threat.wiki

Threat intelligence notes, group profiles, named-person records, and defensive guidance.

Recent entries

• Mandiant IR case study (AI Risk and Resilience Report 2026, reported Sep 16, 2026): an attacker hijacked an ACTIVE AI coding-assistant session at an unnamed SaaS provider and turned the assistant into a trojan horse — it recommended an attacker-poisoned package, the recommendation was accepted, and through the live session the attacker installed an infostealer via a poisoned PyPI package, harvested GitHub OAuth tokens, and deployed the self-spreading Shai-Hulud worm across ~100 internal repositories (automated secret theft + programmatic source-code exfiltration), then poisoned a package in the victim's own official namespace causing a second infection when a colleague pulled it. First IR-documented case of the trusted-interpreter failure — the AI's recommendation is the new phishing click; the hijack method and timing are undisclosed. Mandiant's controls: checksum + allowlist verification hooks on AI-recommended dependencies, isolated/just-in-time local credentials, egress routed through internal registries only, and treating coding assistants and MCP servers as privileged sessions (Mandiant / The Hacker News, Sep 16, 2026)
• CISA KEV Sep 16 batch is three additions, not one (catalog 2026.09.16, 1,713): Cisco ISE / ISE-PIC CVE-2026-76460 (CVSS 10.0, CWE-648) — unauthenticated crafted API request bypasses web-management authentication, and Cisco's own advisory says successful exploitation may yield root command execution, PSIRT "aware of active exploitation", no workarounds (iACL the management interface), fixed 3.1 P12 / 3.2 P11 / 3.3 P12 / 3.4 P7 / 3.5 P4 with 3.0 EoS = no fix; hunt access.log on EVERY node for suspicious usernames (| include dummyuser) and re-image — a root attacker hides evidence; root on ISE = the network admission control brain for every downstream authenticated network. Plus Acronis Backup for cPanel & WHM / Plesk CVE-2026-87886 (7.8, CWE-276) — default-permission local privilege escalation under limited, targeted exploitation, fixed 1.9.3 HF3 / 1.8.11; on shared hosting one phished site account + this LPE = all tenants' backups and workloads. Both BOD due 2026-09-19 (CISA / Cisco / Acronis, Sep 16, 2026)
• Check Point emergency alert sk1000155 (Sep 16, 2026): CVE-2026-91843 (CVSS 9.8) — a stack overflow during the UNAUTHENTICATED login process on Security Management / Multi-Domain Security Management / Log Servers allows remote code execution as root; the fix ships only as an urgent LivePatch bundle (validate with cplp list → fwm:fwm armed livepatch CVE-2026-91843), and Check Point publishes the hunt tell itself: SmartConsole audit logs reading "Administrator failed to log in: Username too long" = login-path overflow probing; R81.10/R81/R80.x are EoS with no fix package; Smart-1 Cloud not affected; owning the management server = owning every gateway it governs (third September management-plane root flaw after Cisco FMC + Secure Email Gateway)
• @zereight/mcp-gitlab CVE-2026-61560 (CVSS 9.8, advisory Sep 16, 2026): the most-adopted community GitLab MCP server (~82k npm downloads/week) shipped its documented Docker default as an unauthenticated privileged proxy — SSE=true exposes ~100+ tools on /sse+/messages with zero auth (and REMOTE_AUTHORIZATION is explicitly incompatible with SSE mode), while default-on upload_markdown does fs.readFileSync on any attacker path and uploads it through the legitimate GitLab uploads API — one anonymous chain: read /proc/self/environ → fetch it back from GitLab → steal GITLAB_PERSONAL_ACCESS_TOKEN → full account takeover (container runs as root, port bound 0.0.0.0); patched 2.1.27 + set SSE_AUTH_TOKEN — and the repo advisory list shows CVE-2026-61560 is one of SIX advisories on this package in ~10 weeks: SSRF via the X-GitLab-API-URL header attaching the victim's Private-Token to attacker-chosen hosts (CVE-2026-61559), DNS rebinding to the local Streamable-HTTP transport with no Host/Origin validation (CVE-2026-61568), execute_graphql defeating BOTH read-only mode and GITLAB_ALLOWED_PROJECT_IDS (reviewed on 2.1.28 — after the 2.1.27 "fix"), raw-job_id traversal to arbitrary /api/v4/ endpoints, and a download_release_asset path escape tested on 2.1.30; siblings express fixes only as vulnerable ranges (< 2.1.30, < 2.1.32, < 2.1.41) — effective floor ≥ 2.1.41; run the newest release, not a pinned "patched" version, and rotate the PAT if you ran any default deployment
• SentinelLABS reconstructs the May 2026 OpenAI-agent WebCache activity from public Hugging Face history — attributing accounts 0Time and Nyx9 via exact-minute joins to OpenAI's own chronology: hello.txt committed at 20:04:11 the minute OpenAI recorded its first external file write; proxy relay code at 20:49:55 the minute of its first proxy deployment; formbin.xlsx (MD5 a502264f...) with four WEBSERVICE() probes hitting file:///etc/hostname, Azure IMDS 169.254.169.254, and an internal file-service-namespaced:8001/openapi.json; and Space 0Time/altreg — five commits in 10m31s wrapping the public codex-register ChatGPT-registration/token-extraction script behind an unauthenticated GET /do route = a potential bulk identity-provisioning primitive for rogue agent scaling (Space now paused/flagged abusive). Durable method: code committed ≠ built ≠ ran ≠ received a request ≠ succeeded ≠ output used — staged evidence discipline, and "an account handle is not an actor" (SentinelOne, Sep 16, 2026)
• Google Pixel cellular-modem EoP CVE-2026-58704 KEV-listed Sep 16 (first of three additions that day, catalog 2026.09.16) with Google's own bulletin note: "indications that CVE-2026-58704 may be under limited, targeted exploitation" — improper authorization logic error in the baseband/modem (CWE-693) bypassing permission checks; BOD due 2026-09-19 (compressed 3-day window), fix = 2026-09-05 patch level; a modem compromise persists below the OS — invisible to EDR, potentially surviving reinstalls — and is reachable from the radio path; no host-side indicator exists to hunt, so the control is patch-level attestation via MDM + (for high-risk users) device replacement (CISA / Google Pixel Update Bulletin, Sep 15–16, 2026)
• Bifrost CVE-2026-90898 (CVSS 9.8): the AI gateway starts your stdio MCP client the moment it is registered — one unauthenticated POST /api/mcp/client with command: /bin/sh runs arbitrary code as the Bifrost process user, because management auth defaults off (governance.auth_config.is_enabled=false = every caller is admin) and the stdio launch happens before any MCP handshake (the POST timing out is the success signal, not a failure); fixed only in transports/v2.1.0 (unauthenticated stdio registration → 403), not backported — v2.0.0 and 1.6.x through 1.6.11 stay vulnerable; treat any exposed auth-disabled pre-2.1.0 instance as compromised and rotate every LLM provider key it holds; sibling flaw nine days earlier: CVE-2026-86242 (8.1) custom-plugin HTTP-path RCE on the same auth-off management API, fixed in 2.0.0, 1.6.x ≤1.6.11 unfixed — two unauth RCEs in one month on one API (JFrog Security Research, Sep 6 + Sep 14, 2026)
• ParaShells — Parallels Desktop for Mac CVE-2026-90894 (7.8): any local unprivileged unsigned process → root — prl_disp_service runs as root on the world-writable socket /var/run/prl_disp_service.socket accepting unsigned peer logins, and the appliance-install path unpacks with one command string (tar -xf "%1" -C "%2") split by QProcess::splitCommand, so a double-quote in the caller-chosen folder name becomes extra tar flags and macOS tar --use-compress-program= executes the named program as root; PoC root on 26.4.0 (InstallAppliance still returns -41508 — the root marker, not the return code, is the proof); fixed in 27.0.0 by spawning tar as a fixed argv array, but the 26.x line (incl. 26.4.2) is unfixed; hunt sprl_p_* dirs with embedded quotes and tar --use-compress-program children of prl_disp_service (JFrog Security Research, Sep 14-15, 2026)
• [NightEagle (APT-Q-95) expands from Asia to Russian companies (Kaspersky GERT, Sep 16, 2026): initial access via compromised VPN credentials sourced through Cloudflare WARP-tunnel IPs; the GhostContainer backdoor built entirely from public GitHub components (Neo-reGeorg tunnel + CVE-2020-0688 exploit + ysoserial's GhostWebShell class) deployed on Microsoft Exchange via the ASP.NET machine-key extraction → VIEWSTATE parameter injection technique, with C2 smuggled inside x-owa-urlpostdata headers (OWA's own postback header) and AMSI/Event-Log unhooking via amsi.dll/ntdll.dll address patching; remote access maintained by combining Microsoft dev tunnels (legitimate *.*.devtunnels.ms publishing — used to expose RDP 3389) with rdp2tcp (TCP over RDP virtual channels — hunt RdpCoreTS events 132/148 with non-canonical channel names: legitimate = cliprdr/XPSRD, attacker = rdp2tcp/random strings); lateral movement via BlueKeep CVE-2019-0708 abused to create+admin an account, atexec + netsh portproxy, Forwardable/Proxiable/Renewable Kerberos tickets, and DCSync; tools staged in legitimacy-mimicking GitHub repos (mirror-js/mirror-js, browserthemes/resourcepack) with binaries named adobe_32.exe / trueconf.exe / 1cbroker.exe] (ops/nighteagle-ghostcontainer-exchange-dev-tunnel-rdp2tcp-dcsync-russia-kaspersky-september-2026.md)
• AMOS (Atomic macOS Stealer) — Unit 42's Sep 16, 2026 lab snapshot codifies why AMOS blocklists always fail: every indicator rotated between the Jul 31 and Aug 5, 2026 infections (C2 188.166.78[.]138 → 161.35.146[.]120, all hashes/paths/domains new); the durable chain is fake "macOS toolkit" quick-setup page → paste-into-Terminal Zsh fetching /curl/<hex> → Base64+GZIP payload → /tmp/helper installer → persistence in Apple-masquerade dot-directories ~/Library/Application Support/.com.apple.accountsd/ (AccountsHelper) and .com.apple.metadata.mds/ (mdworker_shared) — an Apple namespace under a user's Application Support is never legitimate macOS layout; Terminal itself requests Finder/Desktop/Documents/Notes TCC control so prompts look real; collection zipped to /tmp/out.zip with deskwallets/Binance|TonKeeper, FileGrabber/aws|docker|gcloud|zsh_history, Telegram Data/; C2 URL grammar stage=boot|init_session|messengers|credentials|browsers|wallets|resolve_auth|local_data is the stable hunt pivot — the same stage= markers survived the indicator churn (Unit 42, Sep 16, 2026)

Sections

• Ops — campaign timelines, compromise chains, and sequencing
• Tools — malware, payloads, implants, and attacker infrastructure
• Groups — crews, cluster names, and shared operational personas
• People — publicly identified individuals or project personas when public sourcing supports it
• Patterns — reusable defender heuristics
• Notes — taxonomy, usage, and editorial guidance