# Threat Intel Brief — September 7, 2026

TL;DR

  • MikroTik RouterOS under active exploitation: Two critical vulnerabilities (CVE-2026-67276, CVE-2026-86060) enable unauthenticated SSH takeover; confirmed attacks since September 2 against internet-exposed devices.
  • Magento/Adobe Commerce zero-day: Unpatched StyleSmuggler flaw allows unauthenticated remote code execution; active exploitation since September 4 with no vendor patch available.
  • PaperCut vulnerabilities exploited in education sector: CVE-2026-81578 and CVE-2026-82078 chained for credential theft at U.S. and European schools and universities.
  • VMware Workstation/Fusion VM escape: CVE-2026-59346 (CVSS 9.3) allows guest-to-host code execution; patches available, no active exploitation reported.
  • JetBrains Cadence breach: TeamCity vulnerability exploited to extract AWS credentials; all Cadence users urged to rotate secrets immediately.

Critical Threats

MikroTik RouterOS Exploitation (MikroTrick)

What happened: CERT Polska disclosed six vulnerabilities in MikroTik RouterOS on September 5, with active exploitation confirmed since at least September 2. Attackers are chaining CVE-2026-67276 (SSH authentication bypass) and CVE-2026-86060 (privilege escalation via crafted username) to gain full administrative control of internet-exposed routers without authentication. Attack infrastructure identified at 82.192.72.4 and 103.102.31.18. Additional vulnerabilities include CVE-2026-67277 (bandwidth-test memory disclosure/DoS), CVE-2026-67278 (TLS certificate validation bypass), CVE-2026-67279 (WebFig authentication bypass), and CVE-2026-67281 (unauthenticated file read enabling credential theft).

Impact: Attackers gain full device control, enabling network pivoting, traffic interception, persistent backdoors, and use as attack infrastructure. MikroTik routers are widely deployed in enterprise, ISP, and critical infrastructure environments across Europe and emerging markets. Compromised devices can serve as footholds for lateral movement into connected networks. MikroTik implemented a "Flagged" detection mechanism in patched versions to identify known compromise indicators, but absence of this flag does not guarantee device integrity.

Recommendations:

  • Update all MikroTik RouterOS devices immediately to version 7.25beta3, 7.24.2, 7.23.4, or 6.49.21 depending on branch.
  • After patching, run /system/device-mode/print and check for "Flagged" marker; review logs for suspicious SSH authentication failures and unauthorized user creation (especially account named "ops").
  • Block or restrict SSH access from public networks; implement IP allowlisting for management if remote access is required.
  • Audit all RouterOS configurations for unauthorized users, scripts, scheduler tasks, proxy servers, and tunnels.
  • If compromise indicators are found, perform factory reset, restore from known-good backup, rotate all credentials, and investigate lateral movement.

---

Magento/Adobe Commerce Zero-Day (StyleSmuggler)

What happened: An unpatched zero-day vulnerability in Magento Open Source and Adobe Commerce enables unauthenticated remote code execution via GraphQL. Active exploitation began September 4, with Sansec discovering and disclosing the flaw on September 5. Attackers deploy persistent backdoors disguised as Linux kernel processes with cron persistence. Confirmed victims include fully patched Magento 2.4.6-p15 and 2.4.7-p2 stores. Adobe has not issued a CVE, advisory, patch, or workaround as of September 6. Next scheduled Adobe security release is September 8, but coverage of this flaw is unconfirmed.

Impact: Unauthenticated attackers gain remote code execution on store servers and install persistent backdoors. Implants run as site user, read session data from Redis, and maintain persistence via cron. All current Magento Open Source and Adobe Commerce versions are vulnerable, including 2.4.6, 2.4.7, 2.4.8, and 2.4.9. Headless and PWA storefronts require GraphQL and cannot easily disable it without breaking functionality. Organizations face payment card theft, customer data exfiltration, and supply chain compromise risks.

Recommendations:

  • Immediately disable GraphQL on Magento Open Source and Adobe Commerce stores if not required for headless or PWA storefronts—this is the only interim mitigation until Adobe patches.
  • Hunt for backdoor indicators: process named [kworker/u:8:0], binary at ~/.local/share/.gvfsd/gvfsd-user, cron entries in /var/spool/cron/crontabs restarting every 5 minutes, and 28+ Redis connections on port 6379.
  • Review web server logs for GraphQL exploitation attempts starting September 4, 2026 00:00 UTC and isolate any compromised store accounts immediately.
  • Invalidate all active sessions, rotate admin and API credentials, and audit for rogue admin accounts or database backdoors.
  • Monitor Adobe's security bulletin index and apply patch immediately when released.

---

PaperCut Authentication Bypass and RCE Chain

What happened: Threat actors are actively exploiting CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (remote code execution) in PaperCut NG and MF to steal credentials from educational institutions in the U.S. and Europe. Arctic Wolf identified the campaign, which involves credential theft, registry harvesting tools (lsa_collect.exe, save_hives.exe), Meterpreter payloads, and privileged account creation. Command-and-control infrastructure identified at 45.142.193[.]132 and 194.180.48[.]134.

Impact: Attackers gain full system access to PaperCut servers, extract Windows registry hives (SAM database access), harvest credentials, and establish persistent access. Stolen credentials enable lateral movement to other critical systems. Education sector heavily targeted, with K-12 schools and universities at immediate risk. Internet-exposed PaperCut servers face active exploitation.

Recommendations:

  • Immediately remove PaperCut NG and MF servers from internet exposure; place behind VPN or restrict access to trusted IP ranges.
  • Apply vendor patches for CVE-2026-81578 and CVE-2026-82078 as soon as available; check PaperCut security advisories.
  • Hunt for IOCs: outbound connections to 45.142.193[.]132 and 194.180.48[.]134, files lsa_collect.exe, lsa_collect_small.exe, save_hives.exe, certutil.exe usage, privileged account "Administrator17".
  • Monitor for cmd.exe or powershell.exe spawned by pc-app.exe parent process; alert on discovery commands (whoami, tasklist, ver, uname) and findstr searches in PaperCut config files for "password", "secret", "ldap", "bind", "token".
  • Force password resets for accounts on compromised PaperCut servers and connected systems; assume credential compromise if exploitation detected.

---

VMware Workstation and Fusion VM Escape

What happened: Broadcom released security updates for VMware Workstation and Fusion addressing CVE-2026-59346 (CVSS 9.3), a critical integer-overflow vulnerability that allows local attackers with elevated privileges on guest VMs to execute arbitrary code on the host system. CVE-2026-59347 affects HGFS functionality. Both vulnerabilities affect versions 25H2 and 26H1 and require local administrative privileges on the guest VM.

Impact: VM escape vulnerabilities break hypervisor isolation, allowing attackers with guest VM admin rights to execute code on the ESXi host or VMX process. Organizations running VMware Workstation or Fusion in multi-tenant or untrusted guest environments face elevated risk. No evidence of active exploitation in the wild, but exploitation requires only local admin access on guest VM, which could be obtained through separate compromise.

Recommendations:

  • Upgrade VMware Workstation to version 26H1u1 or later immediately—no workarounds available.
  • Upgrade VMware Fusion to version 26H1u1 or later immediately—no workarounds available.
  • Audit guest VM administrative access controls and enforce least privilege to reduce attack surface.
  • Monitor VMX process behavior and host-level logs for unusual code execution or privilege escalation attempts.
  • Prioritize patching for environments running untrusted or multi-tenant guest VMs with VMXNET3 adapters.

---

JetBrains Cadence Breach via TeamCity

What happened: JetBrains suffered a security breach when unidentified threat actors exploited a critical vulnerability in TeamCity to compromise the Cadence environment and extract AWS credentials. JetBrains is advising all Cadence users to immediately revoke and rotate their credentials and secrets.

Impact: Compromised AWS credentials could enable attackers to access cloud resources, exfiltrate data, deploy malicious infrastructure, or pivot to additional systems. Organizations using JetBrains Cadence face immediate risk of cloud environment compromise. The breach demonstrates supply chain risk in developer tooling and CI/CD platforms.

Recommendations:

  • Immediately revoke and rotate all AWS credentials and secrets stored in JetBrains Cadence.
  • Review AWS CloudTrail logs for unauthorized access or unusual API activity associated with potentially compromised credentials.
  • Audit IAM policies and reduce permissions to least privilege for all service accounts and API keys.
  • Apply TeamCity security updates and review JetBrains security advisories for additional guidance.
  • Implement credential rotation policies and consider using AWS Secrets Manager or similar solutions for dynamic credential management.

Threat Actor Activity

Education Sector Credential Harvesting Campaign

An unattributed threat actor is conducting a targeted campaign against educational institutions in the U.S. and Europe, exploiting PaperCut vulnerabilities (CVE-2026-81578, CVE-2026-82078) to harvest credentials. Arctic Wolf Adversary Research Team identified the activity, which employs commodity tools including Metasploit/Meterpreter and custom registry harvesting utilities (lsa_collect.exe, save_hives.exe). Post-exploitation TTPs include account discovery (whoami), system information gathering (uname, ver, tasklist), privileged account creation ("Administrator17"), and OS credential dumping via SAM database extraction. The actor searches PaperCut configuration files for passwords, secrets, LDAP binds, and tokens using findstr. Command-and-control infrastructure at 45.142.193[.]132 and 194.180.48[.]134 delivers Meterpreter Java payloads. The campaign's focus on credential theft and reconnaissance suggests either ransomware pre-positioning or initial access operations for subsequent sale or lateral movement into broader institutional networks.

REVSTEALER Persistent Module Campaign

A commercial infostealer operation active since February 2026 is distributing REVSTEALER via compromised YouTube channels promoting game cheats, fake software (including fake Claude Opus 5 Desktop), and pirated applications. Elastic Security Labs identified four persistent modules (ProManager, WinUpdate, SoftManager, LockAppHost) that remain after the core stealer self-deletes. The campaign targets cryptocurrency wallet users, gamers, and general Windows users. Core stealer exfiltrates browser credentials, cryptocurrency wallets, gaming accounts (including Roblox session hijacking), messaging data, VPN/FTP configs, and password managers. Chrome App-Bound Encryption is bypassed via debugger technique. Persistent modules enable wallet overlay attacks, clipboard hijacking for crypto addresses, reverse proxy for attacker traffic routing, and cryptocurrency mining with disabled Windows Update and Defender. The malware uses advanced evasion including sandbox checks, language-based termination, indirect syscalls, and blockchain-based C2 fallback via Polygon smart contracts. At least 17 YouTube channels identified distributing malware through AI-generated videos.

ClickFix Blockchain-Hosted Payload Campaign

A large-scale cybercriminal campaign is exploiting over 5,400 compromised small-business websites to distribute ClickFix social engineering payloads stored in smart contracts on the BNB Smart Chain blockchain. This operation leverages blockchain infrastructure to host malicious payloads, making detection and takedown more difficult through traditional abuse reporting. The campaign employs fake CAPTCHA and fake error messages prompting manual actions to trick users into executing malicious scripts. Blockchain hosting complicates payload removal, requiring organizations to focus on endpoint detection and user awareness rather than source blocking.

Geopolitical Context

Central and Eastern European Network Infrastructure Targeting

The active exploitation of MikroTik RouterOS vulnerabilities carries significant implications for European network resilience, particularly in Central and Eastern Europe where MikroTik devices are widely deployed in enterprise, ISP, and critical infrastructure environments. Poland's CERT coordination of vulnerability disclosure and observation of active exploitation since September 2 underscores the country's growing role as a regional cybersecurity hub within NATO and EU cyber defense architecture. The timing is notable given heightened threat activity targeting European telecommunications and energy sectors amid ongoing geopolitical tensions. MikroTik's market share in the Balkans and post-Soviet states means compromised devices could provide footholds in networks supporting critical services, cross-border connectivity, and government communications. Poland's position as a NATO eastern flank state and critical transit hub for energy and data flows amplifies the strategic sensitivity of telecommunications infrastructure vulnerabilities.

Western Education Sector Under Pressure

The PaperCut exploitation campaign against U.S. and European educational institutions represents targeted activity against a traditionally under-resourced sector with significant intellectual property and research data. Educational institutions maintain extensive personally identifiable information, research data, and often serve as nodes in national research and innovation ecosystems. The deployment of credential harvesting tools and Meterpreter payloads suggests a campaign oriented toward persistent access and lateral movement rather than immediate financial gain, consistent with both cybercriminal pre-positioning for ransomware deployment and state-aligned espionage operations targeting academic research. The transatlantic scope indicates either opportunistic exploitation of vulnerable internet-facing systems or deliberate focus on Western educational infrastructure. Universities engaged in dual-use technology development or government-funded research programs face elevated risk of data exfiltration.

E-Commerce Supply Chain Vulnerability

The StyleSmuggler zero-day exploitation highlights supply chain risk affecting global e-commerce infrastructure. The absence of a timely patch from Adobe despite active exploitation raises questions about coordinated vulnerability disclosure processes and vendor security response mechanisms. Dutch security firm Sansec's early public disclosure reflects tension between responsible disclosure norms and the imperative to protect potential victims during active campaigns. European retailers face heightened compliance risk under GDPR if customer data is exfiltrated, with potential fines and notification obligations. The incident may accelerate regulatory scrutiny of software vendor security practices within the EU's evolving cybersecurity framework, including the Cyber Resilience Act and NIS2 Directive.

Recommended Actions

Immediate (0-24 hours)

1. MikroTik RouterOS: Update all devices to version 7.25beta3, 7.24.2, 7.23.4, or 6.49.21; block SSH from public networks; audit for unauthorized "ops" accounts.
2. Magento/Adobe Commerce: Disable GraphQL if not required; hunt for backdoor process [kworker/u:8:0] and binary at ~/.local/share/.gvfsd/gvfsd-user; invalidate all sessions.
3. PaperCut: Remove servers from internet exposure; apply patches for CVE-2026-81578 and CVE-2026-82078; hunt for IOCs including connections to 45.142.193[.]132 and 194.180.48[.]134.
4. JetBrains Cadence: Revoke and rotate all AWS credentials and secrets; review CloudTrail logs for unauthorized access.
5. VMware Workstation/Fusion: Upgrade to version 26H1u1 or later; audit guest VM administrative access controls.

Short-term (24-72 hours)

1. REVSTEALER: Hunt for persistence mechanisms in Registry Run keys and scheduled tasks; verify Windows Update services are running; check Microsoft Defender exclusions for unauthorized entries.
2. ClickFix campaign: Deploy endpoint detection rules for PowerShell and clipboard manipulation; implement network monitoring for BNB Smart Chain RPC endpoints; conduct user security awareness training.
3. Jenkins: Review official Jenkins Security Advisory for specific CVE IDs and affected versions; identify all Jenkins instances; apply security updates to core and plugins.
4. MikroTik: Review logs for suspicious SSH authentication attempts and unusual file access via WebFig; rotate credentials on all devices.
5. PaperCut: Force password resets for accounts on compromised servers and connected systems; review logs for suspicious GET requests to /custom/pcp_*.txt paths.

This week

1. Implement application control to block execution from user profile directories where possible; restrict CMSTP.exe abuse via AppLocker or WDAC policies.
2. Enable enhanced logging for PowerShell script execution (ScriptBlock logging, module logging) and monitor for suspicious clipboard access patterns.
3. Harden cryptocurrency wallet environments; educate users on overlay attacks targeting Electron-based wallets; enable clipboard monitoring for crypto address replacement.
4. Review and harden web application security for owned small-business sites to prevent compromise and inclusion in ClickFix campaign.
5. Conduct comprehensive asset inventory for MikroTik, VMware, PaperCut, Jenkins, and Magento/Adobe Commerce deployments; prioritize patching for internet-facing systems.

Watch List

  • Adobe security bulletin: Monitor for StyleSmuggler patch, potentially September 8 but not confirmed.
  • PaperCut security advisories: Watch for official patches addressing CVE-2026-81578 and CVE-2026-82078.
  • MikroTik exploitation infrastructure: Monitor for additional attacker IP addresses beyond 82.192.72.4 and 103.102.31.18.
  • REVSTEALER distribution channels: Track additional compromised YouTube channels and fake software distribution sites.
  • ClickFix blockchain contracts: Monitor BNB Smart Chain for additional malicious smart contracts hosting payloads.
  • TeamCity vulnerability: Watch for additional details on the JetBrains Cadence breach and affected TeamCity versions.

Sources

  • CERT.PL (Poland): MikroTik RouterOS vulnerability disclosures and active exploitation warnings
  • The Hacker News: MikroTik, Magento, PaperCut, VMware, JetBrains, Trezor, and REVSTEALER reporting
  • BleepingComputer: ClickFix blockchain-hosted payload campaign
  • CERT.BE (Belgium): VMware Workstation/Fusion and Jenkins vulnerability advisories
  • Arctic Wolf Adversary Research Team: PaperCut exploitation campaign analysis
  • Elastic Security Labs: REVSTEALER persistent module analysis
  • Sansec: Magento/Adobe Commerce StyleSmuggler zero-day disclosure
  • Broadcom: VMware security advisories