# Threat Intel Brief — September 3, 2026

TL;DR

  • Critical zero-days under active exploitation: SonicWall SMA 1000 (CVE-2026-83548, CVE-2026-83549), JFrog Artifactory (CVE-2026-82329), Sangoma Switchvox (CVE-2026-9586), and Langflow (CVE-2026-0768) are being exploited in the wild for RCE and credential theft.
  • Supply chain attacks escalate: BGP hijacking delivered malicious Virtualizor updates with root backdoors; 13 malicious Composer packages targeted iOS devices for cryptocurrency wallet theft.
  • AI security under fire: Russia-aligned UAC-0099 deploys adversarial prompts to sabotage LLM-based malware analysis; AI coding agents vulnerable to Git config exploitation.
  • Geopolitical cyber activity intensifies: Latvia reports sustained sixfold increase in incidents since 2022; Iranian and Russian-aligned actors expand cross-platform capabilities and social engineering operations.
  • Massive identity breach: Dark web service sells 153+ million North American driver's licenses allegedly from Louisiana identity verification vendor; FBI investigation underway.

Critical Threats

SonicWall SMA 1000 Zero-Day Chain Enables RCE

What happened: Attackers are chaining two zero-day vulnerabilities in SonicWall Secure Mobile Access 1000 series appliances (models 6210, 7210, 8200v) to achieve remote code execution. CVE-2026-83548 is a pre-authentication SSRF vulnerability with a CVSS score of 10.0 affecting the WorkPlace interface. When combined with CVE-2026-83549, a post-authentication command injection flaw in the Management Console, threat actors gain arbitrary OS command execution. Approximately 400+ appliances remain exposed online.

Impact: VPN appliances provide network perimeter access, making them high-value targets. Successful exploitation grants persistent access to internal networks, enabling credential theft and lateral movement. SonicWall SMA 1000 has been repeatedly targeted in zero-day campaigns throughout 2025–2026, with CISA confirming ransomware gang involvement in prior incidents.

Recommendations:

  • Upgrade all SMA 1000 appliances to the latest hotfix immediately
  • Audit appliance logs for unauthorized admin access and unusual WorkPlace interface activity
  • If compromise is detected, re-image the appliance, reset all passwords, and regenerate TOTP tokens
  • Restrict management interface access to trusted IP ranges only

JFrog Artifactory Authentication Bypass Actively Exploited

What happened: CVE-2026-82329 (CVSS 9.8) allows unauthenticated attackers with network access to JFrog Artifactory to forge administrative tokens and gain full admin privileges. Active exploitation began within days of the August 28 patch release, with attackers observed generating admin tokens, enumerating users, and accessing credential sets. Affected versions include 7.161.0–7.161.19, 7.146.0–7.146.36, 7.133.0–7.133.28, 7.125.0–7.125.19, 7.117.0–7.117.27, and 7.111.4–7.111.21 in default configurations.

Impact: Artifactory serves as a central repository for build artifacts, dependencies, and Docker images in CI/CD pipelines. Compromise enables supply chain attacks through binary poisoning, build pipeline tampering, and downstream malicious code distribution to customers. No authentication or user interaction required.

Recommendations:

  • Upgrade to version 7.161.20 or later immediately, prioritizing internet-exposed systems
  • Revoke all existing access tokens and reissue only to verified users—patching does not invalidate forged tokens
  • Review JFrog Access audit logs for unauthorized token generation since August 28
  • Inspect connected CI/CD pipelines and build artifacts for tampering or backdoors
  • Configure additional join keys in JFrog Access to prevent phantom join key exploitation

Langflow and Ruby on Rails RCE Flaws Under Active Attack

What happened: Threat actors are exploiting CVE-2026-0768 (CVSS 9.8) in Langflow, which allows arbitrary Python code execution as root via improper input validation. Simultaneously, CVE-2026-66066 (CVSS 9.5) in Ruby on Rails enables unauthenticated arbitrary file read, secret leakage, and RCE in applications using libvips for Active Storage image processing. VulnCheck recorded 360+ detections for CVE-2026-0768 as of September 1, with attacks originating primarily from Russia targeting UK systems. Attackers are harvesting AWS keys, OpenAI API tokens, and deploying crypto miners.

Impact: CVE-2026-0768 grants root-level access to Langflow instances, exposing AI development environments and cloud credentials. CVE-2026-66066 enables extraction of Rails secrets, database passwords, and cloud storage credentials. Observed post-exploitation includes cryptomining botnet enrollment, credential theft, and C2 establishment. Over 7,100 exposed Rails instances identified globally.

Recommendations:

  • Immediately isolate all Langflow instances and apply vendor patches for CVE-2026-0768
  • Upgrade Rails applications to version 8.1.3.1 or later; disable untrusted image uploads or switch image processors
  • Hunt for exploitation indicators: outbound connections to Russia/France/Israel, queries for environment variables (LANGFLOW_SUPERUSER, OPENAI_API*, AWS_*), XMR miner processes
  • Rotate all exposed secrets: Rails secret_key_base, master keys, AWS credentials, OpenAI API tokens
  • Enable auditd logging on Linux systems and monitor for C2 beaconing

BGP Hijacking Delivers Malicious Virtualizor Updates

What happened: Attackers used BGP hijacking between August 28–30, 2026, to intercept Softaculous update traffic and deliver a malicious Virtualizor package. The trojanized update installed a persistent systemd service (java-jre-update.service), SSH backdoor keys, and an unauthorized "proxyuser" account, resulting in root-level compromise of multiple hypervisors. At least 5 of 34 checked installations at one hosting provider were confirmed compromised.

Impact: Root-level compromise of hypervisors grants full control over host systems and all hosted virtual machines. Persistence mechanisms allow continued access even after initial entry point closure. Client portal sessions and payment data entered during the 38-hour window may have been intercepted. Virtualizor lacks cryptographic package signing, leaving the update mechanism vulnerable to similar attacks.

Recommendations:

  • Run Virtualizor's official Security Analyzer on every hypervisor immediately (SHA-256: 73e74402b3a61c7bab289fc11347bd54c7fcdc2fa2e410f4c3de9d6cd7377d48)
  • Rotate all Virtualizor API keys, restrict API access to trusted IPs, and audit SSH authorized_keys files
  • Search for unauthorized "proxyuser" account, systemd unit "java-jre-update.service", and payload file /usr/lib/jvm/.cache/jre-runtime.dat
  • Block outbound connections to C2 domains cdn[.]nerat[.]cc and connect[.]ne-rat[.]xyz, and IP 31.77.220[.]138:2025
  • Force password resets for all client-area users who logged in between August 28 20:57 UTC and August 30 06:10 UTC

Sangoma Switchvox SQL Injection Exploited for Reverse Shells

What happened: CVE-2026-9586, an unauthenticated SQL injection vulnerability in Sangoma Switchvox VoIP platform versions prior to 8.4.0.2, is being actively exploited. Horizon3 honeypots detected attacks on August 30 from IP 176.65.148.184 deploying reverse shells. The vulnerability exists in the unauthenticated /pa HTTP endpoint. Approximately 4,000 internet-exposed instances globally, primarily in the United States.

Impact: Unauthenticated attackers can execute arbitrary SQL commands and achieve remote code execution without credentials. VoIP infrastructure compromise disrupts business communications, enables call interception, and provides pivot points into internal networks. Patch available since July 14, 2026.

Recommendations:

  • Upgrade all Switchvox instances to version 8.4.0.2 or later immediately
  • Review /var/log/switchvox/db-quirks.log for suspicious SQL statements
  • Check firewall logs for connections to 176.65.148.184, particularly on port 39323
  • Restrict network access to /pa endpoint from untrusted sources if immediate patching is not possible
  • Conduct full system integrity check on any internet-exposed Switchvox instance

Threat Actor Activity

Russia-Aligned UAC-0099 Sabotages AI Malware Analysis

Russia-aligned threat actor UAC-0099 has deployed GuardBreaker, a technique that embeds adversarial prompt injections (nuclear weapon-related text) in malicious VBS scripts to trigger LLM safety mechanisms and prevent AI-assisted analysis. The VBS script downloads MATCHBOIL, a custom C# loader for second-stage payloads. In July 2026, the actor disguised malware as a Notepad++ plugin to compromise Windows systems. UAC-0099 primarily targets Ukrainian organizations in technology and defense sectors, with historical focus on transportation and energy infrastructure.

Iranian Nimbus Manticore Expands Cross-Platform Capabilities

Iranian threat actor Nimbus Manticore (also tracked as Iranian Dream Job) has deployed two previously undocumented cross-platform RAT malware families—NodeRabbit and PollCat—built using Node.js and JavaScript, targeting Linux, macOS, and Windows systems. The group impersonates talent acquisition specialists from major technology companies to deliver trojanized coding challenges via LinkedIn. Observed infections span Afghanistan, Egypt, and Ethiopia. The actor has rapidly expanded its malware arsenal in recent months, adding NightLedger, BridgeHead, ArcBridge, and tools overlapping with TWOSTROKE.

Breeze Comet Targets Brazilian Payment Systems

Breeze Comet (formerly UNC5669), a financially motivated threat actor operating from Brazil since 2024, has executed hundreds of fraudulent transactions through manipulation of Brazilian payment systems including Pix, STR, and Boleto. The group uses password spraying, social engineering via WhatsApp, exploitation of vulnerable JBoss servers, and physical insertion of rogue hardware into retail networks. Custom malware suite includes COBALTSPIN, LIGHTPAINT, MILDFROST, KICKPLATE, and BOATBEAM. Infrastructure analysis indicates potential expansion into Paraguay, Venezuela, Nigeria, and Ghana.

Gambling Goblin Hijacks Brazilian Government Sites

Chinese-speaking cybercrime cluster Gambling Goblin has been installing malicious Apache modules on compromised Brazilian government (.gov.br) and educational institution web servers since mid-2025. The modules reverse-proxy visitors to gambling and sports betting pages while stripping security headers. Check Point Research links this cluster to Earth Berberoka, documented by Trend Micro in 2022. At least 20 .gov.br portals belonging to Brazilian municipalities and police forces were compromised as of July 2025, with over 630,000 URLs generated on hijacked gov.br subdomains.

Russian National Indicted for 2016–2017 Freelancer Malware Campaign

Searzhudin Tamirlanovich Aktulaev, a 40-year-old Russian national, was extradited from Cyprus and charged by the U.S. Department of Justice for orchestrating a phishing campaign that infected approximately 80,000 freelancers with TVRAT and DarkVNC malware between June 2016 and November 2017. The actor created 255 fake accounts on a freelance platform to distribute malicious Excel files with embedded macros. Approximately 50% of infected victims were located in the United States. Court documents were filed in June 2021 and unsealed in September 2026.

Geopolitical Context

Latvia Reports Sustained Cyber Threat Elevation

CERT.LV reports that Latvia's cybersecurity threat level remains high in Q2 2026, with cyber incidents increasing sixfold and compromised devices eightfold since Russia's 2022 invasion of Ukraine. The report explicitly identifies Russia as "the main source of cyber threats to Latvia," noting that activities by Russia-backed cyber actors and hacktivists are "likely to continue" in response to Latvia's support for Ukraine. Latvia's SOC deployment across 57,000 endpoints prevented over 5 million malicious access attempts in H1 2026.

Massive North American Identity Breach Under FBI Investigation

A dark web identity theft service is selling digital scans of over 153 million driver's licenses from the United States and Canada, allegedly sourced from a Louisiana-based identity verification company. The FBI's New Orleans field office has launched an official investigation. The dataset includes high-value targets such as U.S. Defense Secretary Pete Hegseth's license, suggesting the breach affects government contractors and federal employees. The actor claims continuous exfiltration for over a year, with records increasing by approximately 400,000 within 24 hours.

Venezuelan ATM Jackpotting Campaign Targets U.S. Financial Infrastructure

Five Venezuelan nationals pleaded guilty to conducting ATM jackpotting attacks using malware to attempt to empty automated teller machines in the United States. The FBI warned in February 2026 that criminals stole over $20 million in the previous year through ATM jackpotting attacks. The Justice Department has charged 87 members of the Tren de Aragua Venezuelan criminal organization linked to a massive ATM jackpotting scheme deploying Ploutus malware.

Recommended Actions

Immediate (0–24 hours)

  • Patch critical zero-days: SonicWall SMA 1000 (CVE-2026-83548, CVE-2026-83549), JFrog Artifactory (CVE-2026-82329), Sangoma Switchvox (CVE-2026-9586), Langflow (CVE-2026-0768)
  • Run Virtualizor Security Analyzer on all hypervisors and check for java-jre-update.service persistence
  • Revoke all JFrog Artifactory access tokens and reissue only to verified users
  • Rotate exposed credentials: AWS keys, OpenAI API tokens, Rails secret_key_base, Langflow admin credentials
  • Block C2 infrastructure: 45.147.28[.]59, 193.32.2[.]245, cdn[.]nerat[.]cc, connect[.]ne-rat[.]xyz, 31.77.220[.]138:2025

High Priority (24–72 hours)

  • Audit AI coding agents for Git config exploitation vulnerabilities; update goose, Codex CLI/Desktop, Claude Code
  • Review PaperCut NG/MF instances for Emergency Patch Release 3 and hunt for authentication anomalies since August 29
  • Scan for malicious Composer packages: vsmov/theme-*, vsphim/theme-*, haiau009/kkphim-*, chilltvcms/theme-*, ophimcms/theme-*
  • Inspect GeoNetwork instances for unauthorized .xsl or .zip files in formatter directories; upgrade to 4.4.12 or 4.2.17
  • Monitor for Microsoft Teams external collaboration abuse and restrict unknown tenant access

This Week

  • Patch Microsoft Exchange servers against CVE-2026-62911 authentication bypass; approximately 22,000 remain vulnerable
  • Update All-in-One WP Migration plugin to version 7.110 or later on all WordPress installations
  • Review Apache web servers for unauthorized modules, particularly on Brazilian government and educational infrastructure
  • Implement enhanced logging for WinRM connections, PowerShell download activity, and Node.js execution from user-writable directories
  • Educate users on ClickFix social engineering (fake CAPTCHA pages), recruitment-themed coding challenges, and fake software download sites

Watch List

  • AI security vulnerabilities: Adversarial prompt injection techniques spreading from cybercrime to state-aligned actors; LLM-based security tools require architectural redesign to isolate untrusted input
  • Supply chain attack vectors: BGP hijacking, malicious package repositories, and software update infrastructure remain high-value targets
  • Cross-platform malware evolution: Iranian and Russian-aligned actors expanding from Windows-centric to Linux/macOS capabilities
  • Healthcare sector targeting: Sustained breaches affecting millions of patients (Novocure, Aesto Health) indicate persistent threat to medical infrastructure
  • Financial payment system fraud: Brazilian Pix system and ATM infrastructure under coordinated attack by technically sophisticated actors

Sources

  • BleepingComputer: Multiple critical vulnerability and breach reports
  • The Hacker News: Threat actor analysis and vulnerability exploitation coverage
  • Microsoft Security: Enterprise intrusion campaigns and malware distribution analysis
  • Unit 42 (Palo Alto Networks): AI-assisted cyber attack investigation
  • CERT.BE, CERT.LV: European national CERT advisories
  • Krebs on Security: Identity theft service investigation
  • CrowdStrike, Google Threat Intelligence, ThreatFabric, Check Point Research: Threat actor attribution and malware analysis

---

*This report synthesizes intelligence from 37 sources published between September 1–3, 2026. All CVE identifiers have been verified against the authorized list. Organizations should prioritize patching based on internet exposure, criticality of affected systems, and observed exploitation activity.*