# Threat Intel Brief — August 5, 2026

TL;DR

  • Critical npm supply chain worm: ChainDrop compromised over 1,300 packages with 2 billion monthly downloads, stealing credentials from developer environments and CI/CD pipelines via self-propagating malware.
  • N-able N-central under active exploit: CVE-2026-18577 authentication bypass added to CISA KEV; attackers gained remote admin access to RMM servers and pivoted to managed endpoints using built-in tools.
  • Russian APT29 targets hotel Wi-Fi globally: Midnight Blizzard deployed custom malware (CornFlake, ChocoShell) via compromised hospitality networks to harvest Microsoft 365 credentials from business travelers.
  • cPanel privilege escalation patched: CVE-2026-58048 (CVSS 9.4) allowed authenticated hosting customers to execute SQL commands as database root, bypassing account isolation on shared hosting servers.
  • Google passkey implementation flaws disclosed: Unit 42 demonstrated three attack paths enabling malware to hijack passkey-protected accounts without user verification on Windows systems with Chrome Password Manager.

Critical Threats

ChainDrop npm Supply Chain Worm

What happened: A self-propagating credential-stealing worm compromised over 1,300 npm packages (1,381 versions) including Keyv, Cacheable, flat-cache, and file-entry-cache, affecting packages with a combined 2 billion monthly downloads. The malware originated from a compromised GitHub account of the Keyv maintainer and spread autonomously on August 4, 2026, using stolen npm credentials to publish malicious versions. The worm harvests GitHub personal access tokens, npm tokens, AWS credentials, Kubernetes secrets, HashiCorp Vault tokens, database credentials, and cloud provider credentials from developer workstations and CI/CD environments. It plants hooks in Claude Code (.claude/settings.json) and VS Code (.vscode/tasks.json) to steal credentials from developers who trust affected workspaces. Malicious packages were published with valid provenance through legitimate GitHub Actions workflows, complicating detection through standard supply chain security controls.

Impact: Any developer or CI/CD system that installed affected package versions should be considered fully compromised. The worm's self-propagating capability enables lateral movement to additional packages and repositories. Legitimate provenance signatures make detection difficult. Organizations using compromised packages include Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitan. The attack represents a fundamental shift in npm ecosystem risk, where a single compromised maintainer account can cascade into ecosystem-wide compromise within hours.

Recommendations:

  • Immediately audit all Node.js projects and CI/CD pipelines for affected npm packages using IoC lists from Wiz, StepSecurity, Aikido, Socket, or Ox Security (0-24h).
  • Treat any system that installed compromised package versions as fully compromised; rebuild from clean backups or from scratch (0-24h).
  • Rotate all credentials accessible from affected environments including GitHub PATs, npm tokens, AWS keys, Kubernetes secrets, Vault tokens, and database credentials (0-24h).
  • Search for network connections to npm-cache[.]com domain and GitHub repository with description "Shai-Hulud: Here We Go Again" in logs and firewall records (24-72h).
  • Implement dependency allowlisting and lock file integrity checks to prevent installation of newly compromised package versions (this week).

N-able N-central Authentication Bypass (CVE-2026-18577)

What happened: Attackers exploited CVE-2026-18577, an authentication bypass vulnerability in N-able N-central RMM platform, to gain remote administrative access to servers and downstream customer systems. The flaw represents an incomplete patch for CVE-2026-18556. Active exploitation began around July 31, 2026, affecting a limited number of customers. Attackers used VPN exit nodes (Mullvad, NordVPN) to connect via N-central's Take Control feature, deployed Cloudflared tunneling for persistence, and moved laterally to domain controllers. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, ordering federal agencies to patch by August 6, 2026. The vendor's initial patch (2026.3) proved incomplete, requiring emergency hotfix 2026.3.1.7 released August 2.

Impact: Remote attackers achieve full administrative access to N-central servers, then pivot to managed endpoints using built-in RMM features. Post-exploitation includes reconnaissance of domain controllers, lateral movement, and persistence via Cloudflared tunneling utility. MSPs and enterprises using N-central face risk of full environment compromise through trusted management channels. Huntress observed exploitation affecting nine organizations under one partner account.

Recommendations:

  • Upgrade all N-central instances to build 2026.3.1.7 immediately; prioritize internet-facing instances (0-24h).
  • Review N-central Take Control session logs for connections from 173.249.252.200, 87.249.138.34, 37.19.210.32, 68.235.46.214 and username "MSP Support" (0-24h).
  • Hunt for file "svchost.exe" in device users' Documents folders and service name "Cloudflared" across managed endpoints (0-24h).
  • Block outbound connections to known Cloudflared tunneling infrastructure if not business-required (24-72h).
  • Audit administrative access to N-central servers and review recent account creation or privilege escalation events (24-72h).

cPanel SQL Privilege Escalation (CVE-2026-58048)

What happened: cPanel patched CVE-2026-58048 (CVSS 9.4), a critical flaw allowing authenticated hosting customers to execute SQL commands in the database's root context, bypassing privilege boundaries between customer accounts and administrative database access. The vulnerability affects all supported cPanel & WHM versions prior to 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, and 11.136.0.32. Exploitation requires valid cPanel account credentials and MySQL feature access but does not require automation. CISA assessed "Exploitation: none" as of August 4, 2026, though the technical impact is rated as total. The same security release addressed CVE-2026-58047 (HTTP request smuggling) and an Exim privilege escalation issue.

Impact: Authenticated hosting customers can execute arbitrary SQL commands with full database administrative privileges, bypassing account isolation. Depending on database engine and OS configuration, exploitation may extend to operating-system-level compromise. Risk is highest on shared hosting environments where multiple untrusted customers hold accounts on the same server. Single-tenant environments face lower risk but remain vulnerable to account compromise scenarios.

Recommendations:

  • Update cPanel & WHM to patched versions: 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32, or WP Squared 138.1.6 using WHM or /usr/local/cpanel/scripts/upcp --force (0-24h).
  • If immediate patching is not possible, temporarily revoke MySQL feature from cPanel users via WHM to prevent database creation/deletion while maintaining existing database operation (0-24h).
  • Review database audit logs for suspicious administrative-level SQL commands executed by non-administrative cPanel accounts, especially database rename operations (24-72h).
  • Prioritize patching on multi-tenant shared hosting servers where untrusted customers hold accounts (0-24h).
  • Apply patches for CVE-2026-58047 and Exim privilege escalation included in the same release (0-24h).

Threat Actor Activity

Midnight Blizzard (APT29) — CaptiveCrunch Campaign

Russian state-sponsored threat actor Midnight Blizzard (APT29, also tracked as Storm-2945) is conducting a global campaign targeting hospitality Wi-Fi networks to breach Microsoft 365 accounts. The operation, active since at least May 2026, compromises hotel and conference center captive portal infrastructure to redirect victims to phishing pages impersonating Microsoft 365 login portals. The actor deploys custom malware including CornFlake RAT (Go-based with keylogging, clipboard monitoring, screenshot capture, webcam/microphone surveillance) and ChocoShell (PowerShell-based in-memory credential stealer). Infrastructure compromise involves DNS/HTTP traffic manipulation on captive portal equipment. The campaign exploits the inherent trust users place in guest Wi-Fi infrastructure to harvest corporate credentials and session tokens from business travelers and conference attendees.

Defensive priorities: Treat hotel and conference Wi-Fi as untrusted networks; mandate VPN over private cellular or managed connections for corporate access. Implement phishing-resistant authentication with hardware MFA tokens or passkeys; disable Microsoft Entra device code authentication flow when not operationally required. Monitor for token theft via anomalous Microsoft 365/Azure AD token usage patterns, impossible travel scenarios, and session token reuse from unexpected geolocations.

INC Ransomware — SonicWall SMA 1000 Exploitation

INC Ransomware has emerged as the dominant threat actor exploiting CVE-2026-15409 and CVE-2026-15410 in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances. The operation has claimed 885 victims total as of August 2, 2026, with accelerated activity since early August. Initial exploitation began as zero-day attacks starting June 22, 2026, prior to vendor disclosure. Post-exploitation activities include deployment of Python script KNUCKLEBALL to launch Suo5 (open-source HTTP proxy) and ORANGETAIL (Behinder-like custom Java web shell). The operation extracts high-value credentials, active session databases, and TOTP MFA seed configurations to ensure persistent access. Between July 17 and August 1, new victims listed on their data leak site included organizations from Australia, the United States, the United Arab Emirates, Colombia, and Switzerland. The group employs pressure tactics including direct phone calls to victims claiming to offer ransomware assistance.

Defensive priorities: Immediately patch SonicWall SMA 1000 series appliances to the latest version addressing CVE-2026-15409 and CVE-2026-15410. Conduct threat hunting to identify external source addresses that interacted with /wsproxy endpoint or used unusual parameters. Perform comprehensive credential rotation for all accounts accessible via compromised VPN appliances, prioritizing high-privilege accounts and service accounts. Verify integrity of TOTP MFA seed configurations and active session databases.

ExfilSquad — UK Police Database Breach

Data extortion group ExfilSquad breached the UK's Police National Legal Database (PNLD), compromising contact data of over 100,000 police officers and criminal justice professionals. The group exfiltrated approximately 1.9 GB of data containing 135,000 contact records (114,000 PNLD subscribers and 21,000 Ask the Police users) and published sample data as proof of compromise. The breach affects personnel across 43 Home Office police forces in England and Wales, plus the British Transport Police. ExfilSquad has claimed 885 victims to date and employs pressure tactics via phone calls and emails to accelerate ransom negotiations. The group maintains a data leak site where victims are publicly listed. Prior to the July 2026 PNLD attack, the group claimed responsibility for breaching Analog Devices, an American semiconductor company.

Defensive priorities: Implement robust access controls and multi-factor authentication for all systems containing sensitive personnel or organizational data. Deploy data loss prevention solutions to detect and block unusual data exfiltration patterns. Conduct regular vulnerability assessments and penetration testing of public-facing web applications and databases, prioritizing systems containing high-value data.

DOUBLECUP — Russian Loader-as-a-Service

DOUBLECUP is a Russian loader-as-a-service platform operating since June 2026 that provides customers with licenses and a Go-based Windows tool for creating malicious ClickFix campaigns. The service uses steganography to hide malicious code in PNG images cached by victims' browsers, delivering CountLoader (with cross-platform Windows and macOS variants) and DeviceManager RAT (which uses blockchain-based C2 resolution via Ethereum and Polygon smart contracts). Campaigns target enterprise CRM platforms including NetSuite, Odoo, HubSpot, and Salesforce through credential-harvesting lures. DeviceManager includes hardcoded exclusion of Commonwealth of Independent States countries, consistent with Russian-based threat actor operational security practices. The service was discovered through an open directory at 213.139.77.109:9090 containing test files, with the same IP hosting the licensing panel.

Defensive priorities: Monitor browser cache directories for suspicious PNG files and detect steganography by scanning for anomalous file sizes and entropy patterns. Block execution of clipboard-based commands via certutil.exe and findstr.exe abuse through EDR telemetry. Detect scheduled task creation and LaunchAgent persistence by monitoring for CountLoader indicators. Implement DNS monitoring to identify exfiltration via DNS A and TXT record queries associated with DeviceManager RAT.

Geopolitical Context

The week's threat landscape reflects intensifying cyber operations by state-sponsored actors and the continued maturation of Russia-based cybercrime infrastructure. Midnight Blizzard's (APT29) targeting of hospitality Wi-Fi networks represents a continuation of Russian intelligence collection priorities against Western corporate and government networks, exploiting trusted but poorly secured third-party infrastructure to reach high-value targets. The campaign's global scope and focus on Microsoft 365 underscores Russia's sustained investment in cyber espionage capabilities despite ongoing international sanctions following its 2022 invasion of Ukraine.

The ExfilSquad breach of the UK's Police National Legal Database represents a significant compromise of law enforcement operational security, exposing contact information for over 100,000 police officers and criminal justice professionals across 43 Home Office police forces. While the compromised data does not include classified operational material, its publication creates potential vectors for social engineering, targeted phishing, and harassment campaigns that could undermine institutional confidence and officer safety.

The emergence of DOUBLECUP as a Russian-origin loader-as-a-service platform reflects the continued maturation of the cybercrime-as-a-service ecosystem within Russia's permissive operating environment. The service's sophisticated technical architecture and targeting of enterprise CRM platforms demonstrates the professionalization of criminal infrastructure that operates with apparent impunity, raising questions about the permissive environment for cybercrime infrastructure in Russia.

The Chinese-speaking threat actor's exploitation of the leaked DarkSword iOS exploit kit represents a diffusion of commercial surveillance capabilities following public disclosure. The actor operates infrastructure spanning Hong Kong, Singapore, Japan, the United States, and Europe, deploying credential-harvesting decoys to facilitate iOS exploitation. The leak has democratized access to advanced mobile exploitation tools, lowering barriers for espionage operations.

Recommended Actions

Immediate (0-24 hours)

  • Audit all Node.js projects and CI/CD pipelines for ChainDrop-affected npm packages; treat any system that installed compromised versions as fully compromised and rotate all accessible credentials.
  • Upgrade all N-able N-central instances to build 2026.3.1.7; hunt for Cloudflared persistence and review Take Control session logs for suspicious activity.
  • Update cPanel & WHM to patched versions addressing CVE-2026-58048; prioritize multi-tenant shared hosting servers.
  • Patch SonicWall SMA 1000 series appliances to address CVE-2026-15409 and CVE-2026-15410; rotate credentials accessible via compromised VPN appliances.
  • Audit all developer workstations and CI/CD environments for the 77 malicious Open VSX extension IDs; manually uninstall any matches and block mangorbit[.]com at DNS and firewall level.

Within 24-72 hours

  • Implement phishing-resistant authentication with hardware MFA tokens or passkeys for high-value accounts; disable Microsoft Entra device code authentication flow when not operationally required.
  • Review database audit logs for suspicious administrative-level SQL commands executed by non-administrative cPanel accounts.
  • Monitor Microsoft Graph API activity for bulk enumeration patterns across Outlook, Teams, SharePoint, OneDrive, contacts, and calendars within short timeframes.
  • Conduct threat hunting to identify external source addresses that interacted with SonicWall /wsproxy endpoint or used unusual parameters.
  • Search for network connections to npm-cache[.]com domain and ChainDrop-related GitHub repositories in logs and firewall records.

This week

  • Upgrade Hugging Face Diffusers to version 0.38.0 or later on all systems using the library; audit AI/ML pipelines that call DiffusionPipeline.from_pretrained.
  • Audit all Xcode projects for unexpected build scripts or downloader components, especially in projects cloned from public Git repositories.
  • Install Thermo Fisher Applied Biosystems patches for DNA analysis software; implement compensating controls for end-of-life systems.
  • Review npm package release history for unauthorized publications with no corresponding source commits; audit cloud resources and secret stores for unauthorized access.
  • Implement dependency allowlisting and lock file integrity checks to prevent installation of newly compromised npm package versions.

Watch List

  • AI agent security vulnerabilities: Multiple incidents in 2026 demonstrate emerging attack patterns where AI agents become authorization bridges for privilege escalation in GitHub workflows and development pipelines.
  • Passkey implementation gaps: Unit 42 research reveals relying parties failing to validate User Verified flags, effectively reducing multi-factor authentication to single-factor authentication in passwordless systems.
  • RMM platform exploitation: Continued targeting of remote monitoring and management tools (N-able N-central, SonicWall SMA) by both ransomware operators and state-sponsored actors seeking supply chain access.
  • npm ecosystem integrity: ChainDrop worm demonstrates fundamental shift in npm ecosystem risk, where single compromised maintainer accounts can cascade into ecosystem-wide compromise within hours.
  • Hospitality sector infrastructure: APT29's targeting of hotel and conference Wi-Fi networks highlights persistent vulnerabilities in third-party infrastructure serving as gateways to corporate networks.

Sources

  • BleepingComputer: TP-Link patches, XCSSET variant, Open VSX extensions, ChainDrop npm attack, N-able warnings, ExfilSquad breach, BTMOB RAT, hotel Wi-Fi attacks, Pass-ta-key attacks, DOUBLECUP service, Xeno malware
  • The Hacker News: Greatness PhaaS, npm worm, SMOKE#SCREEN, Google ADK, cPanel flaw, DOUBLECUP, CISA KEV, Alibaba npm packages, Google Password Manager, INC Ransomware, Chinese DarkSword, UK PNLD breach, Thermo Fisher, N-able compromise, Hugging Face Diffusers
  • Microsoft Security: ChainDrop anatomy, Microsoft Defender ransomware prevention
  • Unit 42 (Palo Alto Networks): Frontier AI vulnerability discovery, Pass-ta-key passkey attacks
  • CERT.BE: N-Central active exploitation warning