# Threat Intel Brief — August 9, 2026

TL;DR

  • Critical zero-days under active exploitation: Metabase SQL injection (CVSS 10.0) and N-able N-central authentication bypass enable unauthenticated admin access and RMM compromise.
  • Supply chain attacks escalate: Head Mare trojanized TrueConf installers; nearly 800 malicious npm packages deliver cross-platform RAT targeting developers.
  • Infrastructure vulnerabilities demand immediate action: Progress Kemp LoadMaster (CVE-2026-8037) added to CISA KEV after 792 exploitation attempts; KVM VM escape and 18-year-old Linux SCTP flaw enable container breakout.
  • Social engineering campaigns intensify: UNC6671 vishing targets SaaS credentials; Microsoft 365 AitM phishing harvests payroll data; ClickFix attacks drain cryptocurrency wallets.
  • Poland energy sector attack reveals novel vector: December 2025 destructive campaign exploited private APN misconfigurations to compromise operational technology networks.

---

Critical Threats

Metabase Zero-Day Enables Unauthenticated Database Takeover

What happened: Metabase disclosed a maximum-severity SQL injection vulnerability (CVSS 10.0) actively exploited in the wild. Unauthenticated attackers can inject arbitrary SQL into the application database via the password reset endpoint, gain full administrative access, and exfiltrate all connected data. Framework and Tally confirmed breaches with customer data accessed. Metabase Cloud was attacked; self-hosted instances versions 1.58.0 through 1.63.2 are vulnerable. CVE: see source.

Impact: Complete compromise of business intelligence platforms. Attackers obtain database credentials, modify configurations, export sensitive data, and access all information visible to Metabase. Framework reported customer names, IP addresses, physical addresses, phone numbers, and email addresses were accessed. Any internet-exposed Metabase instance faces immediate risk.

Recommendations:

  • 0–24h: Update self-hosted Metabase immediately to patched versions (1.58.24, 1.59.21, 1.60.17, 1.61.11, 1.62.9, or 1.63.5). Block /api/session/reset_password at firewall until patching completes.
  • 0–24h: Hunt for compromise indicators: POST requests to /api/session/reset_password returning 400 status followed by GET /api/user/current returning 200 status.
  • 24–72h: If compromise detected, delete all core_session table rows, audit and remove unrecognized API keys, review admin accounts for unauthorized changes, and rotate all connected database credentials.

---

N-able N-central Under Active Exploitation with Managed Endpoint Persistence

What happened: N-able released emergency hotfix 2 (version 2026.3.1.10) after threat actors exploited authentication bypass vulnerabilities (CVE-2026-18556 and CVE-2026-18577, both CVSS 8.2) to compromise N-central RMM servers. Attackers reached managed endpoints via the Take Control feature and established persistence using Cloudflare Tunnel services that survive server remediation. CISA confirmed active exploitation. Limited number of customers affected.

Impact: Administrative takeover of RMM infrastructure enables lateral movement to all managed customer environments. Attackers can deploy persistent backdoors on endpoints that remain functional even after patching the N-central server. MSPs and enterprises using N-central face risk of supply chain compromise affecting downstream clients.

Recommendations:

  • 0–24h: Update N-central on-premise instances to version 2026.3.1.10 immediately.
  • 0–24h: Deploy N-able's custom service template to scan Windows endpoints for known IoCs (9 IP addresses provided by vendor).
  • 24–72h: Hunt for unauthorized Cloudflare Tunnel services on managed endpoints, especially those created between July 31 and August 8, 2026. Review N-central server logs for unauthorized Take Control sessions and administrative account activity.

---

Progress Kemp LoadMaster Command Injection Added to CISA KEV

What happened: CISA added CVE-2026-8037 (CVSS 9.6) to the Known Exploited Vulnerabilities catalog following 792 exploitation attempts across 18 countries over 41 days. The critical command injection flaw in Progress Kemp LoadMaster allows unauthenticated remote attackers to execute arbitrary commands via unsanitized input in the escape_quotes() function. Federal agencies must patch by August 10, 2026.

Impact: Full compromise of internet-facing load balancers without authentication. Attackers gain control over traffic routing, can intercept credentials, modify configurations, and pivot to backend systems. Affects enterprise and government networks relying on LoadMaster for application delivery.

Recommendations:

  • 0–24h: Apply Progress vendor patches for CVE-2026-8037 on all Kemp LoadMaster appliances immediately.
  • 0–24h: Block known malicious IPs: 192.42.116.58, 192.42.116.105, 146.70.139.154.
  • 24–72h: Review LoadMaster logs for command injection attempts targeting escape_quotes() function since June 2026. Restrict management interface access to trusted networks only.

---

TrueConf Supply Chain Attack Distributes Backdoored Installers

What happened: The Head Mare hacktivist group exploited vulnerabilities in unpatched TrueConf video conferencing servers to compromise software distribution infrastructure. Attackers replaced legitimate client installers with trojanized versions containing backdoors, enabling mass deployment of malware to downstream users. CVE: see source.

Impact: Organizations using TrueConf face immediate risk of widespread backdoor deployment across user endpoints. Supply chain compromise enables persistent access, data exfiltration, and lateral movement. Multiple clients may be compromised simultaneously through trusted software distribution channels.

Recommendations:

  • 0–24h: Verify integrity of all TrueConf server installations and check for unauthorized modifications to client installer files. Isolate and forensically examine endpoints that recently installed or updated TrueConf clients.
  • 0–24h: Contact TrueConf vendor for emergency patch status and official guidance on affected versions.
  • 24–72h: Block distribution of TrueConf installers from internal servers until integrity is verified. Monitor network traffic from TrueConf clients for C2 communication patterns.

---

KVM VM Escape Vulnerabilities Require Immediate Patching

What happened: CERT.BE issued a critical warning regarding VM escape vulnerabilities in KVM (Kernel-based Virtual Machine) hypervisor. The advisory emphasizes urgent patching to prevent attackers from breaking out of guest virtual machines to compromise host systems. Specific CVE identifiers and affected versions not disclosed in advisory.

Impact: VM escape enables complete infrastructure compromise in virtualized environments. Attackers who compromise a guest VM can gain control over the host hypervisor and all other VMs on the same physical server. Critical for cloud providers, data centers, and any organization using KVM virtualization.

Recommendations:

  • 0–24h: Identify all KVM hypervisor hosts and apply latest security patches from Linux distribution vendors (Red Hat, Ubuntu, SUSE, Debian) immediately.
  • 24–72h: Review hypervisor logs for unusual guest VM behavior or unexpected kernel messages. Implement network segmentation to isolate management interfaces.
  • This week: Monitor CERT.BE and vendor security advisories for specific CVE identifiers and additional technical details.

---

18-Year-Old Linux SCTP Flaw Enables Root Escalation and Container Escape

What happened: Tencent researchers disclosed an 18-year-old use-after-free vulnerability in Linux kernel SCTP networking code (present since kernel 2.6.25 in 2008) that allows local users to gain root privileges and escape containers. Patches released August 3 in stable kernels 7.1.6, 6.18.42, 6.12.101, and 6.6.148. CVE: see source.

Impact: Local privilege escalation to root and container escape to host system. Tencent achieved 6 of 8 successful host escapes in testing. Critical for multi-tenant container platforms, cloud providers, and any environment with untrusted local users. Attack requires local access and SCTP protocol availability.

Recommendations:

  • 0–24h: Update to patched stable kernels (7.1.6, 6.18.42, 6.12.101, or 6.6.148) immediately. Verify patch status via distribution security tracker.
  • 24–72h: If SCTP is not required, block the sctp kernel module (e.g., install sctp /bin/true in /etc/modprobe.d/) to eliminate attack surface.
  • This week: Review container configurations and audit seccomp profiles, user namespace policies, and CAP_NET_ADMIN grants to reduce escape risk.

---

Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT

What happened: Coordinated supply chain campaign published nearly 800 malicious packages to npm registry using typosquatting and AI-generated names. Packages deliver WEL1DROPPER leading to cross-platform RAT and infostealer targeting Windows, macOS (x64/ARM64), and Linux. Malware uses Cloudflare Workers and DNS TXT records for C2, with platform-specific evasion (ETW/AMSI patching on Windows, LaunchAgent persistence on macOS, Sliver C2 on Linux). Likely evolution of April 2026 "Moika" campaign. CVE: see source.

Impact: Developers installing typosquatted packages face immediate compromise across all major platforms. Malware exfiltrates credentials, environment variables, and establishes persistent access. Windows payloads disable security telemetry; macOS variants target cryptocurrency wallets and Keychain; Linux systems receive Sliver C2 implants.

Recommendations:

  • 0–24h: Audit package.json and node_modules for typosquatted packages. Block network access to oob-worker.cf103-070.workers.dev, oob-worker.cf102-baf.workers.dev, oob-worker.cf99-9b3.workers.dev, and wel1[.]ru.
  • 24–72h: Hunt for WEL1DROPPER artifacts: /tmp executables launched via /bin/sh (Linux/macOS), LaunchAgent persistence (macOS), Registry Run keys and scheduled tasks (Windows).
  • This week: Enable npm audit in CI/CD pipelines and enforce package signature verification. Consider private registry mirroring with manual vetting for new dependencies.

---

Threat Actor Activity

UNC6671 Vishing Campaign Targets SaaS Credentials

UNC6671, a financially motivated data extortion group operating multiple brands (Redact, Pink, Helix, Falcon), is conducting sophisticated vishing attacks against enterprise employees in financial services, private equity, and professional services. Attackers impersonate IT help desk staff via personal mobile devices, directing victims to adversary-in-the-middle phishing infrastructure that intercepts credentials and MFA tokens. Post-compromise, the group registers adversary-controlled MFA devices, removes existing authentication methods, and uses automated scripts to exfiltrate data from Microsoft 365 and Okta environments. The group collected over $10.6 million in Bitcoin between January and May 2026.

Defensive priorities: Deploy phishing-resistant MFA (FIDO2/WebAuthn hardware tokens). Monitor for suspicious MFA device registrations and removals. Implement user awareness training focused on vishing tactics and IT help desk verification procedures.

---

ClickFix Attacks Deliver macOS Cryptocurrency Stealer

Active ClickFix-style campaigns are delivering Go-based macOS malware capable of stealing cryptocurrency assets (Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, XRP), browser passwords, Apple iCloud Keychain data, and cached credentials. Infection chain uses social engineering to trick users into pasting malicious commands into Terminal. Malware uses privilege escalation via fake system prompts and can drain crypto wallets incrementally (as little as 1% at a time) to evade detection. Infrastructure linked to Aeza Group, a sanctioned Russian bulletproof hosting provider.

Defensive priorities: Educate macOS users never to paste untrusted commands into Terminal. Monitor outbound connections to Aeza Group IP ranges. Deploy EDR rules to detect suspicious privilege escalation prompts and Go-based binaries with Keychain or wallet access patterns.

---

Microsoft 365 AitM Phishing Harvests Payroll Data

Widespread email-driven phishing campaign actively targets Microsoft 365 accounts using adversary-in-the-middle techniques and residential proxies to compromise accounts and harvest payroll and finance-related emails. Hundreds of organizations targeted in July 2026 across healthcare, education, manufacturing, government, and professional services in the U.S., Canada, and Europe. Attackers maintain persistent access using residential proxies matched to victim geography, with automated session refresh every 8 hours. Campaign uses legitimate services (Google Meet, Google Ads, Amazon S3) in six-stage redirection chain to evade email filters.

Defensive priorities: Enable conditional access policies blocking sign-ins from residential proxy IP ranges. Monitor for recurring authentication events at regular intervals (especially 8-hour patterns) with changing source IPs but identical SessionIDs. Block or scrutinize emails containing Google Meet redirect URLs and Amazon S3-hosted HTML redirects.

---

Geopolitical Context

Poland Energy Sector Attack Exploited Private APN Misconfiguration

CERT Polska published a follow-up report on December 2025 attacks against Poland's energy sector, revealing that a second combined heat and power plant was compromised. The three-month investigation identified a previously unobserved attack vector involving private APN (Access Point Name) misconfiguration that permitted arbitrary device-to-device communication within the private network. Attackers exploited this to gain initial access to operational technology networks, then shut down critical industrial processes including a steam turbine and water treatment system. The coordinated campaign affected 30+ wind and solar installations and two CHP plants, with purely destructive objectives. CERT Polska surveys indicate the vulnerable APN configuration is commonly deployed in Poland and internationally.

Strategic implications: The discovery of a novel OT attack vector via telecommunications infrastructure exposes systemic vulnerability affecting energy and industrial operators globally. Poland's position as a NATO frontline state supporting Ukraine elevates the strategic significance. The timing (late December during winter) and destructive intent are consistent with state-sponsored operations targeting European critical infrastructure, though no formal attribution has been disclosed.

---

North Carolina Ports Cyberattack Disrupts U.S. Maritime Infrastructure

The North Carolina Ports Authority confirmed a cyberattack disrupting IT systems and operations across Port of Wilmington, Port of Morehead City, and Charlotte Inland Port. The coordinated attack affecting three geographically distributed facilities suggests targeting of operational technology or centralized IT management systems. Port of Wilmington processes approximately 600,000 TEU containers annually and serves as a vital logistics node for the southeastern United States. No attribution or ransomware claims have been made public as of August 7, 2026.

Strategic implications: The incident represents significant disruption to U.S. critical maritime infrastructure and supply chain operations. The simultaneous impact across three facilities indicates sophisticated coordination. The attack occurs within broader context of escalating threats to U.S. maritime and water utility infrastructure, as evidenced by recent CISA advisories.

---

Recommended Actions

Immediate (0–24 hours)

1. Patch critical zero-days: Update Metabase (1.58.24+, 1.59.21+, 1.60.17+, 1.61.11+, 1.62.9+, 1.63.5), N-able N-central (2026.3.1.10), Progress Kemp LoadMaster (CVE-2026-8037), and Linux kernels (7.1.6, 6.18.42, 6.12.101, 6.6.148).
2. Hunt for active exploitation: Search logs for Metabase password reset anomalies, N-able Take Control sessions, LoadMaster command injection attempts, and unauthorized Cloudflare Tunnel services on managed endpoints.
3. Verify TrueConf integrity: Isolate and examine endpoints that recently installed TrueConf clients. Block installer distribution until integrity is verified.
4. Audit npm dependencies: Scan for typosquatted packages and block Cloudflare Worker domains (oob-worker.cf*-*.workers.dev) and wel1[.]ru.
5. Apply KVM patches: Update all KVM hypervisor hosts with latest security patches from distribution vendors.

Near-term (24–72 hours)

1. Implement phishing-resistant MFA: Deploy FIDO2/WebAuthn hardware tokens for identity providers and SaaS applications to counter AitM attacks.
2. Monitor for persistence mechanisms: Hunt for unauthorized MFA device registrations, LaunchAgent persistence (macOS), Registry Run keys (Windows), and scheduled tasks.
3. Block malicious infrastructure: Update firewall rules to block known IoCs from N-able, npm RAT campaign, and ClickFix operations.
4. Review container security: Audit seccomp profiles, user namespace policies, and disable SCTP kernel module if not operationally required.
5. Restrict management interfaces: Limit LoadMaster, TrueConf server, and SD-WAN management access to trusted networks only.

This week

1. Deploy detection rules: Implement Sysmon Event ID 7 (ImageLoad) monitoring for ETW/AMSI patching, DNS monitoring for TXT record queries to suspicious domains, and EDR rules for Go-based binaries with Keychain access.
2. Conduct user awareness training: Focus on vishing tactics, Terminal command execution risks, and verification procedures for IT help desk contacts.
3. Audit private APN configurations: Review telecommunications infrastructure supporting OT networks for device-to-device communication restrictions and network segmentation.
4. Update WordPress: Verify automatic updates deployed WordPress 7.0.3 to address pre-authentication XSS (CVE-2026-64638).
5. Monitor CERT advisories: Track CERT.BE guidance on Cisco Catalyst SD-WAN and IOS/IOS XE vulnerabilities for specific CVE identifiers and affected versions.

---

Watch List

  • Atlassian Rovo prompt injection: Content-borne attack vector remediation status unclear as of August 8, 2026. Monitor for vendor confirmation of full mitigation.
  • Apache Traffic Server zero-day: CVE-2026-63078 reportedly patched but no public CVE record or fixed version available. Await vendor advisory.
  • CSS-based webmail attacks: Proof-of-concept published for password theft and token leakage across Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail. Monitor for active exploitation.
  • Windows Hello for Business abuse: Proof-of-concept demonstrates malware can silently authenticate to Entra ID for persistent cloud access. No CVE assigned; Microsoft has not issued advisory.
  • NatJack NAT manipulation attacks: Windows (CVE-2026-56181) and Linux (CVE-2026-63913) patches available. Monitor for proof-of-concept code release and exploitation attempts.

---

Sources

  • BleepingComputer: TrueConf supply chain attack, Metabase zero-day, North Carolina Ports cyberattack, Levi Strauss breach, H1 2026 attack chains
  • The Hacker News: Metabase CVSS 10.0 zero-day, N-able N-central exploitation, Progress Kemp LoadMaster (CVE-2026-8037), Atlassian Rovo prompt injection, WordPress pre-auth XSS (CVE-2026-64638), Linux SCTP flaw, npm malicious packages, ClickFix macOS stealer, UNC6671 vishing, NatJack attacks, Microsoft 365 AitM phishing, HTTP Terminator research, Windows Hello abuse
  • CERT.BE: KVM VM escape, Cisco Catalyst SD-WAN, Cisco IOS/IOS XE vulnerabilities
  • CERT.PL: Poland energy sector attack follow-up report