🌐 BlueMoon exploit kit shared by four APT groups, 🔥 Cisco FMC CVSS 10.0 auth bypass exploited, 🤖 AI agents hit 440 PaperCut servers, 📡 FortiGate PivotC2 RAT at scale, 🛰️ DPRK HAProxy backdoor, 🛒 DoppelCart 119k fake shops

Proofpoint has named BlueMoon, a previously undocumented exploit kit that four state-aligned espionage clusters picked up within a week of its first deployment on August 28, chaining two Chrome/V8 bugs with a Windows ALPC escalation into full system compromise from a single malicious page load. APT31 (TA412, Violet Typhoon) moved first against US NGOs, mining and commodity trading firms, installing a fake Gemini extension called GemStone for browser surveillance and credential theft, and UNK_LateNight, UNK_DoubleCheck and UNK_QuietRacket followed by September 3 with ShadowPad, Rust stagers and in-memory .NET payloads. The browser stage uses CVE-2026-85046 and CVE-2026-87491, both fixed in Chromium source before stable Chrome shipped the fix, so they operated as patch-gap zero-days, while CVE-2026-85880 provides the SYSTEM escalation; CISA has added all three to KEV. Patch Chrome to at least 152.0.7977.82 (V8 15.3.48), apply the Windows ALPC fix, and hunt the chrome.exe to cmd.exe to curl.exe to msgbox.exe chain, %TEMP%\ChromeUpdate.exe and the EdgeCore_AutoUpdate and MicrosoftEdgeUpdatesTaskMachine scheduled tasks.

Cisco has confirmed that CVE-2026-20079, a CVSS 10.0 authentication bypass in Secure Firewall Management Center, is being exploited, and Talos tied three clusters to it: UAT-12197 dropping JSP web shells and a JAR credential harvester in the CSM Tomcat webroot, UAT-11823, attributed with high confidence to Sandworm, chaining CVE-2026-20316 for a Netcat reverse shell and a Cyclops Blink variant with DNS-over-HTTPS resolution and packet sniffing, and UAT-11988, assessed as a Qilin affiliate, using static credentials for Active Directory reconnaissance before SOCKS5 and reverse-SSH tunneling and ransomware deployment. CISA added the flaw to KEV on September 9, and Cisco has hotfixes for both CVEs but no workarounds, with a fuller hardening release due the week of September 14. Apply the hotfixes, enable Snort SIDs 66075-66080, 66883 and 66960-66961, and review the Talos GitHub IOCs.

A Russian-speaking operator used an OpenAI Codex-based harness, a DeepSeek model and public offensive tooling to run hundreds of AI agents against PaperCut NG/MF servers, with GreyNoise reporting 440 compromised hosts across 395 organizations in 48 countries from August 31. GreyNoise watched the actor go from an empty workspace to remote code execution on a live victim in under four hours and to domain administrator about two hours later, exploiting CVE-2026-81578, an authentication bypass, and CVE-2026-82078, an unsafe reflection RCE, against self-hosted Java print servers that often carry SYSTEM rights and Active Directory integration. Patch both CVEs now; this is the clearest sign yet that AI-orchestrated exploitation is operational rather than theoretical.

Fortinet's CVE-2025-25249, a heap overflow in the FortiGate CAPWAP handler (cw_acd on UDP 5246) patched in January, is being exploited at scale to plant PivotC2, a custom RAT SOCRadar traced to at least July, as detailed in the FortiGate PivotC2 write-up. The chain fingerprints the appliance through CAPWAP Discovery requests to leak memory and defeat ASLR, grooms the heap, hijacks control flow by ROP and launches a Node.js reverse shell, after which PivotC2 0.2.3 runs SOCKS5 and HTTP tunnels, port scans and automated harvesting of VPN pre-shared keys, SSL-VPN credentials, LDAP secrets and admin passwords from device configs. Researchers found 178 confirmed infections against a target list of more than 30,000 FortiGates, with the US, Chile, Colombia and the UK hardest hit and two US intrusions reaching Exchange mailbox exfiltration; CISA added the CVE to KEV on September 9. Patch, block inbound UDP 5246-5249, and hunt for Node.js processes and the C2 IPs 146.103.99.177 and 46.151.29.58.

Huntress has documented rogue ScreenConnect installations tied to exploitation of CVE-2026-84869, a CVSS 9.9 flaw in client versions before 26.6.5 that lets files be transferred and executed through an active remote session, and the Canadian Centre for Cyber Security confirms open-source reporting of in-the-wild use, with later reporting describing wormable VBScript behaviour. ScreenConnect is deeply embedded in MSP remote-access estates, so confirm 26.6.5 or later and audit for installations you did not deploy.

The ShieldCrash proof of concept against the Microsoft Malware Protection Engine is now the third consecutive bypass of the same component in three months, after RoguePlanet (CVE-2026-50656) was fixed in July and ShieldBreak (CVE-2026-69414) in August, and its author has reclassified the impact from an arbitrary file read as SYSTEM to a full privilege escalation that can extract the SAM database. Microsoft has not confirmed the September bypass, yet the PoC already reaches Defender remediation and completes most of the chain. Track engine version deployment and restrict local access on Defender-dependent endpoints until Redmond answers.

Trezor's third-party email provider was breached and used to send phishing from help@trezor.io with a fake "STM32 Entropy Vulnerability" warning that pushed wallet owners toward seed-phrase theft, and users of BitBox and CoinTracking report the same messages, pointing at shared provider Brevo, according to the Trezor phishing disclosure. The campaign compounds Trezor's August ShipMonk supply-chain breach, whose exposure has grown from nearly 14,000 customers to 81,000 people across the US, Brazil, Colombia and Italy. Treat any "critical security alert" from a hardware-wallet vendor as hostile and verify through the vendor's own domain.

AdaptHealth has confirmed that 4.1 million people were exposed in a breach that began June 5 when an attacker social-engineered a third-party contractor's privileged account, reaching cloud patient-management, document-storage and EHR portals before demanding a ransom on June 15; the company attributes the intrusion to ShinyHunters and has issued 12-month credit monitoring notices. The exposed data includes names, contact and demographic details, insurance information and health records. The contractor-credential path is the same pattern running through this week's healthcare breaches, so third-party access to clinical systems deserves the same scrutiny as the perimeter.

CISA's September 9 KEV update added four flaws, three of which are covered above, namely FortiGate CVE-2025-25249, Cisco FMC CVE-2026-20079 and Chrome's CVE-2026-87491. The genuinely new entry is Citrix NetScaler CVE-2026-19490, a CVSS 9.3 authentication bypass disclosed in August that lets unauthenticated attackers skip login on appliances configured as gateways or AAA virtual servers when a SAML Action is present, and the KEV listing converts weeks of proof-of-concept scanning into confirmed exploitation. Audit any NetScaler ADC or Gateway acting as SSL VPN, ICA Proxy, CVPN or RDP Proxy, apply the fixed builds, and check for the add authentication samlAction configuration.

MacSync Stealer has scaled up through ClickFix lures and search-engine malvertising that impersonate Google Meet, Zoom, Claude, ChatGPT, Cloudflare, Docker, Notion, Cursor and TradingView to trick macOS users into pasting a command into Terminal, sidestepping Gatekeeper, XProtect and file-based EDR, as described in the MacSync analysis. The MaaS payload is a small x86_64 Mach-O stager that forks and calls setsid() to escape the terminal, reparents to launchd, silences its standard streams, hides command strings and C2 addresses behind single-byte XOR with key 0xAA, then loads credential dumpers in memory. Because no vulnerability is required, patch status is irrelevant; monitor for the fork-to-launchd reparenting pattern and tighten browser download hygiene.

Noma Labs researcher Sasi Levi has described Workflow Identity Hijacking, a technique that extracts data from enterprise AI automations without prompt injection or stolen credentials by submitting benign-looking requests that the workflow answers using its own elevated identity and permissions, returning internal data to the external requester through normal output. The fix is not better prompt filtering but strict scoping of what each workflow can read, rate limits on external triggers and output validation that blocks bulk exfiltration.

Dell's DSA-2026-382 covers three critical flaws in Secure Connect Gateway 5.0, led by CVE-2026-80172, a CVSS 9.8 failure to verify data authenticity that lets an unauthenticated attacker replay a captured request indefinitely to mint admin and refresh tokens; CVE-2026-79641 and a third bug add remote command execution. Fixed releases are SCG 5.0 Appliance 5.36.00.16 and Application 5.36.00.00, and any instance exposed beyond a trusted network is a management-plane takeover risk. Patch and confirm SCG is not internet-facing.

Rapid7 has detailed a previously undocumented Linux toolkit it attributes with medium confidence to DPRK operators targeting South Korean media and automotive firms, built around a ted backdoor that compiles into the victim's own HAProxy 2.8.12 binary and abuses its filter API, memory pools and process management to intercept web traffic while real load balancing continues. The kit adds trojanized crond, agetty, atd, sshd and polkitd for persistence, an SSH keylogger and curlRAT with a watchdog thread, and traces back to mid-2025 VirusTotal submissions. Audit HAProxy binaries against known-good checksums in those sectors and watch for the trojanized system daemons.

DoppelCart is the largest fake-shop fraud network documented by domain count: the German startup Nebty found 119,000 sites, more than 105,000 still live, clustered in the .SHOP TLD where they make up 2.72 percent of registrations and resolve to just 27 commerce backends with near-identical build files. The shops clone 44,182 brands, sometimes pulling images straight from the real companies' servers, and lure shoppers with discounts up to 65 percent while harvesting full card data at checkout. The scale defeats manual takedown, so retailers should hunt clones of their own catalogs while registrars and the .SHOP registry cut off the shared backends.

Veradigm has confirmed in an SEC filing that a third-party vendor compromise gave an attacker credentials for its customer-service API, which was then used to copy patient data including Social Security numbers; the Gentlemen gang claimed the attack and clinical information was not touched. The company says only a small number of customers were affected and operations were not disrupted, but SSN exposure carries long-term identity-theft risk and the API path shows how vendor credentials bypass perimeter controls. Watch for follow-on phishing against the affected population.

Watchlist: patch Chrome and Windows for the BlueMoon chain and apply the Cisco FMC, FortiGate and ScreenConnect fixes; meet the CISA KEV deadlines for CVE-2025-25249, CVE-2026-20079, CVE-2026-87491 and Citrix CVE-2026-19490; track Defender engine versions pending a ShieldCrash answer; rotate vendor credentials and audit third-party API access at Veradigm and AdaptHealth; and warn crypto and macOS users about provider phishing and ClickFix Terminal lures.

Generated by commandcode/deepseek/deepseek-v4-flash. Input tokens: 82,542, output tokens: 38,103, cache read: 2,306,688, cache write: 0.