# Threat Intel Brief — September 17, 2026

TL;DR

  • Critical zero-days exploited: Cisco Secure Email Gateway (CVE-2026-76461), Issabel Framework (CVE-2026-89026), and ConnectWise ScreenConnect under active attack; immediate patching required.
  • Iranian transnational repression: CHOSEN BRICK malware controlled via Telegram targets dissidents, activists, and journalists globally; joint US-UK-Netherlands advisory issued.
  • Supply chain compromises: Admin Menu Editor Pro WordPress plugin backdoored 1,500 sites; Shai-Hulud worm spread via hijacked AI coding assistant across 100 repositories.
  • Ransomware escalation: VMware vCenter CVE-2026-59310 now exploited by ransomware gangs after initial APT reconnaissance; CISA mandates federal patching.
  • Chinese APT activity: UTA0560 deployed GRIMWEDGE backdoor against NGOs using Chrome-Windows zero-day chain; shared exploit infrastructure with APT31.

---

Critical Threats

Cisco Secure Email Gateway Zero-Day (CVE-2026-76461)

What happened: Cisco disclosed active exploitation of a critical SQL injection vulnerability (CVSS 9.8) in AsyncOS Software for Secure Email Gateway. Unauthenticated remote attackers can execute arbitrary commands with root privileges by sending crafted emails containing malicious SQL statements. CISA added the flaw to its Known Exploited Vulnerabilities catalog on September 15, 2026, with a three-day federal patching deadline.

Impact: Full system compromise is possible. Attackers may delete forensic evidence from logs, exfiltrate email traffic, and pivot to internal networks. Over 400 internet-exposed instances remain vulnerable. This is the second actively exploited AsyncOS zero-day in 2026, following CVE-2025-20393.

Recommendations:

  • Apply Cisco patches immediately to all Secure Email Gateway appliances.
  • Review mail_logs on each cluster device for suspicious SQL statements as indicators of compromise.
  • Cross-reference network and firewall logs for unusual uploads/downloads to external IP addresses, especially if mail logs appear clean.
  • Isolate or restrict internet exposure of SEG appliances until patching is complete.

---

Issabel Framework Hard-Coded Credential Exploit (CVE-2026-89026)

What happened: A critical vulnerability (CVSS 9.8) in Issabel Framework—a web-based unified communications PBX platform—is under active exploitation since September 9, 2026. Attackers forge JWT tokens using a hard-coded signing key identical across all installations to execute OS commands as the Asterisk user via the /pbxapi/manager/originate endpoint.

Impact: Unauthenticated remote code execution grants full control over PBX operations, enabling call interception, toll fraud, data exfiltration, and lateral movement. Organizations using Issabel for VoIP face immediate compromise risk.

Recommendations:

  • Update Issabel Framework to the version released on or after August 1, 2026, which replaces the hard-coded JWT key with a unique key in /etc/issabel.conf.
  • Audit logs for unauthorized access to /pbxapi/manager/originate or unexpected Asterisk System application calls since early September.
  • Restrict network access to the Issabel web interface to trusted IP ranges or place behind VPN if patching is delayed.
  • Monitor for anomalous outbound connections from the Asterisk user account.

---

ConnectWise ScreenConnect Active Exploitation (CVE-2026-84869)

What happened: CISA flagged CVE-2026-84869, a critical vulnerability in ConnectWise ScreenConnect versions prior to 26.6.5, as actively exploited on September 13, 2026. Attackers with basic privileges can transfer and execute files through active remote sessions without authorization. Over 1,000 unpatched instances remain exposed online.

Impact: Low attack complexity with no user interaction required. Compromised ScreenConnect servers enable lateral movement, data exfiltration, and ransomware deployment across managed client environments. MSPs and IT teams using ScreenConnect face elevated risk.

Recommendations:

  • Upgrade ConnectWise ScreenConnect to version 26.6.5 or later immediately.
  • If immediate patching is not possible, disable TransferFiles permissions as temporary mitigation per ConnectWise guidance.
  • Audit ScreenConnect access logs for unauthorized file transfers or executions during active sessions since early September 2026.
  • Monitor network traffic to ScreenConnect servers for anomalous file transfer activity.

---

WooCommerce Wholesale Lead Capture PHP Backdoor Campaign (CVE-2026-27540)

What happened: Threat actors are actively exploiting a critical unauthenticated arbitrary file upload vulnerability (CVSS 9.8) in WooCommerce Wholesale Lead Capture plugin for WordPress. Wordfence has blocked over 100,000 exploitation attempts since June 2026, with attackers uploading PHP web shells for remote code execution.

Impact: Complete site compromise. Attackers exploit the wwlc_file_upload_handler AJAX action to bypass file extension allowlists and deploy executable PHP files, enabling reconnaissance, persistent backdoor access, and additional payload delivery. Approximately 6,000+ active installations are affected.

Recommendations:

  • Immediately upgrade WooCommerce Wholesale Lead Capture plugin to version 2.0.3.2 or later.
  • Search upload directories (wp-content/uploads) for unexpected PHP files, especially shell.php or recently created executables.
  • Review web server logs for POST requests to /wp-admin/admin-ajax.php with action=wwlc_file_upload_handler parameter.
  • Audit WordPress administrator accounts for unknown or unauthorized users; remove suspicious accounts.
  • If compromise confirmed, restore site from clean backup taken before February 2026.

---

LiteSpeed Web Server Enterprise Privilege Escalation

What happened: cPanel disclosed a critical vulnerability in LiteSpeed Web Server Enterprise versions before 6.3.7 on shared hosting environments. A low-privilege tenant account can escalate to root, compromising all hosted sites and server infrastructure. No CVE assigned; no workaround provided. This is the third LiteSpeed root escalation flaw since May 2026.

Impact: Shared hosting providers face critical risk. No indicators of compromise published. Auto-update delayed; manual intervention required. Pattern of LiteSpeed root escalation flaws in 2026 increases likelihood of attacker interest.

Recommendations:

  • Update LiteSpeed Web Server Enterprise to version 6.3.7 immediately using: /usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7
  • After forced update, restore automatic stable updates: touch /usr/local/lsws/autoupdate/follow_stable
  • Review server logs for anomalous privilege escalation attempts or unauthorized file access outside CageFS boundaries since early September.
  • Audit all shared hosting accounts for unexpected administrative actions, new SSH keys, or altered system binaries.

---

Threat Actor Activity

Iranian State Surveillance: CHOSEN BRICK Malware

The FBI, UK NCSC, and Netherlands AIVD issued a joint advisory attributing CHOSEN BRICK (also known as HEAVYGRAM) malware to Iran's Ministry of Intelligence and Security (MOIS). Active since autumn 2023, the campaign targets Iranian dissidents, activists, and journalists globally through social engineering via WhatsApp and Telegram. Attackers impersonate trusted contacts or tech support, delivering malicious files disguised as legitimate applications (Pictory, KeePass, Telegram, Norton, Adobe Flash, MRI scans).

The malware establishes persistence through Windows Registry Run keys, evades detection by adding Microsoft Defender exclusions, and uses Telegram bots for command-and-control. Collection capabilities include screen capture, audio recording via microphone, credential harvesting from browsers, and exfiltration of Telegram/WhatsApp data. Stolen data has appeared on pro-Iranian leak sites with calls for violence against victims, escalating physical risk.

Defensive priorities:

  • Monitor Windows Registry Run keys for suspicious entries named 'SMQDService' or 'winappx'.
  • Implement network monitoring for unexpected connections to api.telegram.org, vultrobjects.com, storjshare.io, backblazeb2.com, iproyal.com, and lightningproxies.net.
  • Deploy phishing-resistant multi-factor authentication and application allowlisting to prevent execution of social engineering payloads.
  • Enable and monitor Microsoft Defender exclusion changes via event logs to detect defense evasion attempts.

---

Chinese APT Operations: UTA0560 and APT31

Chinese-linked threat actor UTA0560 conducted a spear-phishing campaign on September 1, 2026, exploiting a zero-day chain (CVE-2026-85046, CVE-2026-87491, CVE-2026-85880) in Google Chrome and Microsoft Windows to deliver the GRIMWEDGE JavaScript backdoor against multiple NGOs. A second Chinese actor, JungleBamboo (APT31), deployed the same exploit chain during the same timeframe to deliver different malware. The near-simultaneous use of identical exploit chains suggests shared access to a common exploit developer or procurement from a domestic offensive cyber marketplace.

The attack exploited an unusual "patch gap" where fixes were committed to the open-source Chromium codebase but not yet incorporated into stable Chrome releases, creating N-day vulnerabilities that functioned as zero-days.

Defensive priorities:

  • Monitor for reflective XSS exploitation attempts on public-facing web applications.
  • Deploy endpoint detection rules for DLL side-loading patterns, specifically monitoring for legitimate Windows binaries loading unexpected DLLs from non-standard paths.
  • Implement browser isolation technologies and ensure rapid patching of Chrome/Chromium within 48-72 hours of stable release.
  • Monitor for Chrome extension installations with suspicious permissions and audit extensions against known malicious IDs.

---

Brazilian Banking Malware: REF9334 / KREMLIN

Elastic Security Labs identified KREMLIN, a Brazilian banking malware toolkit tracked as REF9334, active since May 2025. The actor uses social engineering lures impersonating Brazilian banks to install malicious Chrome and Edge extensions that steal credentials, session tokens, cookies, and sensitive data. The malware bypasses browser integrity mechanisms using Phantom Extension and GhostChrome-X techniques, and obfuscates C2 infrastructure using Ethereum smart contracts as dead drop resolvers.

Defensive priorities:

  • Monitor for suspicious scheduled task creation targeting browser directories or persistence mechanisms.
  • Detect DLL side-loading attempts against legitimate security software binaries like SentinelOne components.
  • Implement behavioral detection for modifications to Chromium Secure Preferences files and unexpected changes to browser extension manifests.
  • Block or alert on WebSocket connections from browser processes to non-standard domains.
  • Deploy network monitoring to detect Ethereum smart contract queries from endpoint systems.

---

Russian Enterprise Targeting: NightEagle, Hacking Cat, Toy Ghouls

Kaspersky identified three threat groups targeting Russian enterprises with backdoors, ransomware, and wipers. NightEagle (APT-Q-95), active since 2023, employs sophisticated persistence and lateral movement techniques via compromised VPN credentials, exploits CVE-2019-0708 (BlueKeep) for privilege escalation, and conducts DCSync attacks to impersonate domain controllers. Hacking Cat, a pro-Ukrainian hacktivist entity active since February 2024, exploits Exchange vulnerabilities (CVE-2021-26855, CVE-2026-42897) to deploy Gorilla RAT and Monkey ransomware variants targeting Windows, Linux, and VMware ESXi.

Defensive priorities:

  • Monitor VPN authentication logs for connections originating from Cloudflare WARP IP ranges and European VPS providers.
  • Deploy detection rules for VIEWSTATE parameter manipulation in Exchange server logs.
  • Detect DCSync attacks by monitoring for Directory Replication Service Remote Protocol requests from non-domain controller systems using Windows Event ID 4662.
  • Identify lateral movement via rdp2tcp and Microsoft dev tunnels by monitoring for unusual RDP traffic redirection.

---

Geopolitical Context

Iranian Transnational Repression

The joint US-UK-Netherlands advisory on CHOSEN BRICK reflects coordinated Western response to Iranian state-sponsored transnational repression. The disclosure signals strategic effort to impose reputational costs on Tehran while providing defensive guidance to vulnerable populations. Iran's use of digital surveillance tools to monitor and intimidate perceived threats represents an extension of domestic repression into the cyber domain with global reach. The appearance of victim data on pro-Iranian leak sites underscores operational linkage between cyber espionage and potential physical threats.

China-Nexus NGO Targeting

The September 2026 campaign reflects sustained Chinese cyber espionage interest in civil society organizations. The deployment of sophisticated zero-day exploit chains demonstrates advanced technical capability and operational tempo. The near-simultaneous use of identical exploit infrastructure by two distinct China-nexus groups suggests possible coordination, shared access to a common exploit developer, or procurement from a domestic offensive cyber marketplace.

VMware Ransomware Escalation

CISA's rapid escalation of CVE-2026-59310 from KEV listing to ransomware flag underscores the vulnerability's strategic value. The initial wave of exploitation, attributed to a suspected APT actor across 47 countries, suggests intelligence collection or pre-positioning activity that has now been adopted by ransomware groups. The pattern mirrors previous incidents where zero-day or recently patched VMware vulnerabilities transitioned from targeted APT exploitation to broader ransomware campaigns.

---

Recommended Actions

Immediate (0-24 hours)

1. Patch critical zero-days: Cisco Secure Email Gateway (CVE-2026-76461), Issabel Framework (CVE-2026-89026), ConnectWise ScreenConnect (CVE-2026-84869), WooCommerce Wholesale Lead Capture (CVE-2026-27540), LiteSpeed Web Server Enterprise (6.3.7).
2. Hunt for compromise: Review logs for indicators of exploitation on Cisco SEG, Issabel, ScreenConnect, and WordPress sites since early September 2026.
3. Isolate vulnerable systems: Restrict internet exposure of unpatched Cisco SEG, Issabel, and ScreenConnect instances.
4. Audit WordPress sites: Search for unexpected PHP files in upload directories and review administrator accounts for unauthorized users.
5. Update Google Pixel devices: Apply security patch level 2026-09-05 or later to remediate CVE-2026-58704 (cellular modem privilege escalation under limited targeted exploitation).

High Priority (24-72 hours)

1. Patch Acronis backup plugins: Update Acronis Backup plugin for cPanel & WHM to version 1.9.3 HF3 (build 1.9.3.1021 or later) and Acronis Backup extension for Plesk to build 1.8.11.638 or later to address CVE-2026-87886 (actively exploited privilege escalation).
2. Remediate Admin Menu Editor Pro compromise: Check for versions 2.35 or 2.36; verify presence of includes/wp-user-consent.php file or /wp-content/object-cache/ directory; restore from clean backups dated before September 14, 2026.
3. Patch WNC T-Mobile 5G routers: Upgrade all WNC T-Mobile 5G Box IDU routers to firmware version 1.1.0.651412 or later to address six vulnerabilities (CVE-2026-40854 through CVE-2026-40857, CVE-2026-58146, CVE-2026-58147).
4. Update Chrome and Edge: Ensure Google Chrome is updated to version 143.0.7499.192 or later and Microsoft Edge to version 150.0.4078.48 or later to remediate CVE-2026-0628 and CVE-2026-55945 (AI assistant hijacking vulnerabilities).
5. Patch VMware vCenter: Apply patches for CVE-2026-59310 (critical RCE now exploited by ransomware gangs); treat as emergency priority.

This Week

1. Implement CHOSEN BRICK defenses: Monitor Windows Registry Run keys for suspicious entries; implement network monitoring for Telegram API, Vultr, Storj, Backblaze B2, IPRoyal, and LightningProxies connections; deploy phishing-resistant MFA.
2. Audit browser extensions: Review and restrict extensions requesting declarativeNetRequest and broad web page modification permissions; remove unnecessary or unverified extensions.
3. Validate AI-recommended dependencies: Implement cryptographic checksum verification and allowlist validation for all AI coding assistant recommendations before installation.
4. Patch Parallels Desktop: Upgrade Apple silicon Macs running Parallels Desktop to version 27.0.1 build 58670 or later to address CVE-2026-90894 (privilege escalation).
5. Review SAP systems: Apply SAP patches for critical memory corruption vulnerability in Extended Passport Processing (EPP).

---

Watch List

  • Marimo notebook RCE: CVE-2026-39987 (CVSS 9.3) exploited for 8-second pivot to SSH bastion; patch or isolate all Marimo instances.
  • Vite development servers: Mass-scanning campaign exploits CVE-2026-39364 (CVSS 8.2) to extract AWS credentials, Azure profiles, and Terraform state files from internet-exposed dev servers.
  • N0va phishing campaigns: Token theft operations targeting US and EU businesses via device code phishing; implement conditional access policies requiring phishing-resistant MFA.
  • BambooToken malware: Multi-platform campaign using MQTT protocol to control Windows and Linux systems; targets organizations across Asia and South America since February 2023.
  • Windows 11 KB5124008: Microsoft investigating reports that security update is breaking domain trust relationships on some enterprise systems.

---

Sources

  • BleepingComputer: Windows 11, Iranian CHOSEN BRICK, KREMLIN malware, ScreenConnect, Acronis, Admin Menu Editor Pro, CenterPoint Energy, WooCommerce, VMware vCenter, Black Axe, Cisco SEG
  • The Hacker News: Issabel Framework, Russian enterprise targeting, AI assistant hijacking, Shai-Hulud worm, Parallels Desktop, N0va phishing, Google Pixel modem, Acronis cPanel, WooCommerce, KREMLIN malware, Iranian Telegram malware, BambooToken, Marimo RCE, Vite scanning, LiteSpeed Enterprise, Cisco SEG, China-linked Chrome-Windows zero-days
  • CERT.PL: WNC T-Mobile 5G router vulnerabilities
  • CERT.BE: SAP EPP memory corruption, Cisco SEG SQL injection
  • NCSC UK: Iranian cyber targeting of dissidents, CHOSEN BRICK spyware

---

Classification: TLP:CLEAR
Distribution: Approved for public release
Next Update: September 24, 2026