# Threat Intel Brief — September 23, 2026

TL;DR

  • Check Point zero-day (CVE-2026-93616) actively exploited since July 23; unauthenticated RCE on Security Management Servers demands immediate patching.
  • VeloCloud Orchestrator CVSS 10.0 flaw (CVE-2026-93952) under active exploitation; remote attackers can compromise on-premises SD-WAN infrastructure without credentials.
  • Three Linux kernel vulnerabilities added to CISA KEV catalog; CISA orders federal agencies to patch by end of day and conduct forensic triage.
  • EvilTokens PhaaS platform disrupted after compromising 12,000 Microsoft accounts via device-code phishing; two arrests in UK, but threat persists.
  • North Korean Contagious Interview campaign steals $10.71M in cryptocurrency from 7,000+ wallets across 100+ countries, targeting developers and Web3 specialists.

---

Critical Threats

Check Point Management Server Zero-Day (CVE-2026-93616)

What happened:
Check Point disclosed a path traversal vulnerability in its Security Management Server that allows unauthenticated attackers to upload and execute arbitrary scripts via the web service. The flaw was exploited in targeted attacks beginning July 23, 2026—60 days before the vendor released patches on September 22. Affected versions include R82.20 (no Jumbo Hotfix), R82.10 (Take ≤44), R82 (Take ≤126), R81.20 (Take ≤166), R81.10 (Take ≤190), and all end-of-support R81/R80.x releases.

Impact:
Management Servers control firewall policies for all managed Check Point gateways across enterprise networks. Successful exploitation grants attackers network-wide policy manipulation, credential theft, and persistent access. CISA and FBI have previously flagged path traversal flaws as "unforgivable" since 2007, underscoring the severity of this class of vulnerability in security infrastructure.

Recommendations:

  • Apply R82.20 Security Hotfix immediately to all affected Management Servers per Check Point advisory sk182336.
  • Hunt for compromise using vendor-provided IOCs, focusing on web service logs and unexpected script uploads between July 23 and September 22.
  • Review firewall policy changes and administrative actions during the exploitation window for unauthorized modifications.
  • Restrict management server web services to trusted administrative networks only if not already implemented.

---

VeloCloud Orchestrator CVSS 10.0 Flaw (CVE-2026-93952)

What happened:
Arista confirmed active exploitation of a maximum-severity vulnerability in on-premises VeloCloud Orchestrator deployments using certificate-based Edge authentication. Remote attackers without login credentials can escalate privileges and fully compromise the VCO host. Affected versions include 5.2.3.15 and earlier, 6.1.3.7 and earlier, 6.4.2.7 and earlier, and 7.0.0.2 and earlier. Fixes are available for 5.2 (5.2.3.16+) and 6.4 (6.4.2.8+) trains; patches for 6.1 and 7.0 are pending.

Impact:
Compromised orchestrators provide access to all managed Edge devices in the SD-WAN deployment, enabling attackers to manipulate traffic flows, conduct reconnaissance, and establish persistence across WAN segments. This is the second actively exploited VCO flaw in three months, following CVE-2026-16812 in July.

Recommendations:

  • Upgrade immediately to 5.2.3.16+ or 6.4.2.8+; contact Arista TAC for 6.1 and 7.0 guidance.
  • Restrict VCO web interface access to trusted administrative networks via firewall rules.
  • Hunt for indicators: files /usr/local/sbin/.vcnode.js, /usr/local/sbin/vc-sysmond (MD5: dc78e206eaeadec59fc5801fe4556bd0), /etc/systemd/system/vc-sysmon.service; search nginx logs for x-vc-opt header; block IPs 142.93.149.77 and 104.248.126.159.
  • If compromise suspected, preserve logs and filesystem timestamps before remediation; rotate credentials and inspect Edge device states.

---

Linux Kernel Vulnerabilities Under Active Exploitation

What happened:
CISA added three Linux kernel flaws to its Known Exploited Vulnerabilities catalog, ordering federal agencies to patch by end of day and conduct forensic triage. The vulnerabilities include CVE-2025-39964 (critical 14-year-old race condition in AF_ALG cryptographic socket interface), CVE-2026-53266 (out-of-bounds write in ebtables SNAT), and CVE-2025-39682 (TLS receive-path logic flaw with kTLS). Public exploits are available for two of the three flaws; CVE-2025-39964 has been demonstrated with privilege escalation and container escape in Google kernelCTF.

Impact:
These vulnerabilities enable privilege escalation, container escape, system crashes, and cryptographic result manipulation. Organizations running Linux servers, containers, or cloud infrastructure face immediate risk of compromise. The 14-year latency of CVE-2025-39964 raises concerns about potential long-term covert exploitation.

Recommendations:

  • Apply vendor-provided kernel security updates immediately across all Linux distributions (RHEL, Ubuntu, Debian, SUSE).
  • Conduct forensic triage on all Linux systems to detect signs of prior exploitation—review kernel logs, audit logs, and process execution history.
  • Prioritize patching internet-facing Linux servers, container hosts, and systems running kTLS or using AF_ALG cryptographic interfaces.
  • If immediate patching is not feasible, isolate vulnerable systems from untrusted networks and restrict access to privileged accounts.

---

D-Link DIR-822A Zero-Day (CVE-2026-86296)

What happened:
D-Link warned of a maximum-severity zero-day vulnerability affecting legacy DIR-822A dual-band Wi-Fi routers. The flaw (CVE-2026-86296) resides in the udhcpcd DHCP server component and allows unauthenticated remote code execution. Public proof-of-concept exploit code is available. No patch is currently available, and D-Link is still investigating.

Impact:
Attackers on the same local network can crash DHCP services or execute arbitrary code remotely. DIR-822A is a legacy product, increasing the likelihood it will remain unpatched. Organizations using these routers face immediate risk of device compromise, potential botnet enrollment, and lateral movement within internal networks.

Recommendations:

  • Immediately isolate or disconnect DIR-822A routers from production networks until patches are available or devices can be replaced.
  • Disable remote management interfaces and WAN-side administration.
  • Restrict administrative access using firewall rules or network ACLs to trusted IP addresses only.
  • Plan replacement with supported, actively maintained hardware.

---

WordPress Core Path Traversal (CVE-2026-87902)

What happened:
WordPress released a critical security patch on September 22 addressing a path traversal flaw that allows unauthenticated attackers to load arbitrary local PHP files via template selection logic. On servers meeting specific conditions—active theme with page-* top-level folder AND exploitable PHP files or register_argc_argv enabled—attackers can achieve remote code execution with web-server account privileges. The flaw affects WordPress core versions 4.7.0 through 7.1.1. Fixes are available in 7.1.2 and backported versions down to 4.7.37.

Impact:
Unauthenticated remote code execution (CVSS 9.2) with no user interaction required. Successful exploitation enables file modification/deletion, access to wp-config.php (database credentials, auth secrets), user data theft, rogue admin account creation, and malicious script injection. Proof-of-concept code is publicly available.

Recommendations:

  • Update all WordPress installations immediately to 7.1.2 or appropriate backported version.
  • Verify automatic background updates completed successfully via WordPress dashboard.
  • Audit active themes for top-level directories starting with page- to assess exploitation risk.
  • For servers that cannot patch immediately, disable register_argc_argv for web requests in PHP configuration and remove unused PEAR components.

---

Threat Actor Activity

EvilTokens PhaaS Platform Disrupted

Microsoft's Digital Crimes Unit, in coordination with U.S. courts and international partners, disrupted the EvilTokens device-code phishing service after it compromised approximately 12,000 Microsoft accounts across 10,000+ organizations. The platform, tracked as Storm-2992, leveraged AI throughout its attack chain to analyze compromised mailboxes, identify high-value targets, and generate contextually relevant business email compromise (BEC) messages. Two individuals (aged 32 and 38) were arrested by UK Metropolitan Police on September 11. The platform generated approximately $1.1 million in revenue between October 2025 and June 2026. While infrastructure has been disrupted, the threat persists—affiliates have already created clones such as APToken.

Defensive actions:

  • Disable device-code authentication (OAuth 2.0 device-authorization flow) for Microsoft 365 environments where not required for legitimate business purposes.
  • Implement phishing-resistant authentication methods such as FIDO2 security keys or passkeys.
  • Monitor for anomalous Microsoft Graph API activity, particularly queries mapping organizational relationships or bulk mailbox content access.
  • Deploy email security controls that detect multi-stage redirects and suspicious use of cloud platforms (Vercel, Cloudflare Workers, AWS Lambda) as intermediaries.

---

North Korean Contagious Interview Campaign

North Korean threat actors operating under the 313 General Bureau compromised at least 30,000 devices across more than 100 countries, stealing $10.71M in cryptocurrency from over 7,000 wallets. The campaign, tracked under multiple names including WaterPlum, DeceptiveDevelopment, and Famous Chollima, targets web designers, software developers, engineers, and cryptocurrency specialists via social engineering on LinkedIn and other platforms. Actors pose as recruiters offering lucrative job opportunities, instructing targets to complete coding assessments that trigger multi-stage infection chains deploying malware families including BeaverTail, InvisibleFerret, FlexibleFerret, GolangGhost, and others. The operation leverages laptop farms in Japan, the U.S., and other countries for remote device management, using VPN services to obtain exit nodes in target countries.

Defensive actions:

  • Implement strict vetting procedures for unsolicited job offers and recruitment contacts, especially those requiring completion of coding tests involving file downloads or execution.
  • Monitor and restrict execution of suspicious files from coding assessment scenarios; deploy EDR solutions to identify multi-stage infection chains.
  • Enforce cryptocurrency wallet security controls including multi-factor authentication, hardware wallet usage, and network segmentation.
  • Strengthen identity verification and KYC processes during hiring to detect AI-generated identities and proxy arrangements.

---

Jade Sleet Targets Indian IT Provider

North Korean threat actor Jade Sleet (also tracked as PUKCHONG, Slow Pisces, TraderTraitor, UNC4899) compromised an India-based IT services provider through a DevOps engineer's Apple Silicon MacBook, deploying FLATROOF and ROOFDECK backdoors. The campaign continues Jade Sleet's established pattern of supply chain attacks, following their early 2025 compromise of Safe{Wallet}'s developer environment that resulted in the $1.5 billion Bybit theft. The actor uses social engineering via job interview lures targeting developers in DevOps, cryptocurrency, and fintech roles, creating weaponized GitHub repositories containing malicious Terraform dependency lock files.

Defensive actions:

  • Monitor execution of terraform init commands and validate Terraform lock file integrity by checking for suspicious registry domains.
  • Implement application allowlisting and behavioral monitoring for development tools launching unexpected child processes, particularly Rust-based binaries on macOS systems.
  • Detect outbound connections to Telegram API endpoints and Nostr protocol relays from developer workstations.
  • Monitor for Launch Agent creation in ~/Library/LaunchAgents and /Library/LaunchAgents directories.

---

Chinese-Speaking Actor Exploits Multiple Platforms

A Chinese-speaking threat actor linked to the Red Heron group conducted coordinated exploitation campaigns since June 2026, targeting government and small business entities across 48+ countries. The actor exploited vulnerabilities in WordPress (CVE-2026-63030, CVE-2026-60137), ZyXEL GS1900 switches (CVE-2026-7273), Ubiquiti UniFi OS (CVE-2026-34908/34909/34910), and other platforms. The campaign compromised 996 ZyXEL devices and exfiltrated 18,566+ database records from a Western government organization. Post-exploitation activities included extensive Windows reconnaissance, credential harvesting, and SQL database exfiltration.

Defensive actions:

  • Immediately patch all affected platforms including WordPress, ZyXEL GS1900, Ubiquiti UniFi OS, FlowiseAI, Gitea, Nuclio, SENAITE LIMS, and Proxmox VE.
  • Implement enhanced logging for AMSI bypass attempts (PowerShell ScriptBlock logging Event ID 4104) and token manipulation activities.
  • Deploy network segmentation to isolate SQL servers from web-facing systems; monitor for password spraying patterns.
  • Review GreyNoise-provided IOCs for C2 infrastructure and backdoor hashes.

---

Geopolitical Context

European Regulatory Enforcement

Ireland's Data Protection Commission fined Google €403 million ($463 million) for GDPR violations related to improper handling of location data from three features between May 2018 and February 2020. The company was ordered to bring its data processing into compliance with EU law within six months. The enforcement action underscores the EU's continued assertion of regulatory sovereignty over digital services operating within its single market, regardless of corporate nationality. The decision reinforces the EU's role as a global standard-setter in digital rights, with potential ripple effects on privacy regimes in other jurisdictions.

Sweden's data privacy regulator IMY fined IT systems provider Miljödata $183,000 for inadequate security measures that led to a breach in August 2025 affecting 2.2 million people. The incident highlights concentration risk in Nordic public sector IT infrastructure, where Miljödata serves 80% of Sweden's municipal systems.

---

North Korean Cyber Operations

The Contagious Interview campaign and Jade Sleet's targeting of IT service providers demonstrate North Korea's dual-track cyber strategy: revenue generation through cryptocurrency theft and strategic positioning through corporate network infiltration. The operations reflect Pyongyang's systematic approach to circumventing international sanctions through cyber means, with activities coordinated under the 313 General Bureau of the Munitions Industry Department. The convergence of offensive cyber operations with IT worker placement schemes suggests that compromised individuals increasingly serve dual purposes—both as immediate revenue sources and as long-term access vectors for intelligence collection.

---

Recommended Actions

Immediate (0–24 hours)

  • Patch Check Point Management Servers for CVE-2026-93616; hunt for compromise using vendor IOCs.
  • Upgrade VeloCloud Orchestrator to fixed versions; restrict web interface access to trusted networks.
  • Apply Linux kernel security updates for CVE-2025-39964, CVE-2026-53266, CVE-2025-39682; conduct forensic triage.
  • Isolate or replace D-Link DIR-822A routers; no patch available for CVE-2026-86296.
  • Update WordPress to 7.1.2 or backported versions for CVE-2026-87902.
  • Disable device-code authentication for Microsoft 365 where not required for legitimate business purposes.

Within 24–72 hours

  • Audit Microsoft 365 environments for unauthorized OAuth app permissions, inbox rules, and recently authorized devices following EvilTokens disruption.
  • Review developer environments for signs of North Korean social engineering campaigns; validate Terraform lock file integrity.
  • Patch ZyXEL, WordPress, Ubiquiti, and other platforms exploited by Chinese-speaking threat actor.
  • Implement phishing-resistant authentication methods such as FIDO2 security keys or passkeys.

This week

  • Conduct supply chain risk assessments for third-party IT vendors, particularly those providing DevOps, cloud engineering, or software development services.
  • Deploy enhanced monitoring for OAuth device code authorization flows, Microsoft Graph API activity, and blockchain API queries to Polygon smart contract endpoints.
  • Review and strengthen identity verification and KYC processes during hiring to detect AI-generated identities and proxy arrangements.
  • Implement application control via Windows Defender Application Control (WDAC) or AppLocker to restrict execution of unauthorized binaries.

---

Watch List

  • F5 BIG-IP APM RCE (CVE-2026-94127): Active exploitation confirmed; CERT-EU recommends immediate patching.
  • Bifrost AI Gateway RCE (CVE-2026-90898): CVSS 9.8 flaw allows unauthenticated command execution; patch to transports/v2.1.0.
  • BigDiskBuster zero-day: Blocks Microsoft Defender updates via disk exhaustion; no patch or CVE assigned; previous exploits by same researcher were weaponized in the wild.
  • ClosedQuorum malware: New Windows malware uses AI models (Google Gemini, DeepSeek, Qwen, Mistral) to autonomously make post-compromise decisions.
  • ChainScript RAT: Uses Polygon blockchain infrastructure to rotate C2 servers; distributed via ClickFix-style lures masquerading as Spotify, Zoom, and Microsoft Teams.
  • TASK#STOMP campaign: PowerShell backdoor harvests business documents, Wi-Fi passwords, clipboard contents, and screenshots.

---

Sources

  • BleepingComputer
  • The Hacker News
  • Microsoft Security Blog
  • CERT-EU Advisories
  • CERT.BE (Belgium)
  • CERT.PL (Poland)
  • CISA Known Exploited Vulnerabilities Catalog
  • Check Point Security Advisories
  • Arista Security Advisories
  • WordPress Security Team
  • D-Link Security Advisories

---

*This brief synthesizes open-source threat intelligence from trusted cybersecurity vendors, national CERTs, and government agencies. Organizations should validate findings against their specific environments and consult vendor advisories for detailed remediation guidance.*