6 mincritical
21st September – Threat Intelligence Report - Check Point Research
Critical CVEs in Cisco ISE (actively exploited) and Check Point Security Management require immediate patching; supply chain and phishing campaigns target multiple sectors globally. Multiple vendors released critical patches this week: Check Point (CVSS 9.8 stack overflow), Cisco ISE (CVSS 10.0, actively exploited), Oracle (800+ fixes), and BIND 9 (DoS via DNS-over-HTTPS). Brevo supply chain attack compromised 100,000 websites. North Korean WaterPlum campaign infected 30,000+ devices globally.
Sens:■ ImmediateConf:medium
IOCs4
4cve
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Patch Cisco ISE immediately — CVE-2026-76460 is actively exploited
- Apply Check Point Security Management patch for CVE-2026-91843
- Update BIND 9 to version 9.21.26 or 9.20.29
- Rotate Cloudflare API keys if using Brevo components
Key Takeaways
- CVE-2026-76460 on Cisco ISE has CVSS 10.0 and is actively exploited by unauthenticated remote attackers.
- WaterPlum (Contagious Interview) infected 30,000+ devices across 100+ countries, stealing from 7,000+ crypto wallets.
- GhostCode phishing kit abuses OAuth 2.0 device authorization flow to access Microsoft 365 without stealing passwords.
- HEAVYGRAM backdoor linked to Iranian Handala group uses Telegram for C2, targeting dissidents and journalists.
- Oracle September 2026 CPU addresses 800+ vulnerabilities across 17 product families, 100+ rated critical.
Attack Chain
- Initial Access: WaterPlum operators pose as AI or blockchain employers targeting IT professionals
- Execution: Malware deployed to victim devices across more than 100 countries
- Credential Access: Credentials and cryptocurrency stolen from over 7,000 wallets
- Impact: 30,000+ devices compromised December 2025 through July 2026
Affected Systems
- Check Point Security Management and Log Servers R80-R82
- Cisco ISE
- Cisco Secure Email Gateway
- BIND 9 versions before 9.21.26 and 9.20.29
- Oracle E-Business Suite, Fusion Middleware, Hyperion, Siebel CRM
- Microsoft 365 accounts
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-91843 | Check Point Security Management and Log Servers | 9.8 | Stack overflow in login process allows unauthenticated remote code execution as root. |
| CVE-2026-76460 | Cisco ISE and Secure Email Gateway | 10.0 | Unauthenticated remote attacker gains access to system management interface; actively exploited. |
| CVE-2026-76461 | Cisco ISE and Secure Email Gateway | 9.8 | Critical vulnerability in Cisco ISE and Secure Email Gateway. |
| CVE-2026-77692 | BIND 9 | High | Single crafted DNS-over-HTTPS request crashes named process causing denial of service. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Backdoors with screenshot, file theft, and command execution behaviors are EDR-visible; no specific indicators published. |
| Network Visibility | Low | No network IOCs published; Telegram C2 over HTTPS blends with legitimate traffic. |
| Detection Difficulty | Hard | Attacks abuse legitimate services and protocols; no signatures or IOCs published for direct matching. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| OAuth device authorization flow requests for Microsoft 365 from unexpected locations or devices (T1556) | Microsoft 365 sign-in and OAuth audit logs | Credential Access | Medium — legitimate device-code flows common in enterprise |
| Telegram API network connections from processes other than the Telegram client application (T1071.001) | EDR network connection telemetry | Command and Control | Low — Telegram not typically installed on servers |
| Browser extensions requesting permissions for microphone, camera, or file system access (T1176) | Browser extension policy and audit logs | Persistence | Medium — some legitimate extensions request these |
| DNS-over-HTTPS requests causing named process crashes in BIND 9 (T1499) | BIND 9 query logs and system logs | Impact | Low — named crashes are unusual events |
Required Log Sources
- DNS query logs for BIND DoS
- VPN appliance authentication logs
- Microsoft 365 OAuth authentication logs
- Web application firewall logs
- EDR process and network telemetry
- Browser extension permission audit logs
Key Behavioral Indicators
- Unexpected OAuth device code authentication for Microsoft 365
- Telegram API connections from non-Telegram processes
- Browser extensions requesting microphone, camera, file access
- VPN appliance authentication anomalies preceding data breach
- Crafted DNS-over-HTTPS requests causing named process crashes
Control Gaps
- Standard MFA does not prevent OAuth device-code flow abuse
- Network signatures cannot distinguish Telegram C2 from legitimate traffic
- Supply chain attacks via third-party API keys bypass perimeter controls
- Browser extension permissions are often not centrally managed
False Positive Assessment
Medium — Article describes abuse of legitimate services (OAuth, Telegram, Cloudflare API, browser extensions) which can generate false positives in broad detections.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Apply Oracle September 2026 Critical Security Patch Update
- Block device-code OAuth flow for Microsoft 365 where possible
- Restrict Telegram API traffic from server networks
- Audit and centralize browser extension permission management
User Protection
- Warn IT professionals about fake AI and blockchain employer recruitment
- Review browser extensions for excessive permissions
- Enable MFA on all cloud and API management consoles
- Monitor cryptocurrency wallet activity for unauthorized access
Security Awareness
- Train employees to verify recruiter identities through official channels
- Brief staff on device-code phishing prompts targeting Microsoft 365
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping14 techniques
Tactic
Initial Access
Tactic
Persistence
Tactic
Credential Access
Tactic
Command and Control
Plain-Language Summary
Hackers exploited security flaws in government and corporate systems worldwide, exposing millions of user records. Several critical vulnerabilities in Cisco, Check Point, and Oracle products are being actively exploited and need urgent software updates. Organizations should update affected systems immediately and warn employees about fake employer recruitment scams.
Showing defanged values
- cveCVE-2026-76460Unauthenticated remote attacker gains access to system management interface; actively exploited.
- cveCVE-2026-76461Critical vulnerability in Cisco ISE and Secure Email Gateway.
- cveCVE-2026-77692Single crafted DNS-over-HTTPS request crashes named process causing denial of service.
- cveCVE-2026-91843Stack overflow in login process allows unauthenticated remote code execution as root.