Friday 11 September 2026

Major Incidents or Breaches

• Attackers chained two vulnerabilities in JFrog Artifactory to gain administrator control of self-hosted servers and plant backdoors, impacting the integrity of software build pipelines ^[1].
• Trezor reported that phishing attacks targeting its customers leveraged data from a previous Brevo breach, with 347,000 email addresses targeted and 2,500 users clicking on malicious links ^[9].
• Identity verification provider IDScan confirmed a breach in its cloud platform that exposed customer data, linked to a database containing over 153 million stolen driver’s licenses ^[17].
• Surfshark VPN disclosed that hackers accessed an internal test server due to a configuration error, exposing engineering materials and internal configurations ^[13][31].

Newly Discovered Vulnerabilities

• GitLab urged immediate patching of a maximum-severity path traversal vulnerability (CVE-2026-85706) affecting its servers ^[7].
• Check Point released patches for two critical VPN vulnerabilities (CVE-2026-85102 and CVE-2026-85103) that could allow remote code execution ^[29].
• Cisco revealed that two recently patched Secure Firewall Management Center (FMC) vulnerabilities have been actively exploited by ransomware and state-sponsored threat actors ^[4][16].
• Multiple cyber-espionage groups exploited a new “BlueMoon” exploit kit that leveraged zero-day vulnerabilities in Microsoft Windows and Google Chrome ^[18][39].
• PaperCut issued a new maintenance release replacing previous emergency patches for two flaws that were under active exploitation ^[3].
• JFrog Artifactory flaws were chained to escalate privileges and implant backdoors ^[1].
• A path traversal flaw in GitLab and critical flaws in Check Point VPN products were highlighted as requiring urgent attention ^[7][29].

Notable Threat Actor Activity

• A China-linked group, UNC3569, exploited a flaw in the Sogou Input Method to deploy the GRAYRABBIT backdoor on Windows systems ^[2].
• Three distinct threat clusters, including ransomware and state-sponsored groups, exploited Cisco FMC vulnerabilities for credential theft and ransomware deployment, including Qilin ransomware ^[4][16].
• A Russian-speaking threat actor used hundreds of AI agents to automate the exploitation of PaperCut flaws, compromising 395 organizations globally ^[15][33].
• Multiple espionage groups used the BlueMoon exploit kit to target recent Windows and Chrome vulnerabilities ^[18][39].
• The GoldFactory threat group exploited the Android Work Profile feature to deliver the Gigabud Trojan in Indonesia, while the Mantax Otax malware, which combines ransomware and spyware features, spread separately ^[20][11].
• Russian hackers reportedly used Anthropic’s Claude AI to automate malware evasion and targeted AI vendor infrastructure, including an attempt to steal a pre-release model ^[32].
• A disgruntled researcher known as Nightmare-Eclipse released a new zero-day exploit (“ShieldCrash”) for Windows Defender ^[22].
• Threat actors leveraged Microsoft Graph API to identify targets and pass access to extortion groups such as ShinyHunters ^[21].

Trends, Tools, or Tactics of Interest

• The BlueMoon exploit kit was used by at least four espionage groups to leverage recently fixed Windows and Chrome flaws, indicating rapid adoption of exploit kits for zero-day vulnerabilities ^[18][39].
• AI-powered attacks are increasingly being used to automate the exploitation of vulnerabilities, as seen in the PaperCut incidents ^[15][33].
• Threat actors are abusing Google Play’s Early Access program to distribute thousands of deceptive Android apps promising money, rewards, and premium content ^[6].
• New Android malware, Mantax Otax, was identified as combining ransomware, spyware, and harassment capabilities ^[11].
• Researchers demonstrated a new prompt-crafting technique (PuzzleMask) for bypassing LLM-based policy checks using plain English, highlighting emerging covert AI attack vectors ^[38].
• Identity-based attacks accounted for approximately half of all confirmed malicious activity in a recent quarter, with four primary attack patterns identified ^[19].

Regulatory or Policy Developments Affecting the Security Industry

• A Ukrainian national involved in Conti ransomware operations was sentenced to four years in prison for attacks conducted between 2021 and 2022 ^[10][28].

Sources

1. Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors - thehackernews.com
2. Trezor: 347,000 users targeted in phishing attacks after Brevo breach - bleepingcomputer.com
3. IDScan confirms breach tied to 153 million stolen driver’s licenses - bleepingcomputer.com
4. Surfshark VPN says hackers breached internal testing, proxy servers - bleepingcomputer.com
5. Surfshark Systems Targeted by Hackers - securityweek.com
6. GitLab urges users to patch max severity path traversal flaw - bleepingcomputer.com
7. Check Point Patches Critical VPN Vulnerabilities - securityweek.com
8. Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware - thehackernews.com
9. Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers - bleepingcomputer.com
10. New 'BlueMoon' kit exploited Windows and Chrome zero-day flaws - bleepingcomputer.com
11. BlueMoon exploit kit turns Chrome and Windows flaws into attacks - malwarebytes.com
12. PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws - thehackernews.com
13. China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor - thehackernews.com
14. AI-powered attack exploited PaperCut flaws to hack 395 organizations - bleepingcomputer.com
15. PaperCut Flaws Exploited in AI-Powered Attacks - securityweek.com
16. Indonesia Hit by Android Banking App-Cloning Campaign - darkreading.com
17. New Android malware encrypts files, steals data, and harasses victims - bleepingcomputer.com
18. Anthropic Says Russian Hackers Used Claude AI to Automate Malware Evasion - securityweek.com
19. Nightmare-Eclipse Strikes Again With 'ShieldCrash' Windows Exploit - darkreading.com
20. Voice Callers Exploit BYOD to Reach Microsoft 365, Corporate Data - darkreading.com
21. Google Play Early Access Abused to Push Thousands of Deceptive Android Apps - thehackernews.com
22. PuzzleMask: Abusing Plain Prose as a Covert AI Attack Vector - research.checkpoint.com
23. The Top 4 Threats We Found by Investigating Every Alert for a Quarter - bleepingcomputer.com
24. Conti ransomware gang member sentenced to 4 years in prison - bleepingcomputer.com
25. Ukrainian Conti Ransomware Developer Sentenced to 4 Years in US Prison - securityweek.com