# Threat Intel Brief — September 19, 2026

TL;DR

  • Critical infrastructure under siege: Cisco ISE zero-day (CVE-2026-76460) actively exploited; Check Point management servers vulnerable to unauthenticated root RCE (CVE-2026-91843); Unbound DNS resolver patched for critical heap overflow (CVE-2026-81642).
  • Supply chain attacks escalate: Brevo CDN compromise delivered malware to 100,000+ customer sites; abandoned CDN domain re-registered, still serving thousands of sites; 13 malicious npm packages distributed DPRK-linked WeaselBiscuit stealer.
  • State-sponsored campaigns intensify: China-aligned FamousSparrow deploys SparroWocky backdoor across eight Latin American governments; Pakistan-linked APT36 targets India and Afghanistan with Rust-based implants; Iran's MOIS conducts surveillance via Telegram-based HEAVYGRAM backdoor.
  • AI and developer tools weaponized: Plugin4Shell vulnerability allows malicious code injection in AI coding agents; AWS AgentCore Harness defaults enable credential exfiltration; RatHat Android malware uses AI for automated device control.
  • Patch urgency: Four Linux kernel local root exploits now public; WordPress Click2Shell forces theme installation via crafted links; Microsoft Azure AI Foundry patched for CVSS 10.0 auth bypass (CVE-2026-85889).

Critical Threats

Cisco ISE Zero-Day Actively Exploited

What happened: Cisco disclosed CVE-2026-76460, a maximum-severity authentication bypass vulnerability in Identity Services Engine (ISE) and ISE Passive Identity Connector. Attackers are actively exploiting the flaw in the wild to gain unauthorized access to ISE management interfaces without credentials. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog with a three-day federal patching deadline.

Impact: ISE serves as a centralized policy enforcement platform for network access control and Zero Trust architectures. Successful exploitation grants attackers the ability to manipulate access policies, pivot to protected network segments, and establish persistence with root privileges. Attackers may delete logs to cover their tracks. The vulnerability affects all ISE versions 3.1, 3.2, 3.3, 3.4, and 3.5 regardless of configuration.

Recommendations: Apply Cisco patches immediately (ISE 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, or 3.5 Patch 4). Search access.log files on all ISE nodes for suspicious usernames. Review firewall logs for unusual downloads or uploads to external IP addresses from ISE infrastructure. If malicious activity is detected, re-image affected nodes and restore from known-good backups. No workarounds are available.

---

Check Point Management Server Unauthenticated RCE

What happened: Check Point released emergency LivePatch updates for CVE-2026-91843, a critical stack overflow in Security Management Server and Log Server login processes. The vulnerability allows unauthenticated remote code execution as root over the network. This is the fifth critical unauthenticated management flaw disclosed by Check Point since July 2026.

Impact: Attackers gaining root access to management servers control all Security Gateways (firewalls) and network security monitoring infrastructure. Compromise enables lateral movement, policy manipulation, and complete loss of network visibility. Censys identified 3,836 potentially exposed hosts worldwide. While no active exploitation has been reported, the vulnerability's low complexity and prior Check Point zero-day exploitation (CVE-2026-16232) elevate risk.

Recommendations: Deploy Check Point LivePatch immediately for all Security Management Server and Log Server instances, including standalone and Multi-Domain deployments. Verify installation using cplp list command even if automatic updates are enabled. Audit Trusted Clients configuration in SmartConsole to ensure access is restricted to specific known hosts, not "any IP address." Confirm management interfaces require VPN access and are not directly exposed to the internet. Monitor Audit and Admin login logs for "Administrator failed to log in: Username too long" alerts indicating exploitation attempts.

---

Brevo Supply Chain Attack via Stolen Cloudflare API Key

What happened: Attackers compromised Brevo's Cloudflare API key (hardcoded in source code, likely stolen in late August 2026) and deployed a malicious Cloudflare Worker to inject ClickFix social engineering scripts into Brevo websites and JavaScript files embedded on up to 100,000 customer sites. The attack ran for 5.5 hours on September 14, 2026 (16:07–20:30 UTC). WordPress sites with Brevo widgets were targeted for backdoor plugin installation if administrators were logged in during the exposure window.

Impact: Attackers bypassed integrity checks by rewriting responses at the CDN edge and removing Content-Security-Policy headers, leaving origin servers unmodified. WordPress administrators visiting affected sites while authenticated risked installation of a backdoor plugin with hardcoded authentication bypass, enabling persistent attacker access. Brevo's API, email delivery, and customer account data were reportedly unaffected. The incident demonstrates the systemic risk of hardcoded long-lived API credentials in CDN infrastructure.

Recommendations: WordPress administrators must immediately audit plugins installed or activated on September 14, 2026, especially hidden or must-use plugins; remove any suspicious entries including "Web Media Optimizer" or plugins contacting glegchner.com, corralos[.]beer, sendibt1[.]com, yelahaye[.]surf, or boiseno[.]club. Rotate all WordPress administrator passwords if sites embedded Brevo forms, Conversations widget, or SDK scripts and admins were logged in during the exposure window. Remove hardcoded API keys from source code, rotate all long-lived API tokens, enforce short-lived tokens with least-privilege scopes, and enable alerting for Worker/route/DNS record creation. Monitor WAF and CDN logs for unexpected Worker deployments or security header removal between late August and September 15, 2026.

---

Unbound DNS Resolver Critical Heap Overflow

What happened: NLnet Labs patched CVE-2026-81642, a critical heap overflow in Unbound DNS resolver versions up to 1.26.0. The vulnerability allows remote code execution when a vulnerable resolver queries an attacker-controlled malicious DNS zone. The flaw exists in the DNSSEC validator component and can be triggered via specially crafted DNSKEY records using compression pointers. Eight additional vulnerabilities were patched in the same release, including CVE-2026-82717 (high severity, heap corruption in CNAME synthesis).

Impact: Unbound is widely deployed in enterprise DNS infrastructure. The vulnerability requires no privileges or user interaction and carries a CVSS score of 9.1. Successful exploitation grants remote code execution on DNS resolvers, enabling attackers to intercept, redirect, or manipulate DNS queries for entire networks. The attack surface includes any Unbound instance that may query untrusted zones, making this a significant supply chain risk.

Recommendations: Upgrade all Unbound DNS resolver instances to version 1.26.1 immediately. If immediate upgrade is not possible, apply the minimal or complete patch for CVE-2026-81642 to version 1.26.0 using patch -p1 < patch_CVE-2026-81642_with.diff followed by make install. Inventory all Unbound deployments across the organization, including embedded instances in appliances or containerized environments. Monitor DNS query logs for unusual patterns or queries to suspicious zones, particularly DNSKEY requests with abnormal compression pointer usage. Validate that DNS resolvers are not directly exposed to untrusted networks.

---

Linux Kernel Local Root Exploits Now Public

What happened: Security researcher Asim Manizada released public proof-of-concept exploit code for four Linux kernel vulnerabilities enabling local privilege escalation to root: CVE-2026-80844 (DirtyAH6), CVE-2026-81000 (TUNderflow), CVE-2026-68121 (PPPoEject), and CVE-2026-74469 (DiagSpill). All four are memory-safety bugs in kernel networking code with underlying issues 10–21 years old. Kernel maintainers have already patched these flaws, but systems running older kernels remain vulnerable.

Impact: Multi-user Linux systems, shared hosting environments, and servers with untrusted local user access face immediate risk. Three of four exploits require unprivileged user namespaces (enabled by default on many distributions). Limited remote exploitation potential exists for DirtyAH6 and DiagSpill in narrow configurations (IPv6 routers with IPsec AH transport mode, or SCTP with non-default options). Theoretical container escape vectors exist but no working exploit has been published. Exploits are functional but tuned to specific kernel builds and may cause system crashes.

Recommendations: Update Linux kernel to patched versions: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, or 7.2.4 (or distribution-equivalent versions with all four CVE fixes). Verify distribution security advisories confirm inclusion of all four fixes before deploying updates. If immediate patching is not possible, disable unprivileged user namespaces via sysctl (kernel.unprivileged_userns_clone=0) to block three of four exploit paths. Blacklist or disable unused kernel modules: sctp, sctp_diag, pppoe, and ipv6 AH if not required. Prioritize patching on multi-user systems, shared hosting platforms, container hosts, and any system with untrusted local user access.

Threat Actor Activity

China-Aligned FamousSparrow Targets Latin America

FamousSparrow, a China-linked APT group active since at least 2019, has deployed the SparroWocky backdoor against government organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela since August 2025. ESET researchers assess the campaign aims to collect intelligence on Latin American governments' responses to U.S. pressure on Chinese economic interests. The modular C++ backdoor features advanced evasion techniques including call stack spoofing, thread origin spoofing, and MinHook library hooking to disguise thread start addresses as legitimate Windows functions. SparroWocky provides comprehensive capabilities including command execution, Beacon Object File loading, screenshot capture, and TCP proxy functionality. The group employs DLL side-loading for initial execution and establishes persistence via Windows services or registry keys. C2 communication occurs over ports 443 or 8080, both directly and through HTTP/SOCKS5 proxies. The campaign has been ongoing for over a year, indicating sustained operational tempo aligned with Chinese state interests in monitoring regional diplomatic and policy developments.

Pakistan-Linked APT36 Deploys Rust Backdoors

Transparent Tribe (APT36, Earth Karkaddan), a Pakistan-aligned threat group, has deployed new Rust-based backdoors RUSTYSHADE and RUSTYMOVE targeting government and defense entities in India and Afghanistan since mid-2025. The campaign utilizes private GitHub repositories for command and control communications, representing a tactical evolution from the group's previous SparrowDoor implant. RUSTYSHADE features encrypted bidirectional communication via GitHub REST API, while RUSTYMOVE enables USB-based lateral movement through removable media propagation. The group employs spearphishing with malicious attachments, typosquatted domains impersonating Indian news outlets (theprints[.]org, indiatodays[.]org), and Visual Basic scripting for execution. C2 commands were issued only between 04:00–11:00 UTC on weekdays during August 20 to September 1, 2026, suggesting operators working within Pakistan Standard Time business hours. The targeting pattern reflects Pakistan's ongoing intelligence requirements regarding Indian defense posture and Afghan political developments.

Iran's MOIS Conducts Surveillance via HEAVYGRAM

The Iran-linked hacktivist persona Handala Hack, attributed to VOID MANTICORE (affiliated with Iran's Ministry of Intelligence and Security), has deployed HEAVYGRAM, a Python-based Telegram backdoor, and CRUDEEXCLUDE, a Delphi-based utility, targeting Iranian dissidents, journalists opposed to the regime, and opposition groups. HEAVYGRAM uses Telegram for C2 and supports remote command execution via PowerShell and WMI, screenshot capture, audio recording, data exfiltration, Telegram/WhatsApp session theft, password theft, and persistence via Windows autorun registry keys. CRUDEEXCLUDE configures Microsoft Defender exclusion paths to prepare environments for subsequent stage deployment. The FBI issued alerts in March 2026 and September 2026 formally accusing Iranian cyber actors of conducting these operations. In September 2024, the Canadian RRM documented the targeting and doxxing of five Iran International journalists as part of a hack-and-leak operation. The campaign demonstrates Iran's continued investment in surveillance capabilities leveraging commercial platforms for command-and-control.

DPRK-Linked WeaselBiscuit Stealer via npm

Researchers discovered 13 malicious npm packages delivering WeaselBiscuit, a previously undocumented JavaScript stealer designed to harvest Chrome extension storage. The malware exhibits functional overlaps with BeaverTail and other malware families associated with the DPRK's Contagious Interview campaign. WeaselBiscuit targets Chrome extension storage on Windows, macOS, and Linux, with particular focus on cryptocurrency wallet extensions. The malware pulls payloads from Npoint dead drop resolvers and communicates with C2 at 103.170.217[.]184:8787. Packages were published under the @biz44 namespace and standalone names including engin1, id79-client, process-lhpm, process-mite, and process-tailwind. The campaign targets software developers, IT professionals, and cryptocurrency users, executing in-memory upon package import to bypass file-based detection. While researchers identified "meaningful overlap" with DPRK tradecraft, no definitive attribution evidence exists in terms of operator infrastructure or code-signing material.

Geopolitical Context

Latin America as contested cyber terrain: FamousSparrow's systematic targeting of eight Latin American governments underscores the region's position in U.S.-China strategic competition. The campaign's focus on intelligence collection regarding responses to U.S. pressure on Chinese economic interests suggests Beijing views the entire region as strategically significant. The breadth of targeting may complicate U.S. efforts to build regional consensus on China policy, as compromised government communications could enable Beijing to anticipate and counter diplomatic initiatives.

South Asian cyber espionage normalization: APT36's sustained operations against India and Afghanistan reflect the persistent cyber dimension of South Asian geopolitical tensions. The inclusion of Afghan targets aligns with Pakistan's enduring interest in Afghan political developments following the 2021 Taliban takeover. The operational tempo and tool sophistication suggest state-resourced cyber espionage aimed at strategic intelligence collection on defense posture, policy deliberations, and cross-border security matters.

Iranian transnational repression: The HEAVYGRAM campaign demonstrates Iran's use of cyber operations to advance intelligence collection and influence objectives against dissidents and opposition media globally. The FBI's formal attribution to MOIS and documented targeting of Iran International journalists signal Western concern over Iran's expanding cyber surveillance capabilities and willingness to conduct extraterritorial operations against perceived threats to the regime.

Recommended Actions

Immediate (0–24 hours)

  • Cisco ISE: Apply emergency patches to all ISE instances; search logs for suspicious usernames; review firewall logs for anomalous data transfers.
  • Check Point: Deploy LivePatch to all Security Management and Log Servers; verify installation; audit Trusted Clients configuration.
  • Brevo compromise: WordPress admins audit plugins installed September 14, 2026; remove suspicious entries; rotate admin passwords if sites embedded Brevo scripts.
  • Unbound DNS: Upgrade all instances to 1.26.1 or apply emergency patch; inventory all deployments including embedded instances.
  • Linux kernel: Update to patched versions or disable unprivileged user namespaces; prioritize multi-user systems and container hosts.
  • npm supply chain: Audit dependencies for @biz44 packages and named malicious packages; block C2 infrastructure 103.170.217[.]184:8787.
  • AWS AgentCore: Scope allowedTools parameter to exclude shell and file_operations; implement egress filtering on harness containers.

Within 24–72 hours

  • CDN security: Audit third-party script tags and CDN references; deploy Content-Security-Policy-Report-Only header; implement Subresource Integrity hashes.
  • Docker Sandboxes: Update to version 0.42.0+ on macOS; enable clone mode if patching delayed; audit for versions 0.28.0–0.41.9.
  • BIND 9: Upgrade to 9.20.29 or 9.21.26; prioritize DoH-enabled servers; migrate EOL 9.18 branch to 9.20.
  • WordPress: Update to 7.1.1; verify automatic updates enabled; review installed themes for unexpected additions.
  • AI coding agents: Update Anthropic Claude Code to 2.1.179+, OpenAI Codex to 0.146.0+; restrict GitHub Copilot plugins to GitHub-hosted repositories only.

This week

  • APT36 indicators: Monitor for DLL side-loading, GitHub API traffic from non-development endpoints, USB device connections executing LNK files.
  • FamousSparrow detection: Hunt for PowerShell execution with file enumeration targeting Office documents; correlate with outbound GitHub traffic.
  • HEAVYGRAM monitoring: Detect Microsoft Defender exclusion path modifications; alert on Telegram API traffic from non-browser processes.
  • RatHat Android: Deploy mobile threat defense solutions; review MDM telemetry for anomalous accessibility service usage.
  • Plugin4Shell: Disable auto-update for non-GitHub marketplace plugins; audit currently installed plugins from Bitbucket or private Git servers.

Watch List

  • Gyazo breach: Image-sharing platform suffered data breach exposing 23.6 million user records via unpatched server vulnerability. Monitor for credential stuffing attacks using leaked data.
  • Rapuncel infostealer: SEO-poisoned fake GitHub repositories impersonating LastPass Authenticator distribute previously undocumented infostealer. Alert users to verify software downloads from official vendor sites only.
  • PhantomRaven npm stealer: LLM-generated JavaScript stealer distributed via 100+ npm packages targeting CI/CD secrets and GitHub credentials. Rotate authentication tokens following new package installations.
  • Windows 11 domain login issue: September 2026 updates break domain authentication on 24H2/25H2/26H1 via Machine Identity Isolation enforcement. Disable feature if not running Windows Server 2025 domain controllers.
  • Azure AI Foundry: Microsoft patched CVE-2026-85889 (CVSS 10.0) auth bypass; no customer action required. Verify instances running current versions via Azure Portal.

Sources

  • BleepingComputer: Gyazo server flaw, Fake LastPass repos, Check Point flaw, Chinese hackers SparroWocky, Windows domain login, Cisco ISE zero-day, Brevo supply-chain attack, RatHat Android malware
  • The Hacker News: Linux kernel exploits, WordPress Click2Shell, Transparent Tribe Rust backdoor, Azure AI Foundry patch, Abandoned CDN domain, Plugin4Shell, WeaselBiscuit npm packages, PhantomRaven stealer, Check Point management flaw, Docker Sandboxes flaw, Handala Hack HEAVYGRAM, Unbound DNS flaw, FamousSparrow SparroWocky, BIND 9 update
  • Unit 42 (Palo Alto Networks): AWS AgentCore Harness credential exfiltration vulnerability

---

*This report synthesizes open-source threat intelligence for defensive planning. Organizations should correlate findings with internal telemetry and threat models. All CVE identifiers verified against authorized disclosure sources.*