# Threat Intel Brief — September 25, 2026

TL;DR

  • Critical WordPress RCE (CVE-2026-87902) exploited within hours of disclosure; attackers deploying webshells to /tmp directories for persistent access.
  • F5 BIG-IP APM zero-day (CVE-2026-94127) and Check Point VPN/Management flaws (CVE-2026-85102, CVE-2026-93616) under active exploitation; CISA KEV-listed, federal deadline September 25.
  • ClickFix social engineering now dominant enterprise attack vector, bypassing traditional defenses via clipboard hijacking; 17,000+ compromised URLs identified.
  • Supply chain risks escalate: malicious Terraform providers, compromised npm/PyPI packages, and placeholder domain weaponization (third-party[.]com) threaten developer environments.
  • MikroTik RouterOS SSH chain (CVE-2026-67279, CVE-2026-86060) grants unauthenticated admin access; exploitation confirmed since September 2, device rebuilds required post-compromise.

---

Critical Threats

WordPress Remote Code Execution (CVE-2026-87902)

What happened: A critical unauthenticated RCE vulnerability in WordPress versions prior to 7.1.2 is under active exploitation. Attackers began probing vulnerable sites within five hours of the September 22 patch release, progressing to full code execution by September 23. The flaw allows arbitrary PHP file inclusion when a theme contains a top-level directory starting with "page-" and a readable local .php file (e.g., pearcmd.php) exists on the server. Exploitation attempts increased tenfold within 24 hours, with threat actors writing webshells (wp-pear-rce-flag.php, luci_*.php, zeta_*.php) to /tmp and /var/tmp directories.

Impact: Unauthenticated remote code execution enables full site compromise. WordPress powers 43% of all websites globally, making this a widespread threat. Organizations running WordPress on Docker (official PHP images) or cPanel with PHP <8.5 are vulnerable by default. Observed attacks deploy persistent backdoors enabling data exfiltration, malware distribution, and lateral movement to backend infrastructure.

Recommendations:

  • Update WordPress to version 7.1.2 (or 7.0.6, 6.9.9, 6.8.10 for older branches) immediately.
  • Block source IPs 169.58.48.193, 169.58.48.195, 2001:df1:e8c0::106b at perimeter firewalls.
  • Search web server logs for "pearcmd.php" and suspicious .php file writes to /tmp and /var/tmp since September 22.
  • Verify WordPress auto-update is enabled; audit themes for "page-*" directories to assess exposure.

---

F5 BIG-IP APM Zero-Day (CVE-2026-94127)

What happened: F5 disclosed a critical heap-based buffer overflow (CVSS 9.8) in BIG-IP Access Policy Manager (APM) on September 22, with active exploitation confirmed. The vulnerability affects systems configured as OAuth authorization servers with APM access policy and OAuth profile on the same virtual server. Attackers can achieve unauthenticated remote code execution via malicious traffic to the virtual server. CISA added CVE-2026-94127 to the Known Exploited Vulnerabilities catalog with a federal remediation deadline of September 25.

Impact: Unauthenticated RCE allows full appliance compromise without credentials. BIG-IP devices typically sit at network perimeters, making compromise a gateway to internal infrastructure. Management interface restrictions do not mitigate this flaw. Federal agencies and organizations using BIG-IP APM for OAuth face immediate breach risk.

Recommendations:

  • Apply engineering hotfixes immediately: Hotfix-BIGIP-21.1.0.2.0.30.22-ENG (21.1), Hotfix-BIGIP-17.5.1.9.0.160.12-ENG (17.5), or Hotfix-BIGIP-17.1.3.5.0.41.14-ENG (17.1).
  • If patching is delayed, request and deploy the iRule mitigation from F5 support.
  • Check /var/log/apm for 10+ failed UserInfo requests from single IPs; run 'tmctl global_oauth_stat' to identify anomalous spikes.
  • Review /var/log/audit for suspicious commands correlating with OAuth failures, especially if followed by TMM SIGABRT events.

---

Check Point Security Gateway VPN RCE (CVE-2026-85102, CVE-2026-93616)

What happened: Check Point confirmed active exploitation of CVE-2026-85102, a pre-authentication RCE in Security Gateway VPN certificate-handling, since September 12. Attackers use VPNs and proxies to obfuscate origin. CVE-2026-93616, a Management Server path traversal flaw, has been exploited as a zero-day since July 23. Both vulnerabilities are CISA KEV-listed with a September 25 federal deadline.

Impact: Pre-authentication RCE allows full gateway compromise without credentials. Attackers can execute arbitrary code on internet-exposed Security Gateway appliances. Exploitation attempts observed using specific certificate subjects (CN=vpn, CN=vpn-user, CN=vpnuser). Organizations using Check Point VPN for remote access or site-to-site connectivity face immediate perimeter breach risk.

Recommendations:

  • Install Check Point LivePatch Take 26 immediately on R81.20, R82, or R82.10 gateways, or deploy fixed Jumbo Hotfix: R81.20 Take 166+, R82 Take 126+, R82.10 Take 44+, or R81.10 Take 190+.
  • Update Spark firewalls to R82.00.10 Build 2325 or R81.10.17 Build 4968 or later.
  • Verify LivePatch activation by running 'cpinfo -y CPupdates' in expert mode.
  • If patching is not immediately feasible, disable VPN implied rules and create explicit rules restricting Site-to-Site VPN (UDP/500, UDP/4500) to known peer IPs.
  • Hunt for indicators: review VPN certificate logs for subjects CN=vpn, CN=vpn-user, CN=vpnuser and investigate connections from anonymization infrastructure starting September 12.

---

MikroTik RouterOS SSH Authentication Bypass Chain (CVE-2026-67279, CVE-2026-86060)

What happened: Two MikroTik RouterOS SSH vulnerabilities can be chained to grant unauthenticated full administrative control of internet-exposed routers. The "MikroTrick" chain exploits an SSH state-machine flaw (CVE-2026-67279) combined with an argument-injection bug (CVE-2026-86060). Active exploitation confirmed since September 2, 2026 (one day before patches released). CISA added CVE-2026-86060 to KEV catalog on September 10. Attackers create unauthorized 'ops' admin accounts and exfiltrate device configurations.

Impact: Attackers gain full administrative control without credentials, enabling complete device takeover, configuration theft, persistent backdoor creation, traffic interception, and use of compromised routers as pivot points into internal networks. Patching does not remediate pre-compromise artifacts; manual forensic review and potential device rebuild required.

Recommendations:

  • Update all MikroTik RouterOS devices to version 6.49.21, 7.23.4, 7.24.2 or later immediately.
  • Run '/system/device-mode/print' to check Flagged status (note: absence does not guarantee device is clean).
  • Search SSH logs for username '-2' and check user accounts for unauthorized 'ops' account or unknown users with full privileges.
  • Review firewall rules, scheduler entries, scripts, tunnels, proxies, .rif diagnostic files, and fetch activity logs for anomalies.
  • If compromise indicators found: isolate device, preserve logs, factory reset, rebuild from trusted baseline, rotate all credentials, and do NOT restore backups from compromised devices.

---

Threat Actor Activity

Storm-2570 Ransomware Affiliate

Microsoft Threat Intelligence tracks Storm-2570, a ransomware affiliate active since April 2025 operating across multiple RaaS ecosystems including Qilin, DragonForce, Anubis, and BERT. The actor demonstrates consistent post-compromise tradecraft despite shifting between ransomware families, heavily relying on remote monitoring and management (RMM) tools (MeshAgent, Atera, ScreenConnect, Splashtop, NinjaRMM) for remote access. Discovery and lateral movement conducted using NetScan, Nmap, PsExec, Impacket, NetExec, and RDP batch scripts. Data exfiltration performed using s5cmd and Rclone. The actor has targeted healthcare, education, government, financial services, energy, retail, IT, and critical manufacturing sectors across the United States, Canada, United Kingdom, Spain, Netherlands, and Puerto Rico.

Defensive focus: Monitor for deployment of multiple RMM tools, especially when renamed with organization-specific names. Detect Base64-encoded command execution associated with legitimate remote management binaries. Alert on ntdsutil.exe execution for credential dumping, especially when preceded by RMM tool deployment and followed by lateral movement tools.

---

UNK_CondorFiltration Targets Chilean Organizations

Proofpoint identified UNK_CondorFiltration, a threat actor conducting Microsoft 365 brute-force campaigns against Chilean retail and financial institutions from July to August 2026. The actor leveraged the TeamFiltration offensive framework, compromising 5,700+ accounts across 28 Microsoft 365 tenants. The campaign originated from 1,487 unique AWS EC2 IP addresses. The actor specifically exploited unmanaged functional and service accounts with default credentials and no MFA, achieving 6 of 7 compromises within 7 minutes. Post-compromise, the actor pivoted via German VPN infrastructure within 2 minutes and accessed Microsoft Office, OneDrive, Teams, Azure Portal, SharePoint Online, and initiated Microsoft Graph API token requests.

Defensive focus: Enforce mandatory MFA on all accounts including service accounts. Implement automated discovery and inventory of service accounts and non-human identities; enforce password rotation policies and eliminate default credentials. Monitor for anomalous sign-in patterns including rapid authentication attempts from cloud infrastructure IP ranges and geographic impossibility (e.g., Chile to Germany pivot within minutes).

---

AI-Powered Payment Skimmer Campaign

A financially motivated threat actor, believed to be Chinese-speaking, is conducting large-scale automated attacks against online retailers using open-source AI agent frameworks (Strix, Cairn, Hermes). The campaign has compromised 119+ websites and stolen over 600,000 payment card records since at least July 2026. Victims include a Fortune 500 hospitality company, a major U.S. airline, a large U.S. industrial supplies distributor, and an online fashion retailer. The operator provides high-level objectives to autonomous AI tools that handle reconnaissance, exploitation, and post-compromise activities with minimal human intervention. Between September 10-15, the operator launched 105 distinct attack waves with varying success rates, compromising at least 27 organizations in that five-day window.

Defensive focus: Deploy behavioral detection for rapid sequential exploitation attempts across multiple hosts; monitor for compressed attack timelines (hours vs. days) indicative of AI-augmented reconnaissance. Implement file integrity monitoring on web application JavaScript files, checkout pages, and CDN/S3 content to detect unauthorized modifications. Establish database activity monitoring with alerts for bulk data access patterns followed by field-level deletions in payment processing tables.

---

Geopolitical Context

Chilean Financial Sector Under Targeted Attack

The UNK_CondorFiltration campaign represents a focused intrusion effort against Chile's economic infrastructure, specifically targeting retail and financial institutions. The campaign's concentration on Chilean banking and retail sectors—rather than dispersed global targeting—suggests either regional strategic interest or opportunistic exploitation of known security gaps in Chilean enterprise identity management practices. The use of AWS EC2 infrastructure (1,487 unique IP addresses) demonstrates operational sophistication and resource investment. Chile's position as a stable, digitally advanced economy in South America, coupled with its extensive trade relationships and membership in the Pacific Alliance, makes its financial sector an attractive target for both state-sponsored intelligence collection and financially motivated cybercrime.

---

Ukrainian Business Sites Compromised in ClickFix Campaign

An active ClickFix campaign is compromising legitimate Ukrainian business websites to deliver Psychedelic information stealer malware. The campaign's targeting pattern—Ukrainian-language lures, compromised Ukrainian commercial infrastructure, and concentration of victims in Ukraine (71 of 79 recorded completions)—is consistent with operations designed to exploit Ukraine's digital ecosystem for intelligence collection or financial gain. Russian-language artifacts in the campaign's traffic distribution system (TDS) panel and implementation suggest operators likely based in or aligned with Russian-speaking threat environments. The campaign demonstrates adversary capability to compromise trusted Ukrainian web properties, potentially undermining confidence in domestic digital services.

---

European Critical Infrastructure Vulnerabilities

Multiple critical vulnerabilities affecting European infrastructure have been disclosed by Belgium's CERT.BE, including CVE-2026-77987 (GitHub Enterprise Server SSRF enabling RCE), CVE-2026-94127 (F5 BIG-IP APM), and CVE-2026-93616 (Check Point Management Server). These advisories reflect Belgium's role in EU-level cyber threat information sharing under the NIS2 Directive framework and demonstrate proactive vulnerability disclosure practices. Belgium's position as host to EU and NATO headquarters amplifies the strategic sensitivity of software infrastructure vulnerabilities affecting government and defense sector development environments.

---

Recommended Actions

Immediate (0-24 hours)

1. Patch critical vulnerabilities: WordPress CVE-2026-87902, F5 BIG-IP CVE-2026-94127, Check Point CVE-2026-85102 and CVE-2026-93616, MikroTik RouterOS CVE-2026-67279 and CVE-2026-86060.
2. Block malicious infrastructure: third-party[.]com, fsputnik[.]com, uasputnik[.]com, skyleen[.]fr, IPs 169.58.48.193, 169.58.48.195, 107.175.82[.]242, 193.178.159[.]128, 69.55.61[.]82.
3. Hunt for compromise indicators: WordPress webshells in /tmp and /var/tmp, MikroTik 'ops' admin accounts, Check Point VPN certificate subjects CN=vpn/vpn-user/vpnuser, F5 BIG-IP failed UserInfo requests.
4. Rotate credentials: If MemTensor packages (@memtensor/memos-cloud-openclaw-plugin 0.1.21/0.1.23/0.1.25 or MemoryOS 2.0.34) detected, rotate all npm tokens, PyPI API keys, AWS credentials, GitHub/GitLab tokens, SSH keys, Vault tokens.

Within 24-72 hours

5. Audit cloud identity hygiene: Enforce MFA on all accounts including service accounts; implement automated discovery of non-human identities; eliminate default credentials.
6. Review supply chain dependencies: Pin MemTensor packages to safe versions (0.1.20 for npm, 2.0.33 for PyPI); audit Terraform configurations for malicious providers (gocommunity-io/dockerd, kreuzwenker/docker).
7. Implement ClickFix defenses: Deploy clipboard monitoring and alerting for PowerShell/cmd.exe execution from paste operations; conduct user awareness training on fake CAPTCHA/verification pages.
8. Assess network management exposure: Restrict management interface access for Cisco FMC, Cisco ISE, SonicWall SMA 1000, HPE Fabric Composer, EdgeConnect Orchestrator, Arista management consoles to VPN-only or jump hosts.

This week

9. Strengthen developer environment security: Replace non-reserved placeholder domains with IANA-reserved examples (example[.]com, example[.]org, example[.]net); enable dependency scanning in CI/CD pipelines.
10. Enhance mobile security posture: Deploy mobile threat defense solutions to detect sideloaded APKs and malicious Accessibility Service abuse; educate users to avoid downloading APK files outside Google Play.
11. Review Docker daemon configurations: Ensure Docker daemon API is not exposed to untrusted networks; disable TCP socket exposure or implement TLS client certificate authentication.
12. Conduct threat hunting: Search for Storm-2570 indicators (MeshAgent with victim-themed names, Base64-encoded commands, s5cmd/Rclone exfiltration); review TeamFiltration campaign patterns (rapid authentication from AWS EC2 IPs, Graph API token requests).

---

Watch List

  • Arista VeloCloud Orchestrator zero-day (CVE-2026-93952): Actively exploited; CISA KEV-listed; federal deadline September 25. Affects on-premises deployments with certificate-based authentication.
  • cPanel CalDAV/CardDAV flaws (CVE-2026-87899, CVE-2026-87900, CVE-2026-68490): Allow hosting account holders to execute code as root and gain full server control. Fixed versions available; no active exploitation reported.
  • Ubuntu Linux kernel container escape (CVE-2026-80521): Public exploit available; Ubuntu 26.04, 24.04 LTS, 22.04 LTS remain unpatched. Enables unprivileged container users to escape to host root.
  • OnePlus OxygenOS root escalation: Two unpatched flaws chain to grant root access via zero-permission app. Affects OnePlus 15, OnePlus 12 Pro, and multiple OPPO devices. No CVE assigned; no patch available as of September 24.
  • Google Kubernetes Config Connector confused deputy: Allows Kubernetes user with limited permissions to escalate privileges and potentially gain control of entire Google Cloud organization through malicious YAML configuration file.
  • GitLab issue email token: Private issue email addresses function as unprotected credentials allowing unauthorized code commits and CI/CD job execution if leaked. GitLab considers this intended behavior, not a vulnerability.

---

Sources

  • BleepingComputer
  • The Hacker News
  • Microsoft Security
  • CERT.BE (Belgium)
  • CERT.PL (Poland)
  • CISA Known Exploited Vulnerabilities Catalog
  • Canadian Centre for Cyber Security
  • Check Point Security Advisories
  • F5 Networks Security Advisories
  • Proofpoint Threat Research
  • Arctic Wolf Labs
  • Aikido Security
  • SafeDep
  • Socket Security
  • StepSecurity

---

*This brief covers threats identified through September 25, 2026. Organizations should prioritize patching CISA KEV-listed vulnerabilities (CVE-2026-87902, CVE-2026-94127, CVE-2026-85102, CVE-2026-93616, CVE-2026-86060, CVE-2026-93952) and implement defenses against ClickFix social engineering, which has become the dominant enterprise attack vector bypassing traditional perimeter controls.*