# Threat Intel Brief — September 16, 2026

TL;DR

  • Cisco Secure Email Gateway zero-day (CVE-2026-76461) actively exploited for unauthenticated root RCE; CISA mandates federal patching by September 17.
  • VMware vCenter flaw now exploited by ransomware gangs following initial APT reconnaissance; over 450 instances remain exposed online.
  • Iranian state actors deploy CHOSEN BRICK spyware via Telegram C2 against dissidents globally; joint US-UK-Netherlands advisory warns of physical threat correlation.
  • Chinese threat actors UTA0560 and APT31 simultaneously weaponized Chrome-Windows zero-day chain targeting NGOs on September 1, suggesting shared exploit procurement.
  • Mass supply-chain attacks compromise Admin Menu Editor Pro (1,500 WordPress sites) and expose Vite dev servers leaking AWS/Azure credentials across 800+ incidents.

---

Critical Threats

Cisco Secure Email Gateway Zero-Day Exploitation (CVE-2026-76461)

What happened:
Cisco disclosed active exploitation of CVE-2026-76461, a critical SQL injection vulnerability (CVSS 9.8) in AsyncOS Software for Secure Email Gateway. Unauthenticated remote attackers can execute arbitrary commands with root privileges by sending crafted emails containing malicious SQL statements. Cisco directly notified affected customers in September 2026 after detecting exploitation. CISA added the flaw to its Known Exploited Vulnerabilities catalog with a September 17 federal patch deadline.

Impact:
Over 400 internet-exposed Secure Email Gateway instances remain vulnerable per Shadowserver tracking. Successful exploitation grants full system control, enabling data exfiltration, email interception, lateral movement, and evidence destruction. Attackers can remove logs and indicators of compromise from the device itself. Email gateways serve as critical perimeter defenses for government, defense, and enterprise networks—compromise undermines organizational security posture at the network edge.

Recommendations:

  • Immediate (0-24h): Upgrade AsyncOS to fixed versions: 15.5.5-0141, 16.0.4-302, or 16.5.0-780. Run detection command grep -i "COPY.*TO PROGRAM" mail_logs on all devices including cluster members.
  • Review mail logs and external firewall logs for suspicious SQL injection attempts or unexpected outbound connections.
  • If exploitation detected, assume full compromise: rotate credentials, conduct forensic analysis, and assess lateral movement from the gateway.

---

VMware vCenter RCE Exploited by Ransomware (CVE-2026-59310)

What happened:
CISA warned that ransomware gangs are actively exploiting CVE-2026-59310, a critical directory traversal vulnerability in VMware vCenter Syslog server enabling unauthenticated remote code execution. Initial exploitation by a suspected APT actor in late July deployed reverse SSH tools across 361+ IP addresses in 47 countries. Ransomware operators subsequently adopted the exploit for initial access to virtualized environments.

Impact:
Compromised vCenter servers provide centralized access to multiple virtual machines, sensitive data repositories, and core business systems. Attackers can deploy VMware-specific encryptors targeting virtual machine environments, causing widespread operational disruption. Over 450 vCenter instances remain internet-exposed. Federal agencies face a three-day CISA patching mandate.

Recommendations:

  • Immediate (0-24h): Apply Broadcom patches released July 29, 2026. Audit vCenter/ESXi servers for unauthorized SSH access, unexpected user accounts, and reverse SSH tunnel activity.
  • Restrict network exposure of vCenter Syslog servers; implement strict firewall rules limiting access to trusted administrative networks only.
  • Monitor for directory traversal attempts and unauthenticated code execution patterns in vCenter logs.

---

Iranian CHOSEN BRICK Spyware Targets Dissidents Globally

What happened:
The FBI, UK NCSC, and Netherlands AIVD jointly attributed CHOSEN BRICK (FBI designation: HEAVYGRAM) malware to Iran's Ministry of Intelligence and Security (MOIS). Active since autumn 2023, the campaign targets Iranian dissidents, journalists, and activists worldwide through social engineering via WhatsApp and Telegram. Attackers impersonate trusted contacts or tech support to deliver trojanized applications. Each victim receives a dedicated Telegram bot for C2, demonstrating operational compartmentalization.

Impact:
Malware capabilities include screenshot capture, audio recording via microphone, credential harvesting from browsers, and exfiltration of Telegram/WhatsApp data. Stolen victim data has appeared on pro-Iranian leak sites, with some posts explicitly calling for violence. The advisory notes Iranian intelligence services have plotted kidnapping and assassination operations against targets abroad, linking cyber surveillance to physical threats.

Recommendations:

  • Within 24-72h: Monitor Windows Registry Run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run) for suspicious entries named 'SMQDService' or 'winappx'.
  • Inspect file systems for anomalous directories with trailing spaces (e.g., 'C:\Windows \SysWOW64').
  • Implement network monitoring for unexpected connections to api.telegram.org, vultrobjects.com, storjshare.io, backblazeb2.com from endpoints.
  • High-risk individuals should enroll in NCSC's dedicated support program and deploy free cyber defense services offered by national agencies.

---

China-Linked Zero-Day Chain Targets NGOs

What happened:
Chinese threat actors UTA0560 and JungleBamboo (APT31) conducted parallel spear-phishing campaigns on September 1, 2026, exploiting the same Chrome-Windows zero-day chain. UTA0560 deployed GRIMWEDGE JavaScript backdoor against multiple NGOs via reflected XSS on a U.S. university website. The actors exploited CVE-2026-85046 (Chrome V8 sandbox escape), CVE-2026-87491 (Chrome browser sandbox escape), and CVE-2026-85880 (Windows ALPC privilege escalation). The simultaneous use by separate groups suggests shared exploit procurement.

Impact:
The attackers exploited a narrow patch gap where fixes existed in Chromium source code but had not yet been incorporated into stable Chrome releases. GRIMWEDGE provides system reconnaissance, file operations, process enumeration, and payload delivery capabilities. The targeting of NGOs aligns with documented Chinese intelligence priorities regarding civil society organizations engaged in advocacy on issues sensitive to Beijing.

Recommendations:

  • Within 24-72h: Monitor for reflected XSS exploitation attempts on public-facing web applications; implement Content Security Policy (CSP) headers.
  • Deploy endpoint detection rules for DLL side-loading patterns (T1574.002), specifically monitoring for legitimate binaries loading unexpected DLLs from non-standard paths using Sysmon Event ID 7.
  • Enable Chrome Enterprise policies to enforce rapid patch deployment; monitor for Chrome extensions with suspicious permissions.
  • Hunt for GRIMWEDGE indicators including MSI installers executing obfuscated JavaScript via custom actions.

---

WordPress Supply Chain: Admin Menu Editor Pro Backdoor

What happened:
A threat actor compromised the Admin Menu Editor Pro plugin maintainer's website (adminmenueditor.com) on September 14, 2026, distributing malicious versions 2.35 and 2.36 to over 200 customers. The compromised updates created hidden administrative accounts and deployed web shells, backdooring approximately 1,500 WordPress sites. The attacker had root-level server access and compromised two consecutive plugin versions.

Impact:
Affected sites contain hidden administrative accounts (usernames beginning with 'wp_'), web shells in includes/wp-user-consent.php, and malicious database entries. Attackers maintain persistent access enabling full site compromise, data exfiltration, malware distribution, and potential lateral movement. The maintainer's website remains offline pending remediation.

Recommendations:

  • Immediate (0-24h): Identify all WordPress sites running Admin Menu Editor Pro versions 2.35 or 2.36.
  • Search for indicators: includes/wp-user-consent.php file, /wp-content/object-cache/ directory, user accounts beginning with 'wp_' in wp_users table, wp_ocache* options in wp_options table.
  • Restore from known-clean backups dated before September 14, 2026, or manually delete the plugin, remove /wp-content/object-cache/ directory, and purge malicious database entries.
  • Rotate all WordPress administrative credentials and API keys; review web server access logs for suspicious activity.

---

Mass Vite Dev Server Credential Theft Campaign

What happened:
Attackers are conducting a mass-scanning campaign exploiting CVE-2026-39364, CVE-2025-30208, CVE-2025-31125, and CVE-2024-45811 in internet-exposed Vite development servers. Over 800 attacks and 32,000 raw events were observed in one month via F5 honeypots. Attackers bypass file access controls to steal cloud credentials (.env files, AWS credentials, Azure tokens), Terraform state files, and serverless configurations. Attack traffic originates primarily from Google Cloud IP ranges in the US, Belgium, and Netherlands.

Impact:
Successful exploitation grants unauthorized access to production cloud infrastructure, enabling lateral movement, data exfiltration, and resource hijacking. Development teams frequently expose Vite servers unintentionally through Docker misconfigurations or convenience flags (--host), expanding attack surface beyond typical production systems.

Recommendations:

  • Immediate (0-24h): Update Vite to version 7.3.3+ or 8.0.5+ to patch all four CVEs.
  • Audit network configurations to ensure Vite dev servers (port 5173) are bound to localhost only; remove --host flags and review Docker port mappings.
  • Block inbound traffic to port 5173 at firewall; implement WAF rules to detect/block suspicious /@fs/ path requests.
  • Blocklist attacker IPs: 34.14.15.105, 34.16.200.129, 34.11.196.206.
  • Rotate all AWS credentials, Azure tokens, API keys, and secrets on systems where Vite was publicly exposed; review CloudTrail and Azure Activity Logs for unauthorized access from April 7, 2026 onward.

---

Threat Actor Activity

Iranian Ministry of Intelligence and Security (MOIS)

MOIS continues global surveillance operations against dissidents, activists, and journalists using CHOSEN BRICK/HEAVYGRAM malware controlled via Telegram bot infrastructure. The joint US-UK-Netherlands advisory explicitly links cyber collection to physical threat plotting, including kidnapping and assassination operations. Stolen data appears on pro-Iranian leak sites with incitement to violence. Targeting extends to the UK, US, Netherlands, and globally since at least 2025.

Chinese APT Groups (UTA0560, APT31/JungleBamboo)

Two distinct Chinese threat actors simultaneously deployed the same Chrome-Windows zero-day exploit chain on September 1, 2026, targeting NGOs. The parallel operations suggest shared access to advanced tooling, likely through a common exploit vendor. UTA0560 delivered GRIMWEDGE JavaScript backdoor; APT31 deployed SUPERSTOMP loader and LONGTALE credential-stealing Chrome extension. The targeting of civil society organizations aligns with documented Chinese intelligence collection priorities.

Red Heron (Suspected China-Nexus)

Red Heron exploited CVE-2026-60004 (Gitea RCE) to compromise 13 organizations across six countries, including defense, election, energy, aerospace, telecommunications, government, and research sectors. The actor scanned 1,386 Gitea instances across seven countries while maintaining a separate dataset of 477 Taiwan-based systems, suggesting prioritized collection against Taiwanese targets. Deployed JITTERLY C++ Linux implant with 30+ post-exploitation commands and SIXZUT LD_PRELOAD rootkit.

REF9334 (Brazilian Banking Malware)

Brazilian threat actor REF9334 operates KREMLIN banking malware toolkit targeting Brazilian financial institutions since May 2025. Uses lures impersonating Brazilian banks to install malicious browser extensions on Chrome and Edge, stealing credentials and session tokens. Leverages Ethereum smart contracts as dead drop resolvers for C2 infrastructure, providing resilience against takedown efforts. Also distributes commodity RATs including Pulsar and Remcos.

Black Axe Cybercrime Syndicate

Five alleged Black Axe leaders extradited from South Africa to the US in September 2026 to face wire fraud and money laundering charges spanning 2011-2021. The Nigerian-founded transnational syndicate, with an estimated 30,000 members globally, conducts romance scams, advance fee fraud, and business email compromise targeting elderly Americans. Operation Jackal IV (August 2026) resulted in 58 arrests and 263 identified suspects across 22 countries.

---

Geopolitical Context

Iran's Transnational Repression

The joint US-UK-Netherlands attribution of CHOSEN BRICK to Iran's Ministry of Intelligence and Security represents a coordinated Western response to Iranian digital surveillance operations. The advisory's explicit linkage between cyber collection and physical threat plotting (kidnapping, assassination) elevates the threat beyond information security to personal protection. The US DOJ seized four Iranian leak sites in March 2026 used to publish stolen victim data and incite violence, demonstrating operational integration between MOIS cyber collection and influence operations.

China's Civil Society Targeting

The simultaneous use of identical zero-day exploit chains by UTA0560 and APT31 on September 1, 2026, indicates either shared procurement from a common exploit developer or centralized distribution within China's cyber operations ecosystem. The targeting of NGOs aligns with long-standing Chinese intelligence priorities regarding organizations involved in human rights, democracy promotion, and policy advocacy. The exploitation of a narrow patch gap between Chromium source code fixes and stable Chrome releases demonstrates operational agility and close monitoring of open-source security updates.

Southeast Asian Telecommunications Compromise

The intrusion into 3BB, Thailand's largest broadband provider, represents a significant compromise of critical telecommunications infrastructure. The attacker's focus on RADIUS databases storing customer login credentials and potential lateral movement into Jasmine network infrastructure suggests the breach may have affected a broader segment of Thailand's telecommunications sector. No state-actor attribution has been established, though the operational sophistication is consistent with both APT operations and organized cybercrime.

---

Recommended Actions

Immediate (0-24 hours)

1. Cisco Secure Email Gateway: Upgrade AsyncOS to fixed versions (15.5.5-0141, 16.0.4-302, 16.5.0-780); run detection command on all devices.
2. VMware vCenter: Apply Broadcom patches from July 29, 2026; audit for unauthorized SSH access and reverse tunnels.
3. WordPress Admin Menu Editor Pro: Identify versions 2.35/2.36; search for backdoor indicators; restore from clean backups or manually remediate.
4. Vite Dev Servers: Update to 7.3.3+/8.0.5+; audit network configurations; rotate exposed cloud credentials.
5. WooCommerce Wholesale Lead Capture: Upgrade to version 2.0.3.2+; scan upload directories for PHP files; review admin accounts.

Within 24-72 hours

6. Iranian CHOSEN BRICK: Monitor Windows Registry Run keys for 'SMQDService'/'winappx' entries; inspect for directories with trailing spaces; monitor Telegram API connections.
7. Chrome Zero-Day Chain: Deploy endpoint detection for DLL side-loading; enable Chrome Enterprise rapid patching policies; hunt for GRIMWEDGE indicators.
8. LiteSpeed Enterprise: Update to version 6.3.7 using forced upgrade command; restore automatic stable updates; audit for privilege escalation attempts.
9. Check Point VPN: Apply vendor patches immediately; monitor for unusual authentication attempts and configuration changes.
10. IP Cameras: Audit for internet exposure; change default credentials; update firmware; segment camera networks from corporate networks.

This week

11. Alior Bank PrestaShop Module: Upgrade to versions 8.1.12 or 9.0.8; review backoffice access logs for suspicious SQL activity.
12. BambooToken Campaign: Hunt for DLL sideloading involving Tendyron OnKey software; monitor MQTT protocol connections to external destinations.
13. Telegram Desktop: Update to version 7.0.1 stable or 6.9.4 beta; re-export chats to HTML using patched version; delete legacy exports.
14. Marimo RCE: Identify and isolate Marimo notebook instances; audit AWS CloudTrail for unauthorized Secrets Manager API calls; rotate exposed credentials.
15. DDRop Hardware Attack: Audit physical access controls for data centers hosting Intel TDX/AMD SEV-SNP systems; monitor for anomalous memory behavior.

---

Watch List

  • Gitea RCE (CVE-2026-60004): Red Heron demonstrated rapid weaponization; additional compromises likely among unpatched instances, particularly in Taiwan and defense sectors.
  • SAP Extended Passport Processing: Critical memory corruption flaw patched; monitor for proof-of-concept code release and opportunistic exploitation.
  • Microsoft September Updates: Emergency out-of-band patches released for RDS failures; organizations should prioritize deployment to restore Remote Desktop Services functionality.
  • Revolut Data Breach: Fintech company disclosed breach exposing customer financial information and passport data via social engineering impersonating government agency.
  • Japan VPN Breach: 246,000 government personnel records exposed via VPN flaw; no attribution provided but consistent with state-sponsored reconnaissance patterns.

---

Sources

  • Cisco Security Advisory (CVE-2026-76461)
  • CISA Known Exploited Vulnerabilities Catalog
  • FBI, UK NCSC, Netherlands AIVD Joint Advisory (CHOSEN BRICK/HEAVYGRAM)
  • Volexity Threat Research (UTA0560, APT31)
  • Elastic Security Labs (REF9334/KREMLIN)
  • Acronis Threat Research Unit (Red Heron)
  • Wordfence Intelligence (WooCommerce, Admin Menu Editor Pro)
  • F5 Labs, Socket Security (Vite, Twitch extension)
  • CERT.BE, CERT.PL, NCSC UK advisories
  • BleepingComputer, The Hacker News reporting

---

Classification: TLP:CLEAR
Distribution: Approved for public release