Cybersecurity Brief – 2026-09-11

Fri, 11 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

Attackers chained two vulnerabilities in JFrog Artifactory to gain administrator control of self-hosted servers and plant backdoors, impacting the integrity of software build pipelines ^[1].
Trezor reported that phishing attacks targeting its customers leveraged data from a previous Brevo breach, with 347,000 email addresses targeted and 2,500 users clicking on malicious links ^[9].
Identity verification provider IDScan confirmed a breach in its cloud platform that exposed customer data, linked to a database containing over 153 million stolen driver’s licenses ^[17].
Surfshark VPN disclosed that hackers accessed an internal test server due to a configuration error, exposing engineering materials and internal configurations ^[13]^[31].

Newly Discovered Vulnerabilities

GitLab urged immediate patching of a maximum-severity path traversal vulnerability (CVE-2026-85706) affecting its servers ^[7].
Check Point released patches for two critical VPN vulnerabilities (CVE-2026-85102 and CVE-2026-85103) that could allow remote code execution ^[29].
Cisco revealed that two recently patched Secure Firewall Management Center (FMC) vulnerabilities have been actively exploited by ransomware and state-sponsored threat actors ^[4]^[16].
Multiple cyber-espionage groups exploited a new “BlueMoon” exploit kit that leveraged zero-day vulnerabilities in Microsoft Windows and Google Chrome ^[18]^[39].
PaperCut issued a new maintenance release replacing previous emergency patches for two flaws that were under active exploitation ^[3].
JFrog Artifactory flaws were chained to escalate privileges and implant backdoors ^[1].
A path traversal flaw in GitLab and critical flaws in Check Point VPN products were highlighted as requiring urgent attention ^[7]^[29].

Notable Threat Actor Activity

A China-linked group, UNC3569, exploited a flaw in the Sogou Input Method to deploy the GRAYRABBIT backdoor on Windows systems ^[2].
Three distinct threat clusters, including ransomware and state-sponsored groups, exploited Cisco FMC vulnerabilities for credential theft and ransomware deployment, including Qilin ransomware ^[4]^[16].
A Russian-speaking threat actor used hundreds of AI agents to automate the exploitation of PaperCut flaws, compromising 395 organizations globally ^[15]^[33].
Multiple espionage groups used the BlueMoon exploit kit to target recent Windows and Chrome vulnerabilities ^[18]^[39].
The GoldFactory threat group exploited the Android Work Profile feature to deliver the Gigabud Trojan in Indonesia, while the Mantax Otax malware, which combines ransomware and spyware features, spread separately ^[20]^[11].
Russian hackers reportedly used Anthropic’s Claude AI to automate malware evasion and targeted AI vendor infrastructure, including an attempt to steal a pre-release model ^[32].
A disgruntled researcher known as Nightmare-Eclipse released a new zero-day exploit (“ShieldCrash”) for Windows Defender ^[22].
Threat actors leveraged Microsoft Graph API to identify targets and pass access to extortion groups such as ShinyHunters ^[21].

Trends, Tools, or Tactics of Interest

The BlueMoon exploit kit was used by at least four espionage groups to leverage recently fixed Windows and Chrome flaws, indicating rapid adoption of exploit kits for zero-day vulnerabilities ^[18]^[39].
AI-powered attacks are increasingly being used to automate the exploitation of vulnerabilities, as seen in the PaperCut incidents ^[15]^[33].
Threat actors are abusing Google Play’s Early Access program to distribute thousands of deceptive Android apps promising money, rewards, and premium content ^[6].
New Android malware, Mantax Otax, was identified as combining ransomware, spyware, and harassment capabilities ^[11].
Researchers demonstrated a new prompt-crafting technique (PuzzleMask) for bypassing LLM-based policy checks using plain English, highlighting emerging covert AI attack vectors ^[38].
Identity-based attacks accounted for approximately half of all confirmed malicious activity in a recent quarter, with four primary attack patterns identified ^[19].

Regulatory or Policy Developments Affecting the Security Industry

A Ukrainian national involved in Conti ransomware operations was sentenced to four years in prison for attacks conducted between 2021 and 2022 ^[10]^[28].

Sources

Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors - thehackernews.com
Trezor: 347,000 users targeted in phishing attacks after Brevo breach - bleepingcomputer.com
IDScan confirms breach tied to 153 million stolen driver’s licenses - bleepingcomputer.com
Surfshark VPN says hackers breached internal testing, proxy servers - bleepingcomputer.com
Surfshark Systems Targeted by Hackers - securityweek.com
GitLab urges users to patch max severity path traversal flaw - bleepingcomputer.com
Check Point Patches Critical VPN Vulnerabilities - securityweek.com
Cisco FMC Flaws Exploited to Steal Credentials and Deploy Qilin Ransomware - thehackernews.com
Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers - bleepingcomputer.com
New 'BlueMoon' kit exploited Windows and Chrome zero-day flaws - bleepingcomputer.com
BlueMoon exploit kit turns Chrome and Windows flaws into attacks - malwarebytes.com
PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws - thehackernews.com
China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor - thehackernews.com
AI-powered attack exploited PaperCut flaws to hack 395 organizations - bleepingcomputer.com
PaperCut Flaws Exploited in AI-Powered Attacks - securityweek.com
Indonesia Hit by Android Banking App-Cloning Campaign - darkreading.com
New Android malware encrypts files, steals data, and harasses victims - bleepingcomputer.com
Anthropic Says Russian Hackers Used Claude AI to Automate Malware Evasion - securityweek.com
Nightmare-Eclipse Strikes Again With 'ShieldCrash' Windows Exploit - darkreading.com
Voice Callers Exploit BYOD to Reach Microsoft 365, Corporate Data - darkreading.com
Google Play Early Access Abused to Push Thousands of Deceptive Android Apps - thehackernews.com
PuzzleMask: Abusing Plain Prose as a Covert AI Attack Vector - research.checkpoint.com
The Top 4 Threats We Found by Investigating Every Alert for a Quarter - bleepingcomputer.com
Conti ransomware gang member sentenced to 4 years in prison - bleepingcomputer.com
Ukrainian Conti Ransomware Developer Sentenced to 4 Years in US Prison - securityweek.com

ShinyHunters on DanSec Daily

Cybersecurity Brief – 2026-09-11

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Sources