Group-IB (published 23 September 2026) documents RemControl, a previously undocumented Android banking trojan sold as MaaS. Distribution uses fake Google Play pages impersonating the TVTap IPTV app (tvtap-hd[.]app / tvtap-liveapp[.]com, registered 10 Jul 2026; Italian campaigns geofence + User-Agent gate). The dropper starts a local VPN that null-routes com.android.vending to blunt Play Protect, then abuses Accessibility Service for full-screen banking overlays, UI-tree streaming, remote gestures, pattern-lock capture, and anti-removal. C2 is recovered from Telegram dead-drops (AES-128-CBC); early C2 bnbnhura[.]top registered 12 May 2026. Panel API docs and an overlay file that still contains a verbatim AI-assistant reply show AI-assisted build of backend and phishing HTML. Group-IB confirmed overlays for 30+ financial institutions across Western Europe, Middle East, and Canada (Italy/France primary). Affiliate tag UNKK; dropper naming overlaps prior Medusa/UNKN distribution. (source: BleepingComputer)
Group-IB — RemControl: AI built the overlays (23 Sep 2026)
BleepingComputer (23 September 2026) reports a Microsoft service alert (also shared by MVP Susan Bradley) that September 2026 Windows 11 security updates can break Always On VPN when the profile uses automatic protocol selection between IKEv2 and SSTP. Affected tunnels may stay in Connecting, retry endlessly, or error with “The specified port is already in use.” Originating updates named: Windows 11 26H1 KB5124012; 25H2 and 24H2 KB5124008. Interim mitigation from Microsoft: pin the AoVPN profile to a single protocol (SSTP only or IKEv2 only) until a permanent fix ships. Same CU wave previously drove emergency fixes for Hyper-V, RDS, and USB audio. UPDATE (21 Oct): Microsoft told IT admins in a service alert that the issue was 'mistakenly updated to Resolved status on October 13, 2026' after the October Windows 11 cumulative updates and has been returned to Mitigated; the October updates do not fix it, and a resolution is planned for an update 'in the coming weeks'. The single-protocol (SSTP only or IKEv2 only) mitigation still applies (BleepingComputer, 21 Oct).
BleepingComputer — Sep 2026 CUs break Always On VPN (23 Sep 2026; cites Microsoft service alert)
Aikido Security (Joe Leon, 23 September 2026) demonstrates that GitLab's "Email work item to this project" / incoming-email address embeds a long-lived account-level glimt- token that does not expire. Anyone holding the address can create issues — and, by changing the -issue suffix to -merge-request and attaching a git patch, open merge requests or push commits under the victim's identity, including CI/CD via .gitlab-ci.yml when role/permissions allow (Maintainer may reach protected branches). Token is account-scoped (same secret across projects), not project-scoped as the UI implies; email path also bypassed IP allow-lists in Aikido's test (browser/git clone blocked, email accepted). GitLab docs frame the Incoming email token as issue-creation only. No CVE assigned in the research. Mitigations: treat issue-by-email addresses as secrets; rotate/revoke incoming email token in User settings; avoid publishing addresses; review unexpected MRs/pipelines authored as users who use email work items. (sources: Aikido research; Cyber Security News)
Aikido — Send GitLab an email, push to main (23 Sep 2026)
Adobe Experience Manager Forms JEE APSB26-151 (CVE records published 22 September 2026, 18:56 UTC; 23 September, 2:56 am Perth) patches six vulnerabilities. Adobe's CVE records score them as follows (CVSS 3.1): CVE-2026-75745 (incorrect authorization → arbitrary code execution) 10.0 Critical; CVE-2026-82000 (SSRF → privilege escalation) 9.6 Critical; CVE-2026-81995 (improper input validation → arbitrary code execution) 9.1 Critical; CVE-2026-81999 (SSRF → privilege escalation) 8.7 High; CVE-2026-75744 (stored cross-site scripting) 8.1 High; and CVE-2026-75743 (CSRF → security feature bypass) 7.1 High. Affected: AEM 6.5 Forms JEE 6.5.25 and AEM 6.5 LTS Forms JEE SP2. Fixes: a hotfix for 6.5.25; 6.5 LTS SP3. Companion to Connect APSB26-150 same day. (sources: Adobe APSB26-151 helpx; Adobe's CVE records) Correction (24 Oct 2026): Adobe's CVE record scores CVE-2026-75745 at 10.0 (CVSS 3.1; no privileges or user interaction needed), so it, not CVE-2026-82000 (9.6), is the highest-rated flaw in APSB26-151. (source: CVE record CVE-2026-75745 (Adobe)) Correction (25 Oct 2026): an earlier correction on this card gave severity ratings and scores from Adobe's bulletin that we could not verify; the card now gives only the scores in Adobe's CVE records, and a report credit we could not verify has been removed. (source: CVE.org) Correction (25 Oct 2026): the card date has moved from 22 to 23 September 2026, the Perth date of the publication of Adobe's CVE records (22 September, 18:56 UTC; 23 September, 2:56 am Perth). (source: CVE.org) Correction (26 Oct 2026): an earlier update today restored severity ratings from Adobe's APSB26-151 bulletin; Cyberstack's plain request for the bulletin was redirected (HTTP 301) rather than answered, so that update has been withdrawn and the card again gives only the scores in Adobe's CVE records. The hotfix name, Adobe's priority rating and its statement on in-the-wild exploitation, which came from the bulletin, have also been removed. (source: CVE.org)
Adobe APSB26-151 — AEM Forms JEE security update (22 Sep 2026 US time)
Socket (23 September 2026; corroborated by Aikido, SafeDep, StepSecurity) reports compromise of MemTensor MemOS packaging: npm @memtensor/memos-cloud-openclaw-plugin versions 0.1.21, 0.1.23, and 0.1.25 (0.1.25 tagged latest; 0.1.22/0.1.24 match last-good 0.1.20 aside from version strings; last known-good 0.1.20) and PyPI MemoryOS 2.0.34 (latest; last pre-compromise 2.0.33). Malicious builds bundle cross-platform Go implant sckit (linux/macOS/Windows x64+arm64) that launches on OpenClaw gateway start / memory-recall (npm) or on import memos (PyPI), harvests developer/CI secrets (npm/PyPI/GitHub/GitLab/AWS/Vault/SSH and related env tokens), and phones home to skyleen[.]fr. Initial access via malicious GitHub commits altering release tooling; Socket could not yet confirm how registry publish access was obtained. Treat any host that loaded the bad versions as compromised; worm-like republish strings noted but broader package impact unconfirmed. (sources: Socket analysis; The Hacker News)
Hewlett Packard Enterprise advisory HPESBNW05137 (rev.1, 22 September 2026) covers multiple flaws in HPE Networking Analytics and Location Engine (ALE) ≤ 5.0.0.0, fixed in ALE 5.1.0.0. Lead criticals: CVE-2026-76708 (CVSS 9.8) — default hard-coded credentials on administrative/system accounts enabling unauthenticated remote login to the ALE management interface and underlying OS (CWE-798); CVE-2026-76709 (CVSS 9.8) — unauthenticated remote arbitrary file write with elevated privileges via an internal administrative component. Additional highs include info disclosure, data injection, auth’d root filesystem/command execution, MitM RCE, and API password-hash disclosure (CVE-2026-76710 through CVE-2026-76717). HPE said it was not aware of any public discussion or exploit code targeting the flaws as of the advisory's release date. (sources: HPE HPESBNW05137; CVE.report; Tenable CVE pages) Correction (27 Oct 2026): HPE's bulletin says it is not aware of public discussion or exploit code; it does not address active exploitation, so the card no longer says it did. (source: HPE HPESBNW05137)
Have I Been Squatted (published 22 September 2026; researcher Ben Folland) documents Corp MDM, a compact Android surveillance implant distributed via fake Google Play pages branded as CEVA and TKW Logistics (playgoogle.logisticstkwcargo[.]com / playgoogle.ceva-app[.]help) delivering package com.corp.mdm. Once sideloaded it requests SMS/telephony/notification permissions, removes its launcher icon, runs a hidden foreground service, registers a device id with C2, heartbeats ~30s, and polls for commands (intercept new inbound SMS only — not the historical inbox — enable/disable call forwarding, self-destroy). C2 and phishing/Windows-malware hosting share VPS 69.55.61[.]82; operator panel on TCP/3456. HIBS assesses Armenian/Russian nexus from panel/UI artefacts and places the implant inside a broader logistics-sector credential-phishing + Windows malware campaign aimed at cargo theft (distinct from prior Diesel Vortex cluster; no evidence same group). Suspected AI-assisted development (capability-limiting bugs). No CVE. (sources: The Hacker News; Have I Been Squatted)
Have I Been Squatted — Inside Corp MDM (22 Sep 2026; note vendor URL spelling)
Proofpoint Threat Insight (22 September 2026) details active TeamFiltration campaign UNK_CondorFiltration targeting over 5,700 accounts across 28 Microsoft 365 tenants in Latin America (focus Chile; major retailer + financial institutions). Late July–August 2026 waves; 78.3% of observed auth events against one unnamed Chilean retailer. All seven confirmed compromises were unmanaged functional/service accounts with no prior legitimate login baseline — default/predictable passwords never rotated, no MFA. Six of seven broken within ~7 minutes (shared/default password set). Post-access: German VPN pivot, corporate VPN SAML probe, Azure Portal / OfficeHome / SharePoint Online / Microsoft Graph token activity (sign-ins alone are not proof of exfiltration). TeamFiltration (Joakim Kandefelt / TrustedSec; DEF CON 30) automates Entra ID enumerate/spray/exfil/backdoor. Prior related cluster UNK_SneakyStrike (Proofpoint Jun 2025) hit 80k+ accounts. (source: Proofpoint) Updated 24 Sep 2026: The Hacker News reported the campaign on 24 September (2:32 pm Perth). (source: The Hacker News)
Proofpoint — Spraying in the Andes: TeamFiltration Returns (22 Sep 2026)
SolarWinds Trust Center advisory CVE-2026-28325 documents an unauthenticated remote code execution vulnerability in Observability Self-Hosted stemming from deserialization of untrusted data when the application is configured to use a specific communication mode. CVSS 3.1 8.8 HIGH (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — adjacent network). Affected: Observability Self-Hosted 2026.2.2 and below. Fixed: 2026.2.3. Credit: Kai Huang (Armadin). No in-the-wild exploitation stated by vendor. Sibling CVE-2026-28324 (CVSS 9.8 integrity-check RCE) is a separate card on the same fix train. SolarWinds first published the advisory on 22 September 2026. (source: SolarWinds Trust Center) Correction (31 Oct 2026): removed the SecurityWeek link and credit, which this desk cannot read; every detail comes from SolarWinds' advisory, and the card is now dated by the advisory's first-published date, 22 September 2026, instead of 24 September. (source: SolarWinds Trust Center)
SolarWinds Trust Center — CVE-2026-28325 Observability Self-Hosted
SolarWinds Trust Center advisory CVE-2026-28324 documents an unauthenticated remote code execution vulnerability in Observability Self-Hosted due to insufficient integrity checks. Installations configured in a non-default and non-secure configuration are affected. CVSS 3.1 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Affected: Observability Self-Hosted 2026.2.2 and below. Fixed: 2026.2.3. Credit: Kai Huang (Armadin). SolarWinds makes no mention of in-the-wild exploitation. Same patch train also addresses sibling CVE-2026-28325 (separate card). SolarWinds first published the advisory on 22 September 2026. (source: SolarWinds Trust Center) Correction (31 Oct 2026): removed the SecurityWeek link and credit, which this desk cannot read; every detail comes from SolarWinds' advisory, and the card is now dated by the advisory's first-published date, 22 September 2026, instead of 24 September. (source: SolarWinds Trust Center)
SolarWinds Trust Center — CVE-2026-28324 Observability Self-Hosted
Astrana Health, Inc. Form 8-K Item 1.05 (date of earliest event 22 September 2026) reports a material cybersecurity incident at subsidiary Astrana Health Management, Inc. Threat actors used social engineering — impersonating company personnel and spoofing the main corporate telephone number — to contact employees and obtain unauthorized access. The company detected and responded, engaged a third-party cybersecurity/forensics firm, notified law enforcement, and is notifying state/federal regulators and payer partners. Remediation includes resetting affected credentials, restricting remote-access tools, rebuilding certain systems from clean backups, and improving monitoring/logging/detection. Investigation determined threat actors accessed and exfiltrated certain private and confidential information; assessment continues on whether patient, employee, credentialed-provider, business/financial, IP, or other data was involved; patient notifications to follow findings. Incident judged material as of 22 Sep 2026 due to potential sensitivity of data; company states it does not currently expect material impact on financial condition or operations. (source: SEC 8-K)
SEC EDGAR — Astrana Health Form 8-K Item 1.05 (22 Sep 2026)
Jamf Threat Labs (22 September 2026) documents a third PamStealer macOS infostealer variant distributed as a fake multichain crypto wallet “Wavel”. Lure site wavel[.]app serves Wavel.dmg from y32me8[.]com; the DMG drops a nameless .scpt that opens in Script Editor and runs compiled JXA (JsOsaDAS1.001.00 magic) which only base64-decodes a carrier into /bin/zsh. The zsh dropper downloads a purpose-built pkgunpack Mach-O, completes a live X25519/ECIES key exchange with wavel.apple03cloudstore[.]com, and decrypts CoreUpdate.pkg.enc — without server cooperation the payload cannot be recovered statically. Stage 2 is rewritten from Rust to Swift while retaining PAM-based credential validation that names the family. (sources: Jamf Threat Labs; Cyber Security News)
Jamf Threat Labs — PamStealer adapts again (Wavel / Swift / server-side decrypt, 22 Sep 2026)
