# Threat Intel Brief — September 15, 2026

TL;DR

  • China-aligned UNC3569 actively exploiting CVE-2026-51990 in Tencent Sogou Input Method to deploy GrayRabbit backdoor; hundreds of millions of installations at risk.
  • Red Heron (suspected Chinese actor) compromised 13 organizations across six countries via Gitea RCE (CVE-2026-60004), targeting defense, energy, and election systems with focus on Taiwan.
  • Critical VPN vulnerabilities in Check Point (unauthenticated RCE) and GitLab (path traversal) require immediate patching; CERT.BE issued emergency advisories.
  • Mass-scanning campaign targeting Vite development servers (CVE-2026-39364) to steal AWS/Azure credentials from exposed environments.
  • Microsoft emergency patches released for Remote Desktop Services failures affecting Windows Server 2019/2022/2025 after September 2026 updates caused widespread RDP outages.

---

Critical Threats

Tencent Sogou Input Method Exploited for Espionage

What happened:
China-aligned threat actor UNC3569 is actively exploiting CVE-2026-51990, a critical one-click remote code execution vulnerability in Tencent's Sogou Input Method for Windows. The flaw affects versions prior to 16.3.0.3498 and leverages unvalidated URI handlers and an outdated, unsandboxed Chromium 80 engine. Attackers deliver crafted sgbiz: URI links that achieve RCE and deploy the GrayRabbit backdoor—a modular malware family with capabilities including reverse shells, file exfiltration, system reconnaissance, and in-memory plugin loading.

Impact:
Sogou Input Method has hundreds of millions of installations concentrated in China and Chinese-speaking populations globally. Successful exploitation grants persistent backdoor access enabling data exfiltration, lateral movement, and long-term espionage operations. Organizations with Chinese-language input requirements or operations in Greater China face immediate compromise risk. The underlying Chromium engine remains outdated despite the April 2026 patch, leaving residual vulnerability exposure.

Recommendations:

  • Update Sogou Input Method to version 16.3.0.3498 or later immediately across all Windows endpoints.
  • Block sgbiz: URI scheme at email gateways, web proxies, and endpoint security controls.
  • Hunt for GrayRabbit indicators: monitor biz_helper.exe and SGMyInput.exe spawning unexpected child processes, outbound connections from Sogou processes, and RC4-encoded C2 traffic.
  • Consider replacing Sogou with alternative input methods if not business-critical, given residual risk from outdated browser engine.

---

Check Point VPN Unauthenticated RCE

What happened:
CERT.BE issued an urgent advisory warning of an unauthenticated remote code execution vulnerability in Check Point VPN products. Specific affected versions and CVE identifier have not been publicly disclosed. The vulnerability allows attackers to gain full control of VPN gateways without credentials.

Impact:
Check Point VPN solutions are widely deployed across government, financial, telecommunications, and healthcare sectors globally. Unauthenticated RCE on internet-facing VPN gateways represents a critical perimeter breach risk, enabling attackers to compromise entire network infrastructures. VPN devices are high-value targets for state-sponsored actors seeking persistent access to sensitive environments.

Recommendations:

  • Identify all Check Point VPN products in your environment immediately (firewalls, gateways, remote access VPN).
  • Apply vendor-provided security updates from Check Point's security advisories portal as emergency maintenance.
  • Monitor VPN gateway logs for unusual authentication attempts, unexpected processes, or configuration changes.
  • If patching cannot be completed within 24 hours, restrict VPN access to known IP ranges and implement additional network segmentation.

---

GitLab Path Traversal Vulnerability

What happened:
CERT.BE issued a critical warning regarding a path traversal vulnerability in GitLab Community Edition (CE) and Enterprise Edition (EE). Specific affected versions and CVE identifier have not been disclosed. Path traversal flaws can enable unauthorized access to sensitive files, source code repositories, configuration files, and credentials.

Impact:
GitLab is extensively deployed across government, defense, and private sector organizations for source code management and DevOps workflows. Exploitation could expose intellectual property, credentials, and operational data. The critical severity rating and immediate patching recommendation suggest high exploitability and significant risk.

Recommendations:

  • Identify all GitLab CE and EE instances in your environment immediately.
  • Apply the latest GitLab security patches from official security releases.
  • Review GitLab access logs for suspicious file access patterns or path traversal attempts (../ sequences, unusual file paths).
  • Restrict network access to GitLab instances to trusted networks until patching is complete.
  • Monitor https://about.gitlab.com/security/ for specific CVE details and affected version ranges.

---

Red Heron Gitea Exploitation Campaign

What happened:
Red Heron, a suspected Chinese threat actor, exploited CVE-2026-60004 (Gitea RCE) within days of July 2026 disclosure to compromise 13 organizations across Canada, Argentina, Taiwan, United States, Qatar, and Sri Lanka. The actor weaponized public proof-of-concept code into an automated Python exploitation framework, deployed JITTERLY (C++ Linux backdoor) and SIXZUT (LD_PRELOAD rootkit), and conducted extensive reconnaissance scanning 1,386 Gitea instances across seven countries. A separate dataset of 477 Taiwan-based systems suggests prioritized targeting.

Impact:
Compromised organizations span defense, election systems, energy, aerospace, telecommunications, government, and research sectors. The actor achieved root-level access to multi-node infrastructure, exfiltrated source code, configuration secrets, internal tokens, and SSH keys. The campaign demonstrates rapid N-day weaponization capability and sophisticated post-exploitation tradecraft including credential theft, lateral movement, and persistent access mechanisms.

Recommendations:

  • Immediately patch CVE-2026-60004 on all internet-facing Gitea instances.
  • Conduct forensic review of systems exposed during July-September 2026 for indicators of compromise.
  • Monitor for LD_PRELOAD rootkit activity (SIXZUT) by auditing /etc/ld.so.preload and environment variables.
  • Implement network segmentation to prevent lateral movement from development platforms to production infrastructure.
  • Audit and rotate credentials, SSH keys, API tokens, and configuration secrets stored in Git repositories.

---

Vite Development Server Credential Theft Campaign

What happened:
A mass-scanning campaign is actively exploiting CVE-2026-39364 (alongside CVE-2025-30208, CVE-2025-31125, and CVE-2024-45811) to target internet-exposed Vite development servers. Attackers bypass file access controls to steal cloud credentials from .env files, AWS credentials, Azure tokens, and Terraform state files. Over 800 attacks and 32,000 raw events were observed in one month, primarily from Google Cloud IP ranges in the US, Belgium, and Netherlands.

Impact:
Successful exploitation grants unauthorized access to production cloud infrastructure, enabling lateral movement, data exfiltration, and resource hijacking. Development teams using Vite with cloud integrations face immediate credential compromise risk if servers are internet-accessible. Affected versions include Vite 7.1.0 through 7.3.2 and 8.x before 8.0.5.

Recommendations:

  • Update Vite to version 7.3.3 or later (7.x) or 8.0.5 or later (8.x) immediately.
  • Block inbound access to TCP port 5173 at firewall; ensure Vite binds only to localhost (127.0.0.1), not 0.0.0.0.
  • Block or alert on HTTP requests containing /@fs/ path segments at WAF or reverse proxy.
  • Rotate all AWS access keys, Azure service principal credentials, and secrets in .env files if Vite servers were publicly exposed since April 7, 2026.
  • Audit Docker configurations and CI/CD pipelines to prevent accidental exposure of development servers.

---

Threat Actor Activity

UNC3569 (China-aligned Espionage Group)

UNC3569 continues sophisticated exploitation of CVE-2026-51990 in Tencent Sogou Input Method, deploying the GrayRabbit backdoor family. The group operates across cybercrime and cyber contractor-for-hire ecosystems, demonstrating rapid vulnerability weaponization and modular malware development. Targeting focuses on Chinese-speaking populations, likely including government entities, enterprises, and individuals within China and diaspora communities. The 64-bit GrayRabbit variant observed in 2026 represents continued evolution from the 2024 baseline, indicating sustained investment in tooling and operational refinement.

Red Heron (Suspected Chinese APT)

Red Heron demonstrates advanced capabilities including rapid N-day weaponization, custom tooling development (JITTERLY, SIXZUT), and multi-stage intrusion operations. The actor's use of Simplified Chinese labels, classification of Taiwan as part of China, and targeting patterns align with Chinese intelligence collection priorities. The campaign's scope across defense, election systems, energy, and government sectors—with disproportionate focus on Taiwan (477 systems catalogued separately)—suggests deliberate strategic intelligence collection aligned with Chinese state interests.

HISHIMIRO/jeetbot.cc (Commercial Bot Service)

Cyprus-based commercial bot service operator Aleksandr Popov distributed a malicious Twitch browser extension that exfiltrated OAuth tokens from nearly 31,000 users to Russian-operated proxy infrastructure. The extension was distributed through official Chrome and Firefox stores, leveraging user trust in legitimate distribution channels. The deliberate exclusion of ten Russian-language streamer channels from token forwarding suggests intentional design choices in the exfiltration architecture, though the actor claims the leakage was an "oversight."

3BB Thailand Intrusion (Unattributed)

An unattributed threat actor gained root access to 3BB, Thailand's largest broadband provider, using MeshCentral as a persistent backdoor. The intrusion targeted RADIUS databases containing subscriber credentials and demonstrated sophisticated tradecraft including SSH password spraying, web shell deployment, and cleanup scripts designed to erase logs while preserving the backdoor. The actor's focus on telecommunications infrastructure and subscriber authentication data suggests either espionage targeting or preparation for follow-on attacks using stolen broadband credentials.

---

Geopolitical Context

Indo-Pacific Tensions and Taiwan Targeting

Red Heron's separate dataset of 477 Taiwan-based systems and confirmed compromise of four Taiwanese organizations—including an industrial automation company with SCADA/HMI capabilities—underscores persistent cyber pressure on Taiwan's critical infrastructure amid cross-Strait tensions. The systematic treatment of Taiwan as part of China in operational datasets reflects operational priorities consistent with Beijing's geopolitical stance. The successful progression from vulnerable Gitea servers to root-level access across multi-node Proxmox clusters demonstrates cascading supply chain and infrastructure compromise risks.

European Critical Infrastructure Vulnerabilities

CERT.BE's multiple critical advisories (Check Point VPN, GitLab path traversal, compromised IP cameras) reflect heightened threat activity targeting European critical infrastructure. Belgium's position as host to NATO headquarters and EU institutions amplifies the strategic sensitivity of VPN and network security within its jurisdiction. The exploitation of IP cameras for cyberespionage and DDoS operations suggests coordinated campaigns, though no specific attribution has been provided. These incidents underscore persistent gaps in IoT security across European critical infrastructure despite regulatory efforts under NIS2 and the EU Cybersecurity Act.

Japan Government Data Breach

The breach of Japan's Government Solution Service (GSS), exposing 246,000 personnel records, represents a significant compromise of administrative infrastructure supporting a key Indo-Pacific democratic government. The incident remained undetected from initial access until June 25, 2026, demonstrating persistent targeting of Japanese government networks amid heightened regional cyber activity. The exposure of government employee contact information provides valuable targeting data for subsequent social engineering, espionage operations, or influence campaigns. No attribution has been disclosed, though Japan has historically faced cyber intrusions linked to Chinese and North Korean threat actors.

---

Recommended Actions

Immediate (0-24 hours)

  • Patch CVE-2026-51990 (Tencent Sogou Input Method) to version 16.3.0.3498 or later across all Windows endpoints with Chinese-language input requirements.
  • Patch Check Point VPN products per vendor security advisories; restrict VPN access to known IP ranges if patching cannot be completed immediately.
  • Update Vite to version 7.3.3+ or 8.0.5+ and rotate all cloud credentials if development servers were internet-exposed since April 2026.
  • Deploy Microsoft emergency patches (KB5129236, KB5129195, KB5129194, KB5129238, KB5129237, KB5129235) to resolve Remote Desktop Services failures on Windows Server systems.
  • Audit PrestaShop installations for Alior Bank "raty" module and update to version 9.0.8 or later to address CVE-2026-7848 and CVE-2026-15600.

Near-term (24-72 hours)

  • Patch GitLab CE/EE instances per official security releases; review access logs for path traversal attempts.
  • Patch CVE-2026-60004 (Gitea RCE) on all internet-facing instances; conduct forensic review for JITTERLY and SIXZUT indicators.
  • Hunt for GrayRabbit backdoor indicators: monitor Sogou processes for unusual child processes, outbound connections, and RC4-encoded C2 traffic.
  • Audit browser extensions across enterprise endpoints; remove "Twitch Enhanced Viewer | JeetBot" (Chrome: pnhhdhhcadcjfckjhpmjneldiegbojfb, Firefox: twitchenhancedviewer@example.com) and revoke Twitch OAuth tokens.
  • Review VPN gateway logs (Check Point, Fortinet, others) for unusual authentication attempts, unexpected processes, or configuration changes.

This week

  • Implement network segmentation to isolate IP cameras, development servers, and IoT devices from production infrastructure.
  • Deploy behavioral detection for automated account registration and repository enumeration patterns on self-hosted Git platforms.
  • Audit physical access controls for servers running Intel TDX, Scalable SGX, or AMD SEV-SNP confidential computing workloads; verify tamper-evident seals and hardware inspection procedures.
  • Review Microsoft 365 sign-in logs for suspicious authentication method additions, high-volume Microsoft Graph API calls, and bulk SharePoint/OneDrive downloads per passkey phishing campaign indicators.
  • Conduct forensic review of Japanese government personnel records exposure; monitor affected individuals for elevated spear-phishing and social engineering attempts.

---

Watch List

  • Microsoft passkey phishing campaigns (Storm-3121, Storm-3032/UNC6671) targeting Azure AD/Entra ID with CEO fraud and cloud account compromise; over 1 million scam emails sent August 3-5, 2026.
  • Revolut data breach exposing customer financial information and passport data to threat actor impersonating government agency; affected customer count undisclosed.
  • HBO Max Reddit account compromise distributing ClickFix malware via malicious ads targeting Windows and macOS devices.
  • Telegram Desktop HTML export vulnerability (fixed in 7.0.1) allowing JavaScript injection via bot messages; legacy exports created before July 2026 remain vulnerable.
  • DDRop hardware attack breaking Intel TDX and AMD SEV-SNP confidential computing memory protection; requires physical access but proof-of-concept code released on GitHub.

---

Sources

  • BleepingComputer: Microsoft releases emergency Windows updates to fix RDS failures
  • BleepingComputer: Japan's Digital Agency says VPN flaw exposed 246,000 personnel records
  • BleepingComputer: Hackers target exposed Vite dev servers to steal AWS, Azure secrets
  • BleepingComputer: Hackers exploit Tencent app flaw to deploy GrayRabbit malware
  • The Hacker News: Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries
  • The Hacker News: Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users
  • The Hacker News: 3BB Attacker Used MeshCentral Backdoor for Root Access, Targeted Subscriber Credentials
  • The Hacker News: New DDRop Attack Breaks Intel TDX and AMD SEV-SNP Confidential Computing
  • The Hacker News: Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data
  • CERT.BE: Warning: Unauthenticated RCE in Check Point VPN Products, Patch Immediately!
  • CERT.BE: Warning: Critical Path Traversal in GitLab CE/EE, Patch Immediately!
  • CERT.BE: Warning: Compromised IP Cameras Used By Threat Actors To Enable Cyberespionage, Theft, Breaching Into Systems And DDoS
  • CERT.PL: Vulnerabilities in Alior Bank "raty" module for PrestaShop