Cybersecurity Brief – 2026-09-01

Tue, 01 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

Berlin’s city administration confirmed data theft following a Rhysida ransomware attack, with cybercriminals attempting extortion after listing the city on a data leak site ^[18].
Hackers stole personal and health information affecting 9.5 million individuals from Aesto Health’s AWS infrastructure ^[33].
McKesson, a healthcare company, acknowledged a data breach after ShinyHunters claimed to have stolen hundreds of millions of records ^[42].
Nutex Health notified the SEC of a ransomware attack that compromised patient, employee, provider, business, and financial data ^[31].
Anthropic users were impacted by infostealer attacks, with session cookies stolen to gain access to Claude AI accounts and consume usage ^[19]^[41].
METR, an AI evaluation non-profit, suffered the theft of an API key, leading to the consumption of approximately $600,000 in AI credits ^[4].
Five Venezuelan nationals pleaded guilty in the US to ATM jackpotting attacks that involved attempting to physically install malware on ATMs to dispense cash ^[10]^[30].
The Cronos blockchain network was restarted after a price-manipulation exploit on the Tectonic lending platform enabled the theft of $74 million ^[12].

Newly Discovered Vulnerabilities

Nearly 22,000 Microsoft Exchange servers remain unpatched and exposed to a high-severity authentication bypass vulnerability, allowing attackers to hijack user mailboxes ^[9].
Two critical vulnerabilities in PaperCut NG and MF print management software (CVE-2026-82078 and CVE-2026-81578) are being actively exploited in data theft attacks; CISA has added these to its Known Exploited Vulnerabilities (KEV) catalog ^[11]^[35].
A critical authentication bypass vulnerability in JFrog Artifactory (CVE-2026-82329) is being exploited in the wild just days after disclosure ^[32].
WatchGuard patched three critical vulnerabilities in its Fireware OS iked process that could allow unauthenticated remote code execution ^[34].
ServiceNow patched three critical code injection vulnerabilities that could allow attackers to execute arbitrary code and access or tamper with data ^[37].
A critical flaw in Langflow (CVE-2026-0768) is under active exploitation, allowing unauthenticated remote execution of arbitrary Python code ^[6]^[29].
Kaspersky patched a vulnerability in its Endpoint Security product exploited by the Nightmare Eclipse group using the ‘HardBreacher’ technique ^[36].
Critical vulnerabilities in Ruby on Rails are being exploited for credential-probing and command and control activity ^[6].
JSCeal, a stealer targeting cryptocurrency applications, is delivered as compiled V8 bytecode and executed by a bundled Node.js runtime ^[38].

Notable Threat Actor Activity

Mirage Kitten, an Iran-linked threat actor, is targeting aviation and FinTech sectors across the Middle East and Africa with new malware families NodeRabbit (Node.js) and PollCat (JavaScript) ^[1].
The Russia-aligned UAC-0099 group is using a new technique, GuardBreaker, to plant nuclear weapon prompts in malware aimed at disrupting AI analysis in Ukraine ^[5].
North Korean threat actors are expanding job fraud operations beyond IT into healthcare and sales, seeking illicit employment in new sectors ^[7].
The Chinese Fire Ant group is using Cisco routers as spying platforms by establishing unauthorized GRE tunnel interfaces ^[16].
Rhysida ransomware is actively extorting the city of Berlin following a successful attack ^[18].
The Nightmare Eclipse group is exploiting a Kaspersky Endpoint Security vulnerability with a tool called ‘HardBreacher’ ^[36].

Trends, Tools, or Tactics of Interest

Abuse of enterprise collaboration tools by threat actors has increased fourfold in the past year as attackers use these platforms to evade detection ^[2].
The TerminalFix campaign, a variant of ClickFix, uses fake Cloudflare CAPTCHA prompts to trick users into executing malicious PowerShell commands, establishing reverse tunnels for deeper network access ^[13]^[20]^[40].
Infostealers are being used to hijack AI service accounts such as Anthropic’s Claude by stealing session cookies, enabling unauthorized access and usage ^[19]^[41].
Attackers are exploiting critical vulnerabilities in Langflow and Rails for credential harvesting and establishing command and control channels ^[6]^[29].
A router backdoor was observed where devices shipped with remote access enabled, allowing attackers to collect traffic and credentials and then erase logs ^[8].
Researchers demonstrated that AI models, such as Claude, can be used to port PLC exploits between device models quickly, reducing the barrier for industrial exploit development ^[28].
Job fraud tactics by North Korean actors are diversifying to include healthcare and sales roles ^[7].
JSCeal stealer is delivered in compiled V8 bytecode format and executed by a bundled Node.js runtime, targeting cryptocurrency users ^[38].

Regulatory or Policy Developments Affecting the Security Industry

CISA added the actively exploited PaperCut vulnerabilities (CVE-2026-82078 and CVE-2026-81578) to its Known Exploited Vulnerabilities catalog, signaling increased urgency for patching ^[35].
Nutex Health disclosed its ransomware breach to the SEC, reflecting regulatory requirements for timely breach notification ^[31].

Sources

Berlin confirms data theft after Rhysida ransomware attack claims - bleepingcomputer.com
9.5 Million Impacted by Aesto Health Data Breach - securityweek.com
McKesson confirms cyber incident after ShinyHunters claims patient-data theft - malwarebytes.com
Ransomware Gang Claims Nutex Health Data Breach - securityweek.com
Anthropic Users Hit by Infostealer Attacks, Session Thefts - darkreading.com
Infostealers are hijacking Claude accounts at users’ expense - malwarebytes.com
Attackers Steal METR API Key and Consume AI Credits Worth About $600,000 - thehackernews.com
Five Venezuelans plead guilty to ATM jackpotting attacks in US - bleepingcomputer.com
Five Venezuelans Plead Guilty in US Court to ATM Jackpotting - securityweek.com
Cronos blockchain restarts after $74 million Tectonic exploit - bleepingcomputer.com
Nearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks - bleepingcomputer.com
Recently patched PaperCut zero-days used in data theft attacks - bleepingcomputer.com
PaperCut Exploitation Escalates to Active Intrusions - securityweek.com
Critical JFrog Artifactory Vulnerability Reportedly Exploited in the Wild - securityweek.com
WatchGuard Patches Critical Vulnerabilities - securityweek.com
ServiceNow Patches 3 Critical Code Injection Vulnerabilities - securityweek.com
Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity - thehackernews.com
Hackers Start Exploiting Critical Langflow Vulnerability - securityweek.com
Nightmare Eclipse Drops ‘HardBreacher’ Kaspersky Product Exploit - securityweek.com
Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode - research.checkpoint.com
Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set - securelist.com
Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis - thehackernews.com
North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales - thehackernews.com
Chinese Fire Ant hackers turn Cisco routers into spying platforms - bleepingcomputer.com
Attackers Abuse Enterprise Collaboration Tools to Avoid Detection - blog.knowbe4.com
Microsoft warns of TerminalFix attacks deploying reverse tunnels - bleepingcomputer.com
'TerminalFix' Campaign Weaponizes PowerShell for Enterprise Attacks - darkreading.com
TerminalFix looks like ClickFix, but delivers a very different payload - malwarebytes.com
⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More - thehackernews.com
Experiment: Porting a PLC Exploit With AI Takes Hours and Hundreds of Dollars - securityweek.com

CVE-2026-81578 on DanSec Daily

Cybersecurity Brief – 2026-09-01

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Sources