← All threat briefs

Cybersecurity Brief - 2026-09-21

SECURITY // 2026-09-21

Cybersecurity Brief — 2026-09-21

Threat Activity

  • North Korean Jade Sleet (PUKCHONG/Slow Pisces/TraderTraitor/UNC4899) compromises Indian IT provider via macOS backdoors FLATROOF and ROOFDECK — SentinelOne attributed the breach of a small India-based IT services firm to Jade Sleet, a DPRK group with a history of cryptocurrency heists (including the $1.5B Bybit theft via Safe{Wallet} supply chain compromise). The attack used job-interview lures with weaponized Terraform dependency lock files (.terraform.lock.hcl) pointing to malicious domains like registry.hashicorp-aws[.]com, triggering attacker-controlled modules on terraform init. Two Rust-based backdoors were deployed on ARM macOS: FLATROOF uses Telegram for C2 and steals browser data, Terminal history, and login.keychain-db; ROOFDECK uses the Nostr protocol for decentralized C2 with signed commands verified via embedded public key. The implants remained dormant from March 18–29, 2026, activating when the victim opened a Cursor workspace. (Source: The Hacker News)

  • ClickFix lures deliver new ChainScript RAT using Polygon blockchain for C2 rotation — Blackpoint APG documented a previously unknown RAT called ChainScript (build names: ComponentTask33, UpdateDigital, HostShared, OrchidViolet66) masquerading as Spotify, Zoom Workplace, and Microsoft Teams installers. The attack chain starts with ClickFix-style lures leading to a malicious MSI (ComponentTask33-4d14e6ac.msi) that deploys Node.js and launches the ChainScript JavaScript agent via hidden PowerShell/VBScript stages. ChainScript achieves persistence via scheduled task + Registry Run key fallback, communicates over WebSockets, and provides full RAT capabilities: interactive CMD/PowerShell, file ops, screenshots, payload deployment, crypto wallet enumeration (desktop apps + browser extensions), and remote JavaScript execution. C2 infrastructure is discovered via a Polygon smart contract (EtherHiding-style), allowing operators to redirect implants to new infrastructure without updating the malware. Related: HBO Max's verified Reddit account (u/hbomax) was hijacked to serve 108 malicious ClickFix ads over 48 hours in mid-September, delivering MacSync/AMOS on macOS and Amatera Stealer + clippers on Windows. (Source: The Hacker News)

Vulnerabilities & Exploits

  • Cisco ISE authentication bypass (CVE-2026-76460, CVSS 10.0) under active exploitation — Cisco disclosed a maximum-severity flaw in Identity Services Engine (ISE) and ISE Passive Identity Connector allowing unauthenticated remote attackers to bypass authentication via insufficient controls on an API endpoint. Successful exploitation grants root command execution. Fixed in: 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, 3.51 Patch 4. Cisco confirmed active exploitation; CISA added to KEV catalog (Sept 16) requiring FCEB agencies to patch by Sept 19. No workarounds exist; iACLs recommended as mitigation. IoC: review access.log for suspicious usernames (e.g., dummyuser). This follows days after CVE-2026-76461 (CVSS 9.8) in Cisco Secure Email Gateway AsyncOS also confirmed exploited. (Source: The Hacker News)

  • China-linked UTA0560 and JungleBamboo (APT31) exploit Chrome-Windows zero-day chain (BlueMoon) to deploy GRIMWEDGE and LONGTALE — Volexity attributed a Sept 1 spear-phishing campaign targeting NGOs to UTA0560. The chain exploits three flaws: CVE-2026-85046 (V8 sandbox arbitrary read/write), CVE-2026-87491 (browser sandbox escape), CVE-2026-85880 (Chrome process code injection). Payload: msgbox.exe loader → wsc.dll DLL sideloading → MSI installer with obfuscated JavaScript backdoor (GRIMWEDGE) polling ocr.opusaccel[.]top for eval()-executed commands (recon, file/process mgmt, command execution, payload delivery). Separately, JungleBamboo used the same chain to deploy SUPERSTOMP loader → LONGTALE Chrome extension (masquerading as Google Gemini, ID: ckiknalbeplpcpofpnabcnhjcegckfei) for credential theft and surveillance. Near-simultaneous use by multiple China-nexus actors suggests possible exploit sharing/reverse-engineering. (Source: The Hacker News)

  • Public exploits released for four Linux kernel local root flaws (DirtyAH6, TUNderflow, PPPoEject, DiagSpill) — Researcher Asim Manizada published working exploit code for four kernel vulnerabilities (CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469) after coordinated disclosure. All fixed in stable kernels: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, 7.2.4. Three require unprivileged user namespaces (enabled by default on many distros); DiagSpill requires only SCTP module. No in-the-wild exploitation reported; exploits are build-specific and can crash systems. Primary risk: shared/multi-user systems where local privilege escalation enables full takeover. Check distro advisories for backported fixes. (Source: The Hacker News)

  • WordPress Click2Shell flaw (CVSS 7.1 core, 9.6 chained) forces theme install, chains to RCE — pwn.ai disclosed a flaw in WordPress core (fixed in 7.1.1, backported to 4.7+) where a crafted URL opened by a logged-in admin automatically installs an attacker-chosen theme from WordPress.org without clicking "Install." The installed theme remains inactive but can execute PHP during Customizer preview. Chained with a vulnerable theme (Mobile Repair Zone) containing an unauthenticated background handler that downloads and executes packages, full RCE is achieved (CVSS 9.6). No CVE assigned yet; no workaround beyond updating. Related: wp2shell (July, no login/click needed) is listed in CISA KEV as exploited; Click2Shell is not. (Source: The Hacker News)

  • Critical Check Point Management flaw allows unauthenticated RCE as root — (Source: The Hacker News, from "Top Stories This Week" listing)

  • Critical Unbound DNSSEC validator flaw could allow RCE via malicious DNS zone — (Source: The Hacker News, from "Top Stories This Week" listing)

  • Cisco Secure Email Gateway flaw (CVE-2026-76461, CVSS 9.8) exploited in the wild — (Source: The Hacker News)

Data Privacy & Policy

  • Data broker Radaris loses domains in New Jersey "Daniel's Law" privacy lawsuit — A judge ordered transfer of radaris.com and over a dozen sister data broker domains to plaintiffs (Atlas Data Privacy Corp) after Radaris repeatedly ignored removal requests for law enforcement officials' personal info. Daniel's Law provides $1,000/violation fines. Radaris (operated by Russian-born Lubarsky brothers in MA) used shell entities across Marshall Islands, BVI, Seychelles, and Cyprus to evade accountability; a 2017 class action default judgment of $7.5M was similarly evaded via domain transfer appeals. The court found the Marshall Islands entity claimed as operator didn't exist. (Source: Krebs on Security)