# Threat Intel Brief — September 8, 2026

TL;DR

  • Magento StyleSmuggler zero-day actively exploited to deploy Linux backdoors on e-commerce sites; no patch available as of September 7.
  • N-able N-central RMM platform faces fourth critical RCE hotfix in five weeks (CVE-2026-86218) amid conflicting reports of in-the-wild exploitation.
  • MikroTik RouterOS vulnerabilities (CVE-2026-67276, CVE-2026-86060, CVE-2026-67277) enable unauthenticated SSH takeover; active exploitation confirmed by Poland's CERT.
  • BigBear 2.0 phishing-as-a-service bypassed MFA at 258 organizations, stealing 5,000+ Microsoft 365 credentials via adversary-in-the-middle attacks.
  • Multiple RMM and remote access tools under sustained attack: ConnectWise ScreenConnect abused for worm-like VBScript propagation, new unpatched ScreenConnect flaw disclosed.

---

Critical Threats

Magento StyleSmuggler Zero-Day Exploitation

What happened:
A zero-day vulnerability dubbed "StyleSmuggler" affecting all versions of Magento and Adobe Commerce is being actively exploited since September 4 to deploy a Rust-based Linux backdoor. Attackers inject PHP code via the Magento template system, establish persistence through cron jobs, and disguise malicious processes as legitimate system services (kworker, fc-cache). The backdoor uses NTP-mimicking traffic on UDP port 123 to evade detection. Adobe confirmed a fix is in development but has not yet released a patch; the next scheduled security update is September 8, though inclusion of the StyleSmuggler fix remains unconfirmed.

Impact:
Over 160,000 Magento/Adobe Commerce websites globally face immediate risk of full server compromise, including 14,000 sites in the top 1 million. Attackers gain remote command execution capability with web server privileges. E-commerce operators report surges in "Payment Transaction Failed Reminder" emails as an exploitation indicator. The backdoor's persistence mechanisms and process-masquerading techniques complicate detection and remediation.

Recommendations:

  • Disable GraphQL on all Magento and Adobe Commerce instances immediately as a temporary mitigation.
  • Hunt for suspicious processes named kworker/u:8:0 or fc-cache in ~/.cache/fontconfig/ directories and audit cron jobs for unauthorized entries repeating every 30 minutes.
  • Block or monitor outbound UDP traffic to port 123 from web servers; investigate connections to unfamiliar NTP-like hostnames.
  • Rotate all Magento administrative and database credentials if compromise is suspected.
  • Apply Adobe security patches immediately when released on September 8; monitor vendor advisories for confirmation of StyleSmuggler remediation.

---

N-able N-central RMM Platform Under Sustained Attack

What happened:
N-able released its fourth emergency hotfix in five weeks to address CVE-2026-86218, a maximum-severity (CVSS 4.0: 10.0) unauthenticated remote code execution vulnerability in the N-central remote monitoring and management platform. All on-premises builds below version 2026.3.1.14 are affected, including systems already patched with Hotfix 3. Conflicting vendor statements exist: N-able's incident notice reports in-the-wild exploitation observed by an independent researcher, while release notes state exploitation is unconfirmed. Huntress reproduced a proof-of-concept exploit chain but cannot confirm this specific CVE was used in observed compromises. This follows confirmed August 2026 intrusions where attackers used authentication bypass flaws to deploy Cloudflare tunnels on managed devices.

Impact:
Compromise of an RMM platform grants attackers privileged access to all managed client networks and devices, enabling widespread lateral movement, data theft, and ransomware deployment across MSP customer bases. Approximately 1,500 N-central instances remain exposed online. Historical patterns show slow patching: 880 servers remained vulnerable weeks after previous N-central zero-days in 2025. No interim mitigations are available; patching is the only remediation.

Recommendations:

  • Upgrade all on-premises N-central servers to version 2026.3.1.14 (Hotfix 4) immediately; direct upgrade paths available from versions 2025.4, 2026.1, 2026.2, 2026.3, and prior hotfixes.
  • Restrict inbound access to N-central consoles using IP allowlisting or VPN; consider taking internet-facing servers offline until patched.
  • Audit all N-central user accounts for unexpected or unauthorized users created since August 2026.
  • Review N-central server logs and managed endpoint activity for unauthorized Take Control sessions and Cloudflare tunnel registrations.
  • Hosted N-central (NCOD) customers should verify with vendor that patches have been applied; monitor N-able status page for updated indicators of compromise.

---

MikroTik RouterOS Exploit Chain Enables Unauthenticated Takeover

What happened:
Attackers are actively exploiting a chain of vulnerabilities in MikroTik RouterOS to gain full administrative control of routers with SSH services exposed to the internet. Poland's CERT Polska issued a warning on September 5 regarding successful attacks dating back to at least September 2. The exploit chain leverages CVE-2026-67276 (SSH authentication bypass) and CVE-2026-86060 (SSH privilege escalation) to achieve unauthenticated admin access. A third vulnerability, CVE-2026-67277, allows unauthenticated attackers to crash routers or leak kernel memory via the bandwidth-test service. Attack infrastructure has been identified at IP addresses 82.192.72.4 (confirmed successful attacks) and 103.102.31.18 (exploitation attempts). Approximately 122,500 MikroTik devices have exposed SSH interfaces as of September 5.

Impact:
MikroTik routers are widely deployed in SMB and enterprise edge environments, particularly across Europe and emerging markets. Successful exploitation enables network traffic interception, routing manipulation, credential theft, and pivot points for lateral movement into protected networks. Compromised routers can serve as persistent footholds for espionage or pre-positioning activities. Belgium's CERT.BE issued a critical warning urging immediate patching, reflecting heightened concern across European national CERTs.

Recommendations:

  • Immediately update MikroTik RouterOS to version 7.24.2, 7.23.4, 6.49.21, or 7.25beta3 or later to patch CVE-2026-67276, CVE-2026-86060, and CVE-2026-67277.
  • Review RouterOS logs for indicators of compromise: login failures for user -2, user additions by ssh:-2@, or presence of unauthorized ops accounts with elevated privileges.
  • Block or restrict external access to SSH (port 22), WWW/WWW-SSL (ports 80/443), and bandwidth-test services via firewall rules; disable these services if not required.
  • If compromise is suspected based on indicators or connections from 82.192.72.4 or 103.102.31.18, isolate the device, preserve logs and configuration for forensics, perform factory reset, and rebuild from trusted backup while rotating all SSH keys and passwords.
  • Monitor for connections from known malicious IPs and review SSH authentication logs for anomalous activity or privilege escalation events.

---

Threat Actor Activity

BigBear 2.0 Phishing-as-a-Service Bypasses MFA at Scale

A phishing-as-a-service platform called BigBear 2.0 has been used to bypass multi-factor authentication at 258 organizations across 40+ countries, stealing over 5,000 Microsoft 365 credentials. The campaign, tracked as PREY-0058 by Arctic Wolf and UNC6671 by Mandiant, employs Evilginx2-based adversary-in-the-middle infrastructure to intercept session tokens. CloudSEK documented 5,137 credential records stolen, including 474 complete MFA-bypassed authentications, 1,032 plaintext passwords, and 4,148 session cookies. The platform uses custom JavaScript to disable FIDO2/WebAuthn browser functionality, forcing victims to weaker authentication methods, and employs geo-matched residential proxies across 69 countries to evade Microsoft's anomaly detection. Real-time credential exfiltration via Telegram bots enables immediate account takeover. The administration panel remained online at time of reporting, though phishing infrastructure had been offline for three weeks prior.

Defensive actions:

  • Force password reset and revoke all active sessions and refresh tokens for Microsoft 365 accounts, prioritizing high-privileged and admin accounts.
  • Review Microsoft 365 sign-in logs (Entra ID) for authentication from residential proxy IPs or geo-mismatched locations between user and authentication source.
  • Enforce phishing-resistant FIDO2/WebAuthn authentication methods and disable legacy MFA (SMS, voice, push notifications without number matching).
  • Implement Conditional Access policies requiring managed/compliant devices for Microsoft 365 access.

PEEP Toolkit Converts Browsers into Post-Compromise Backdoors

SOCRadar disclosed PEEP, a Chromium-based post-exploitation toolkit that masquerades as a "Smart Bookmarks" extension to turn Chrome and Edge browsers into backdoors for host command execution. The toolkit requires prior administrative access or code execution on target systems and injects malicious extensions directly into browser profiles while bypassing Web Store checks and user prompts. PEEP is a derivative of the open-source RedExt framework, previously used in GlassWorm attacks. Active C2 infrastructure at 206.237.30.232 and xfjcc[.]fun shows 34 agent entries and 10 active sessions. The malware exfiltrates browsing history, session cookies, credentials, and active-tab metadata via plaintext HTTP every 30 seconds. Attribution points to a Chinese-speaking threat actor based on source code artifacts.

Defensive actions:

  • Block C2 infrastructure at perimeter: IP 206.237.30.232 and domain xfjcc[.]fun.
  • Hunt for malicious extension ID ejkndncpkdcjcikfhiamcdehdoegilbj in Chrome/Edge profiles across Windows and Linux endpoints.
  • Audit enterprise Chrome/Edge policies for unauthorized ExtensionInstallForcelist or ExtensionSettings entries.
  • Monitor for Secure Preferences file modifications in Chrome/Edge user profiles and unexpected native messaging host binaries in user context.

REVSTEALER Deploys Persistent Modules for Crypto Mining

Elastic Security Labs discovered four previously unreported modules linked to REVSTEALER, a Windows information stealer active since February 2026. The modules (ProManager, WinUpdate, SoftManager, LockAppHost) persist on infected systems after the core stealer self-deletes. LockAppHost disables Windows Update and Microsoft Defender, then runs a cryptocurrency miner with admin rights—defenses remain weakened after miner removal. ProManager overlays fake windows on cryptocurrency wallets to steal credentials. SoftManager turns endpoints into reverse proxies routing attacker traffic. WinUpdate performs clipboard hijacking to replace crypto addresses. The core stealer exfiltrates browser passwords (bypassing Chrome App-Bound Encryption via debugger), cookies, 50+ wallet types, Telegram sessions, VPN/FTP configs, password managers, and documents. The malware uses blockchain-based C2 fallback via Polygon smart contracts for resilience against takedowns.

---

Geopolitical Context

European Network Infrastructure Under Sustained Pressure

The convergence of critical vulnerabilities in MikroTik RouterOS, SonicWall Network Security Manager, and widespread RMM platform compromises reflects sustained pressure on European network infrastructure. Belgium's CERT.BE issued urgent warnings for both MikroTik and SonicWall vulnerabilities, while Poland's CERT Polska confirmed active MikroTik exploitation dating to September 2. MikroTik devices hold substantial market share in Central and Eastern Europe, including Poland, Ukraine, and Baltic states—regions with heightened threat environments. The timing and technical sophistication of these attacks—achieving unauthenticated administrative control—is consistent with reconnaissance or pre-positioning activities. While no attribution has been publicly disclosed, the technical profile aligns with tradecraft observed in operations attributed to multiple state-aligned advanced persistent threat groups. Poland's role as a NATO frontline state and logistics hub for Ukraine support operations elevates the strategic sensitivity of any compromise affecting its network infrastructure providers.

Supply Chain Vulnerabilities in Cryptocurrency Sector

The Trezor data breach, affecting 81,000 customers via third-party logistics provider ShipMonk, underscores systemic supply chain vulnerabilities in cryptocurrency infrastructure. The breach occurred through exploitation of a Metabase analytics platform zero-day SQL injection vulnerability, linked to the ShinyHunters extortion gang. ShipMonk's failure to delete legacy customer data dating to 2019–2021 despite contractual obligations amplified breach impact by 5x beyond initial disclosure. The exposed customer data—including physical addresses—creates elevated physical security risks in jurisdictions with organized crime activity targeting cryptocurrency holders. The incident may accelerate regulatory scrutiny of third-party vendor risk management practices, particularly under GDPR in European jurisdictions and state-level breach notification laws in the United States.

---

Recommended Actions

Immediate (0-24 hours)

1. Patch N-able N-central to version 2026.3.1.14 (Hotfix 4) immediately; restrict internet access to consoles until patched.
2. Update MikroTik RouterOS to versions 7.24.2, 7.23.4, 6.49.21, or 7.25beta3 or later; block external access to SSH, WWW, and bandwidth-test services.
3. Disable GraphQL on all Magento and Adobe Commerce instances as temporary mitigation for StyleSmuggler zero-day.
4. Hunt for PEEP browser backdoor extension ID ejkndncpkdcjcikfhiamcdehdoegilbj in Chrome/Edge profiles; block C2 infrastructure at 206.237.30.232 and xfjcc[.]fun.
5. Force password reset and revoke all active sessions for Microsoft 365 accounts; review Entra ID sign-in logs for residential proxy sources.

Within 24-72 hours

6. Apply SonicWall NSM patches per vendor guidance; check MySonicWall portal for latest security advisories.
7. Audit ConnectWise ScreenConnect client installations for unauthorized instances connecting to non-corporate C2 servers (45.13.237.190, 131.123.40.98:8041, borertors92.anondns[.]net).
8. Hunt for REVSTEALER persistence mechanisms: Registry Run keys, scheduled tasks, and services matching names ProManager, WinUpdate, SoftManager, LockAppHost.
9. Review Telerik UI for ASP.NET AJAX deployments; upgrade to version 2026.2.708 or later to address CVE-2026-13181, CVE-2026-13182, CVE-2026-13183, CVE-2026-13184.
10. Implement Conditional Access policies in Microsoft 365 to restrict sign-ins from residential proxy IP ranges and enforce device compliance checks.

This week

11. Deploy phishing-resistant MFA (FIDO2/WebAuthn) for all users, prioritizing executives and help desk staff.
12. Train help desk staff to verify caller identity through out-of-band methods before assisting with authentication or MFA issues.
13. Monitor for ConnectWise ScreenConnect patch release expected this week; apply immediately upon availability.
14. Review third-party vendor contracts for data retention and deletion clauses; audit compliance with data minimization policies.
15. Conduct threat hunt for indicators of compromise across MikroTik, N-able, and ScreenConnect environments using published IOCs.

---

Watch List

  • Adobe Commerce/Magento patch release (September 8): Confirm StyleSmuggler remediation included; apply immediately.
  • ConnectWise ScreenConnect file transfer vulnerability: Patch expected later this week; monitor vendor advisories.
  • N-able N-central exploitation confirmation: Vendor statements conflict on in-the-wild exploitation; monitor for updated IOCs and detection guidance.
  • Mathspace data breach: Over 1 million students, staff, and parents affected via compromised Metabase internal reporting system; monitor for follow-on phishing campaigns.
  • TantoSec Telerik UI exploit: Public proof-of-concept released September 7 for CVE-2026-13181 through CVE-2026-13184; no confirmed wild exploitation but historical targeting by ransomware groups increases risk.

---

Sources

  • BleepingComputer: Magento StyleSmuggler zero-day exploited to deploy Linux backdoor
  • BleepingComputer: N-able patches max severity N-central flaw amid ongoing attacks
  • BleepingComputer: Hackers exploit new MikroTik RouterOS flaws to hijack routers
  • BleepingComputer: BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations
  • BleepingComputer: Trezor data breach impact now reaches 81,000 customers
  • BleepingComputer: ConnectWise warns of new ScreenConnect flaw without patch
  • The Hacker News: N-able Issues Fourth N-central Hotfix in Five Weeks for Unauthenticated RCE Flaw
  • The Hacker News: Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication
  • The Hacker News: PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution
  • The Hacker News: Fake IT Calls Target Executives in Microsoft 365 Data Theft and Extortion Attacks
  • The Hacker News: Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts
  • The Hacker News: Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner
  • The Hacker News: Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released
  • CERT.BE: Warning: Critical vulnerabilities in Mikrotik RouterOS, Patch Immediately!
  • CERT.BE: Warning: Vulnerability in SonicWall Network Security Manager, Patch Immediately!