← All threat briefs

Cybersecurity Brief — 2026-08-22

SECURITY // 2026-08-22

Cybersecurity Brief — 2026-08-22

Supply Chain & Malware

  • 14 trojanized npm packages deliver RedC2 4.0 Linux backdoor with AI-assisted C2 — Researchers at Trend Micro discovered 14 malicious npm packages (e.g., streak-metrics-math, kit-map-vim, streak-map-cache) that masquerade as functional calendar/streak utilities but silently drop the RedShell Linux beacon for RedC2 4.0, an AI-powered cross-platform C2 framework. The trojan loader in dist/index.mjs executes the bundled implant on a single import — no install hook required. The packages are fully functional, masking the payload beneath legitimate date-utility code. RedC2 4.0, advertised by threat actor "MarlboroMan" on Hack Forums in June 2026, supports terminal access, file transfer, in-memory BOF/.NET/shellcode execution, and network pivoting. (Source: The Hacker News)

  • CISA adds three actively exploited flaws to KEV catalog — On August 5, CISA added CVE-2026-9198 (Langflow RCE, CVSS 9.8), CVE-2026-34486 (Apache Tomcat missing encryption, CVSS 7.5), and CVE-2026-18556 (N-able N-central auth bypass, CVSS 8.2) to its Known Exploited Vulnerabilities catalog. Langflow has seen 650 exploitation attempts from 244 unique IPs across 41 countries since July 6. The Tomcat flaw (CVE-2026-34486) is being exploited by a Chinese-speaking threat actor (aliases knaithe/KnYuan, based in Zhuhai) using DeepSeek via the Hermes Agent framework as an autonomous offensive operator — the AI narrowed targeting scope to conserve compute and pivoted to other CVEs (n8n, Citrix NetScaler, Marimo, IKE VPN) when initial Langflow exploits failed. The campaign delivered SNOWLIGHT, a C-based Linux dropper/loader, across 100+ countries between April–June 2026. (Source: The Hacker News)

Windows Internals & Defense Evasion

  • Microsoft Defender's own BTR.sys driver weaponized to delete security software at boot — Check Point Research disclosed "BTR Reforged," a technique that abuses Microsoft Defender's legitimately signed boot-time remediation driver (BTR.sys) to perform arbitrary kernel-level file/registry operations on Windows 7 through Windows 11 25H2. The driver is a required Windows component and cannot be blocklisted without breaking Defender. Researcher Jiří Vinopal reverse-engineered the RC4-encrypted transaction protocol (static 256-byte key unchanged across 18 builds since Windows 7) and released proof-of-concept tool BTR_CLI, which installs the driver via direct HKLM registry writes (bypassing Service Control Manager, generating no Event ID 7045). During the "golden window" after filesystem becomes writable but before Defender user-mode services start, BTR.sys can delete security binaries (e.g., MsMpEng.exe, MpCmdRun.exe) before they lock themselves. A live Black Hat demo showed full Defender stack removal on a fully patched Windows 11 25H2 machine with Tamper Protection active. Exploitation requires SeLoadDriverPrivilege (admin). MSRC stated findings don't meet criteria for immediate servicing since they rely on pre-existing admin privileges. No evidence of real-world abuse observed. (Source: The Hacker News)

Privacy & Adtech Intelligence

  • DecryptAds launches free service to map adtech supply chains, expose geo-risk partners — Krebs on Security profiles DecryptAds, a new free service that scrapes and cross-references ads.txt, app-ads.txt, and sellers.json/buyers.json files to build a complete picture of the adtech ecosystem for any site or app. A search for espn.com reveals 143 ad partners and 19 registered data broker domains; nearly half collect geolocation data, three collect device fingerprints and sensitive PII. DecryptAds flags "geo-risk" partners based in Russia, China, UAE, and Cyprus. It identified Russian adtech firm Between Digital (listing a NYC address but processing payments through sanctioned Alfa Bank) on espn.com and multiple U.S. military news sites (armytimes.com, airforcetimes.com, defensenews.com, navytimes.com, marinecorpstimes.com, federaltimes.com). Between Digital collects ad data on ~55,000 partner websites. The service aims to detect malicious ads, adversarial-nation ad networks, and AI-generated slop sites — threats invisible when viewing a single adtech file in isolation. (Source: Krebs on Security)