauthorized DNS or traffic changes
User Protection
- Update Google Chrome to latest version to mitigate BlueMoon V8 exploitation
- Deploy mobile threat defense on Android devices to detect Work Profile abuse
- Enforce MFA on Microsoft 365 accounts targeted by passkey phishing campaign
- Block lookalike Microsoft 365 sign-in pages at web proxy or DNS level
Security Awareness
- Warn employees about passkey-themed social engineering calls and texts targeting Microsoft 365
- Train staff to verify government agency email requests through independent channels
- Advise users to report unexpected Android Work Profile creation prompts
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping13 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Privilege Escalation
Tactic
Stealth
Plain-Language Summary
Attackers exploited software flaws at several companies, exposing personal data of millions of people. Microsoft released fixes for a record 974 vulnerabilities, including two already being used by attackers. GitLab and MikroTik also patched critical bugs that could let attackers read files or take over routers. Separately, a criminal group called GoldFactory cloned banking apps on Android phones to steal money, and a tool called BlueMoon combined browser and Windows flaws to take over computers. Organizations should apply available patches immediately and review access to exposed services.
Showing defanged values
- cveCVE-2026-67276Chainable with CVE-2026-86060 to obtain passwordless SSH access and elevate to admin.
- cveCVE-2026-72898SQL injection exploited to access internal reporting database at Mathspace.
- cveCVE-2026-81963Actively exploited zero-day allowing local privilege escalation to SYSTEM.
- cveCVE-2026-85046Type confusion in V8 engine used in BlueMoon exploit chain for browser compromise.
- cveCVE-2026-85706Unauthenticated path traversal via repository commits API allowing arbitrary file read.
- cveCVE-2026-85880Actively exploited zero-day allowing local attackers to elevate privileges to SYSTEM.
- cveCVE-2026-86060Chainable with CVE-2026-67276 for passwordless SSH and full administrator escalation.