# Threat Intel Brief — September 18, 2026

TL;DR

  • Critical zero-days under active exploitation: Cisco ISE authentication bypass (CVE-2026-76460), ConnectWise ScreenConnect file transfer flaw (CVE-2026-84869), and Issabel Framework hard-coded credential issue (CVE-2026-89026) demand immediate patching.
  • Supply-chain attacks escalate: Brevo compromise via stolen Cloudflare API key injected malware across customer sites; AI coding assistant hijack spread Shai-Hulud worm across 100+ repositories at unnamed SaaS provider.
  • China-aligned espionage intensifies in Latin America: FamousSparrow deploys SparroWocky backdoor against government entities in eight countries since August 2025.
  • Iranian surveillance targets dissidents globally: MOIS-linked Handala Hack persona uses HEAVYGRAM Telegram backdoor for credential theft and monitoring of journalists and activists.
  • Infrastructure vulnerabilities create systemic risk: Critical flaws in Unbound DNS (CVE-2026-81642), Check Point management servers (CVE-2026-91843), and WooCommerce plugins enable remote code execution.

---

Critical Threats

Cisco ISE Zero-Day Exploitation (CVE-2026-76460)

What happened: Cisco confirmed active exploitation of a maximum-severity authentication bypass vulnerability in Identity Services Engine (ISE) versions 3.1 through 3.5. Attackers can gain unauthorized administrative access to the web management interface via API endpoints without authentication. CISA added the flaw to its Known Exploited Vulnerabilities catalog with a three-day federal remediation deadline.

Impact: Organizations using Cisco ISE for network access control and Zero Trust architectures face critical risk. Successful exploitation grants root-level device compromise, enabling credential theft, lateral movement, and persistent backdoor installation. No workarounds exist—patching is mandatory.

Recommendations:

  • Upgrade immediately to fixed releases: ISE 3.1P12, 3.2P11, 3.3P12, 3.4P7, or 3.5P4
  • Search access.log files on all ISE nodes for suspicious or unknown usernames as compromise indicators
  • Review firewall logs for unusual external connections or data exfiltration patterns
  • If compromise suspected, re-image affected nodes and restore from known-good backups per Cisco guidance

---

Brevo Supply-Chain Attack via Stolen Cloudflare Credentials

What happened: Attackers compromised Brevo's Cloudflare API key (hardcoded in source code) and deployed a malicious Cloudflare Worker that injected ClickFix social engineering lures into Brevo websites and customer-embedded scripts. The attack window spanned 5.5 hours on September 14, 2026, affecting up to 100,000 customer sites. WordPress administrators visiting compromised pages had malicious plugins auto-installed, creating persistent backdoors.

Impact: High-severity supply-chain compromise affecting Brevo CRM platform and downstream customers. Visitors to affected sites received fake Cloudflare verification prompts executing malicious Windows commands. WordPress sites face persistent compromise via hardcoded admin session hijacking. Brevo's API and email delivery reportedly unaffected, but customer trust and regulatory compliance (GDPR, NIS2) face scrutiny.

Recommendations:

  • Audit WordPress sites for plugins installed September 14, 2026, especially "Web Media Optimizer"; remove immediately if found
  • Rotate all WordPress admin passwords on sites embedding Brevo forms, Conversations widget, or SDK loader scripts during attack window (16:07–20:30 UTC)
  • Review WAF/CDN logs for connections to malicious domains: cdn10.sendibt1[.]com, yelahaye[.]surf, boiseno[.]club, glegchner[.]com, corralos[.]beer
  • Scan endpoints of users who visited Brevo-hosted pages on September 14 for ClickFix malware execution artifacts
  • Audit for hardcoded API keys in source code; rotate immediately and implement secrets management solutions

---

Unbound DNS Resolver Critical RCE (CVE-2026-81642)

What happened: NLnet Labs disclosed a critical heap overflow in Unbound DNS resolver versions up to 1.26.0 affecting the DNSSEC validator. Remote code execution is possible when an attacker controls a malicious DNS zone and queries the vulnerable resolver. Denial of service is guaranteed; RCE depends on attacker-controlled data. Even July and August 2026 security releases remain vulnerable.

Impact: All Unbound deployments face remote exploitation risk regardless of configuration. Recursive DNS resolvers used for internal or public resolution are at immediate risk. NLnet Labs assigned CVSS 9.1 (Critical). No active exploitation reported, but public disclosure increases likelihood of weaponization.

Recommendations:

  • Upgrade to Unbound 1.26.1 immediately using official packages or Windows installers
  • If immediate upgrade impossible, apply CVE-2026-81642 patch to version 1.26.0 source tree and rebuild
  • Verify version with unbound -V command; confirm 1.26.1 or later
  • Monitor DNS resolver logs for unusual DNSKEY query patterns or crashes in DNSSEC validation code
  • Consider temporarily disabling DNSSEC validation if patching delayed beyond 24 hours (mitigation effectiveness unconfirmed by vendor)

---

ConnectWise ScreenConnect Active Exploitation (CVE-2026-84869)

What happened: CISA confirmed active exploitation of a critical vulnerability in ConnectWise ScreenConnect versions prior to 26.6.5. Attackers with basic privileges can transfer and execute files through active remote sessions without authorization or host confirmation. Over 1,000 unpatched instances remain exposed online, primarily in North America and Europe.

Impact: Critical risk for MSPs and organizations using ScreenConnect for remote access. Low attack complexity with no user interaction required. ScreenConnect has been repeatedly targeted by ransomware gangs and state-sponsored groups (including North Korean Kimsuky APT). Compromise enables lateral movement, data exfiltration, and ransomware deployment across managed client environments.

Recommendations:

  • Upgrade ConnectWise ScreenConnect to version 26.6.5 or later immediately on all instances
  • If immediate patching impossible, disable TransferFiles permissions as temporary mitigation per ConnectWise guidance
  • Audit ScreenConnect access logs for unauthorized file transfers or executions since September 7, 2026
  • Inventory all ScreenConnect instances (on-premises and cloud); verify patch status
  • Review and restrict user privilege levels to minimum necessary access

---

Issabel Framework Hard-Coded Credential Exploitation (CVE-2026-89026)

What happened: Shadowserver Foundation confirmed active exploitation since September 9, 2026, of a critical vulnerability in Issabel Framework (all versions prior to August 1, 2026 patch). Attackers forge JWT tokens using a hard-coded signing key identical across all installations to execute OS commands via the /pbxapi/manager/originate endpoint without authentication.

Impact: Unauthenticated remote attackers gain full control over PBX systems, enabling call interception, toll fraud, data exfiltration, lateral movement, and ransomware deployment. Organizations using Issabel for VoIP/unified communications face immediate compromise risk. CVSS 9.8 (v3.1) / 9.3 (v4.0).

Recommendations:

  • Apply August 1, 2026 patch immediately; replaces hard-coded JWT key with unique key in /etc/issabel.conf
  • Audit Issabel instances for compromise indicators: review Asterisk logs for unexpected originate commands, check for unauthorized accounts, inspect system logs for suspicious command execution since September 9
  • If patching impossible immediately, restrict /pbxapi/ endpoint access to trusted management IPs via firewall or web server ACLs
  • Rotate all credentials and API keys associated with Issabel and Asterisk systems after patching
  • Monitor outbound connections for C2 traffic; review call detail records for anomalous patterns or toll fraud

---

Threat Actor Activity

China-Aligned FamousSparrow Targets Latin American Governments

FamousSparrow, a China-aligned state-sponsored group active since 2019, has deployed the SparroWocky backdoor against government organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela since August 2025. ESET telemetry shows 90% of targets concentrated in Latin America. The group demonstrates strong knowledge of anti-analysis techniques and Windows internals, employing DLL sideloading chains, Mbed TLS for secure C2, MinHook for defense evasion, and COFF Loader for dynamic plugin execution. SparroWocky provides file execution, TCP proxying, command execution, reconnaissance, exfiltration, screenshot capture, and self-deletion capabilities. The sustained multi-country campaign suggests intelligence collection aligned with China's economic and diplomatic engagement in the region, particularly monitoring responses to U.S. pressure on Chinese interests.

Detection priorities: Monitor for DLL sideloading activity, MinHook usage, outbound TLS connections to suspicious infrastructure (IOC: 216.238.110[.]120), COFF object loading in memory, and periodic screenshot capture APIs.

---

Iranian MOIS-Linked Handala Hack Deploys HEAVYGRAM Surveillance Backdoor

The FBI attributes Handala Hack persona to Iranian Ministry of Intelligence and Security (MOIS) actors conducting surveillance against dissidents, journalists, and opposition groups globally. The campaign employs HEAVYGRAM (also tracked as CHOSEN BRICK by UK NCSC), a Python-based Telegram backdoor capable of remote command execution, screenshot/audio capture, credential theft from browsers and messaging apps, and data exfiltration. Initial access occurs via social engineering on Telegram, WhatsApp, and Instagram, delivering malware masquerading as legitimate applications. CRUDEEXCLUDE, a Delphi-based utility, configures Microsoft Defender exclusions and stages payloads. The FBI issued alerts in March and September 2026 warning of MOIS operations targeting Iranian dissidents, including a September 2023 hack-and-leak operation against Iran International journalists documented by Canada's Rapid Response Mechanism.

Detection priorities: Monitor for Microsoft Defender exclusion path modifications via PowerShell, suspicious PowerShell execution modifying Windows Registry autorun keys, Telegram API traffic from non-standard processes, masqueraded executables mimicking legitimate apps, and unauthorized access to browser credential stores.

---

Multiple Groups Target Russian Enterprises with Backdoors and Wipers

Three distinct threat clusters are actively targeting Russian enterprises. NightEagle (APT-Q-95), active since 2023, gains access via compromised VPN credentials through Cloudflare WARP tunnels and European VPS infrastructure, deploying GhostContainer backdoor to Exchange servers (likely exploiting CVE-2020-0688). The group conducts DCSync attacks, harvests password hashes, and uses long-lived Kerberos tickets for persistence. Hacking Cat, a pro-Ukrainian hacktivist entity operational since February 2024, exploits Exchange vulnerabilities (CVE-2021-26855, CVE-2026-42897) to deploy Gorilla RAT and Monkey ransomware variants (Rust, .NET, C++, Golang) targeting Windows, Linux, and VMware ESXi. Some Monkey variants function as wipers by not storing encryption keys. The group collaborates with Cyber Anarchy Squad and Ukrainian Cyber Alliance. Toy Ghouls represents a third cluster with limited operational details disclosed.

Detection priorities: Monitor VPN authentication from Cloudflare WARP and European VPS providers, deploy detection for CVE-2020-0688, CVE-2019-0708, CVE-2021-26855, and CVE-2026-42897 exploitation, detect DCSync attacks via Directory Service Access events (Event ID 4662), monitor for mass process termination and backup deletion, and detect ASP.NET VIEWSTATE manipulation.

---

Geopolitical Context

Latin America as Cyber Espionage Battleground: FamousSparrow's sustained targeting of eight Latin American governments reflects China's strategic intelligence priorities amid intensifying U.S.-China economic competition in the region. The deployment of sophisticated, modular backdoors indicates investment in long-term access to government networks where China has expanded infrastructure, lending, and trade relationships over two decades. The campaign underscores Latin America's position as contested terrain in great power competition, with cyber espionage serving as a tool for monitoring diplomatic and economic positioning.

Iranian Transnational Repression: MOIS-linked operations targeting Iranian dissidents, journalists, and opposition figures demonstrate Tehran's use of cyber capabilities for transnational repression. The FBI's repeated alerts and Canada's attribution of hack-and-leak operations highlight the extraterritorial reach of Iranian intelligence activities, raising concerns about press freedom and civil society safety across Europe, North America, and the Middle East. The emergence of Handala Hack following October 7, 2023 attacks signals Iran's intent to leverage cyber operations in support of broader regional narratives.

Russia-Ukraine Cyber Dimension: The convergence of espionage-focused APT activity (NightEagle) and ideologically motivated destructive operations (Hacking Cat) against Russian targets reflects the persistent cyber dimension of the Ukraine conflict. The evolution of pro-Ukrainian hacktivist groups from defacement to encryption and wiper deployment demonstrates increasing technical capability and destructive intent, with potential for reciprocal escalation.

---

Recommended Actions

Immediate (0-24 hours)

  • Patch critical zero-days: Cisco ISE (CVE-2026-76460), ConnectWise ScreenConnect (CVE-2026-84869), Issabel Framework (CVE-2026-89026), Unbound DNS (CVE-2026-81642), Check Point Management (CVE-2026-91843)
  • Supply-chain incident response: Audit WordPress sites for malicious plugins installed September 14, 2026; rotate credentials on sites embedding Brevo scripts
  • Google Pixel devices: Update to security patch level 2026-09-05 or later to remediate CVE-2026-58704 (limited targeted exploitation confirmed)
  • Windows 11 domain login issues: Disable Machine Identity Isolation and reset secure channel on affected 24H2/25H2/26H1 systems per Microsoft guidance
  • WooCommerce Wholesale Lead Capture: Disable or uninstall plugin version 2.0.3.1 and earlier; search for shell.php in uploads directory

Within 24-72 hours

  • AI coding assistant security: Audit IDE extension permissions; revoke direct access to secrets and OAuth tokens; implement cryptographic checksum validation for AI-recommended dependencies
  • Browser extension audits: Remove unnecessary extensions with declarativeNetRequest and web content modification permissions; update Chrome to 143.0.7499.192+ and Edge to 150.0.4078.48+ to remediate AI assistant hijack vulnerabilities (CVE-2026-0628, CVE-2026-55945)
  • KREMLIN malware hunt: Block execution of JavaScript files from email; monitor Chrome/Edge profile directories for unauthorized extension installations; hunt for scheduled tasks establishing persistence for Node.js executables
  • Parallels Desktop: Upgrade Apple silicon Macs to version 27.0.1; audit Intel-based Macs running vulnerable 26.x for exposure (CVE-2026-90894)

This week

  • DNS infrastructure: Upgrade BIND to 9.20.29 or 9.21.26 to address fourteen security flaws including critical DoH crash (CVE-2026-77692)
  • WNC T-Mobile 5G routers: Upgrade to firmware 1.1.0.651412 to remediate six vulnerabilities including unauthenticated RCE (CVE-2026-58146, CVE-2026-58147, CVE-2026-40854 through CVE-2026-40857)
  • Acronis cPanel/Plesk: Update Backup plugin to 1.9.3 HF3 (build 1.9.3.1021+) and Plesk extension to build 1.8.11.638+ to remediate CVE-2026-87886 privilege escalation under active exploitation
  • Docker Sandboxes: Update to version 0.42.0+ on macOS to remediate VM escape vulnerabilities (CVE-2026-77179, CVE-2026-79994)
  • RatHat Android malware: Deploy mobile threat defense solutions; enforce app installation restrictions to Google Play Store only

---

Watch List

  • N0va phishing campaigns: Monitor for OAuth consent grants and device code authentication flows; implement detection for URL pattern /api/verification/init?session=*&flow=*prompt_profile=
  • Shai-Hulud worm variants: Route dependency downloads through internal repositories with malware scanning; monitor for anomalous repository access patterns
  • FamousSparrow infrastructure: Block outbound connections to 216.238.110[.]120; hunt for DLL sideloading chains and COFF object loading
  • Handala Hack/HEAVYGRAM: Monitor Telegram API traffic from non-standard processes; detect Microsoft Defender exclusion modifications
  • NightEagle/Hacking Cat: Monitor VPN authentication from Cloudflare WARP; detect DCSync attacks and mass process termination patterns

---

Sources

  • BleepingComputer: Cisco ISE zero-day, ScreenConnect exploitation, Brevo supply-chain attack, Windows 11 domain login issues, KREMLIN malware, Iranian CHOSEN BRICK surveillance, Chinese SparroWocky espionage
  • The Hacker News: Check Point management flaw, Docker Sandboxes VM escape, Handala Hack HEAVYGRAM backdoor, Unbound DNS RCE, FamousSparrow Latin America campaign, BIND 9 vulnerabilities, Issabel Framework exploitation, Russian enterprise targeting, AI assistant hijacking, Shai-Hulud worm, Parallels Desktop privilege escalation, N0va phishing, Google Pixel modem exploitation, Acronis cPanel vulnerability, WooCommerce plugin exploitation
  • CERT Polska: WNC T-Mobile 5G router vulnerabilities
  • CISA Known Exploited Vulnerabilities Catalog: CVE-2026-76460, CVE-2026-84869, CVE-2026-58704

---

*This report synthesizes open-source intelligence from cybersecurity vendors, government agencies, and security research organizations. Organizations should validate findings against their specific environments and threat models.*