Zimperium zLabs (9 September 2026) describes Mantax Otax, an Android strain linked to Indonesian operators that combines spyware with ransomware. Samples were distributed as sideloaded APKs on third-party file hosts via phishing and social engineering, outside Google Play. After install it seeks device-admin and Accessibility permissions, pulls C2 from GitHub, and can use Firebase or WebSockets. Spyware capabilities reported include screen recording, browser history, lock-screen PIN theft, contacts, call logs, SMS, local file theft, and covert photos. On older Android versions it encrypts shared-storage files with a victim-specific AES key from C2, deletes originals, appends .enc, replaces images with ransom notices, and opens a full-screen Firebase-hosted chat for payment negotiation. (sources: BleepingComputer; Zimperium blog)
UPDATE 23–24 Sep 2026: Check Point blog advisory and BleepingComputer confirm active exploitation of CVE-2026-85102 (pre-auth RCE in Security Gateway / Spark VPN certificate handling) beginning 12 September 2026 against Spark customers (anonymized VPN/proxy infra; observed cert subjects include CN=vpn / CN=vpn-user / CN=vpnuser under OU=users,O=global — list not exhaustive). CISA added CVE-2026-85102 to KEV on 22 Sep 2026 (due 25 Sep). Vendor disclosed + shipped fixes 9 Sep with no then-known exploitation; Dutch NCSC 12 Sep had assessed exploitation as imminent. Remediation: LivePatch Take 26 on supported R81.20/R82/R82.10 gateways, or Jumbo R81.20 Take 166 / R82 Take 126 / R82.10 Take 44 / R81.10 Take 190 or later; Spark R82.00.10 Build 2325 or R81.10.17 Build 4968+. Same advisory wave also covers Management CVE-2026-93616 (separate card; KEV 22 Sep). (sources: Check Point sk1000117; BleepingComputer)
Check Point sk1000117 — CVE-2026-85102 VPN certificate RCE
CERT/CC and BleepingComputer (9 September 2026) warn that Skullcandy Dime 3 earbuds (model S2DCW) on firmware 1.0.0.28 accept Bluetooth pairing from nearby unpaired devices without user interaction, PIN, or case access. Issue tracked as CVE-2025-20701 in the Airoha Bluetooth Audio SDK. Skullcandy says fixed in firmware 1.0.0.30, but end users have no supported update path via the Skullcandy app. Nearby attacker can hijack the audio link. Broader Airoha-based headset class affected per ERNW/TROOPERS research. (source: BleepingComputer citing CERT/CC)
Wiz Research (Amitai Cohen & Yaara Shriki, 9 September 2026; also THN same day) scanned ~3,074 internet-facing LiteLLM AI gateways: 294 (9.6%) accepted the docs/Docker default master key sk-1234 or required no authentication (191 of those had no key at all). Default/missing master key grants admin and exposes every configured LLM provider API key (LLMjacking), and can chain to post-auth custom-code-guardrail RCE CVE-2026-59821 (fixed v1.82.0) for root-in-container when still on vulnerable builds. Same research covers MCP auth bypass CVE-2026-59822 (already on Cyberstack; CISA KEV; Wiz honeypot exploitation). LiteLLM still ships sk-1234 as the example/default in common install paths. Mitigate: set a unique strong master key immediately; upgrade past 1.82.0/1.84.0; review custom guardrails and pass-through endpoints. (source: Wiz)
US Treasury OFAC (press release sb0624) designated Xinbi Guarantee, a Chinese-language illicit marketplace supporting cyber scams, fraud, money laundering, and related crime targeting Americans, plus two supporting digital-currency entities — coordinated with DoJ Scam Center Strike Force infrastructure and wallet seizures. THN (9 September 2026) reports ~$52.8M in cryptocurrency frozen across 52 wallets and ~$12M held in two seized payment wallets; Telegram channels hosting the market dismantled. Xinbi acted as escrow between scam-center operators and vendors (pig-butchering sites, laundering, trafficking labour). Treasury notes reported use by North Korean hackers and OFAC-designated entities including Jin Bei Group and Prince Group TCO affiliates. (source: Treasury OFAC)
Okta Threat Intelligence (Jeremy Kirk, Sydney; 9 September 2026): analysis of a free 7 GB Remus-style infostealer dump (5,871 machines, 162 countries, released on Telegram 2 August 2026) found thousands of unexpired authentication tokens for Google, Microsoft, Anthropic, Amazon, Gamma, Notion, Character.ai, Cursor, Poe, and Pika AI. Of 44,791 unique JWTs, 555 were likely AI-auth related; 2,937 auth-related JWEs (mostly OpenAI/NextAuth.js); 1,843 JWTs/JWEs still unexpired on release day; 17.7% of JWTs held plaintext PII. TruffleHog found 24 still-valid API keys across Gemini, OpenAI, Groq, and OpenRouter. Replay bypasses password+MFA; underground tooling includes anti-detect browsers. Recommendations: session-reuse detection, API key caps/IP allowlisting, OAuth short-lived tokens, Device-Bound Session Credentials where available. AU author; global dataset. (source: Okta blog)
Okta Threat Intelligence — AI token replay (9 Sep 2026)
Proofpoint (9 September 2026) documents BlueMoon, chaining CVE-2026-85046 (Chrome V8 type confusion), CVE-2026-87491 (V8 sandbox escape; patch-gap 0-day), and CVE-2026-85880 (Windows ALPC heap overflow LPE / AppContainer escape; Microsoft September Patch Tuesday + CISA KEV). First in-the-wild use attributed to China-aligned APT31 (Proofpoint: TA412, aka JungleBamboo / Violet Typhoon) from 28 August 2026; other espionage clusters rapidly reused the kit. UPDATE 15 September 2026 (Volexity blog 9 Sep; THN report 15 Sep): Volexity details two China-nexus clusters using the same byte-identical exploit chain against NGOs via spearphishing through reflected XSS on a legitimate US university site. UTA0560 deploys GRIMWEDGE (obfuscated JavaScript backdoor via MSI custom actions; C2 ocr.opusaccel[.]top). JungleBamboo/APT31 deploys SUPERSTOMP loader then LONGTALE (aka GemStone) credential-stealing Chrome extension. UPDATE 23 September 2026 (Volexity Part 2 blog 21 Sep; THN report 23 Sep): third China-nexus cluster UTA0565 used the same BlueMoon chain on 3–4 Sep 2026 via multiple fake websites (chinadigitaltimes[.]top; americanprgoress[.]top typosquat of Center for American Progress) with hidden iframe loading config.html; final payload chrome_cleanup.exe is previously undocumented CLEANGULP (MSVC; control-flow flattening). CLEANGULP installs to %LOCALAPPDATA%/Microsoft/IME/MicrosoftIME.exe with scheduled task “MicrosoftIME”; commands shell/ps/upload/download/bof; C2 thecovnresation[.]com over HTTP (AES-256-GCM + custom Base64 alphabet). Targeting included Asian government entities (Hong Kong activist lure) and CAP-themed phishing. (sources: Volexity Part 2; Proofpoint)
Volexity — Mind the (Patch) Gap, Part 2 / UTA0565 CLEANGULP (21 Sep 2026)
The Hacker News (9 September 2026) reports Alby warned of a critical flaw in self-hosted Alby Hub (Lightning bitcoin wallet) that could let an attacker take over a wallet and send funds — only where the Hub management interface was reachable from the internet. Affected: v1.7.0 through v1.18.5 (pre-August 2025 builds); fixed from v1.19.0 (first fixed release 29 August 2025); current recommended v1.24.0. Alby says one user affected so far; technical details withheld pending responsible disclosure. Guidance: remove external reachability first (e.g. bind 127.0.0.1), then upgrade; if exposed on an affected build, change unlock password after update and contact security@getalby.com. (source: GitHub getAlby/hub)
BleepingComputer (9 September 2026) covers Veradigm's SEC disclosure of a third-party vendor incident: an attacker obtained vendor credentials for a Veradigm customer-services API and copied patient personal details including some Social Security numbers; clinical/medical content and the broader Veradigm network were not accessed per the filing. Veradigm says a small number of customers were affected, notified law enforcement, and is offering credit monitoring where applicable. According to BleepingComputer, Veradigm's disclosure did not identify the attacker; The Gentlemen ransomware group claimed the intrusion on 5 September. (source: BleepingComputer) Updated 24 Oct 2026: the gang's claimed record count has been taken out of the headline and the unverified claimed leak deadline removed. (source: BleepingComputer) Correction (25 Oct 2026): removed the ransomware group's own claim to be holding 3.5 million patient records; no company, regulator or outlet has confirmed that figure. (source: BleepingComputer)
BleepingComputer (9 September 2026) reports anonymous researcher Nightmare Eclipse released a ShieldCrash proof-of-concept against Microsoft Defender immediately after September 2026 Patch Tuesday. The researcher claims ShieldCrash bypasses the ShieldBreak elevation issue patched as CVE-2026-69414 and demonstrates arbitrary file read as SYSTEM on fully patched Windows 10, Windows 11, and Windows Server, without write access to the compromised system. ShieldBreak itself followed RoguePlanet (disclosed June, patched July). Microsoft had not commented to BleepingComputer at publish. Treat as a local privilege-escalation research drop / incomplete patch claim — not a remote wormable CVE. No Australian exploitation signal on this pass. (source: BleepingComputer)
Cisco PSIRT advisory cisco-sa-onprem-fmc-authbypass-5JPp45V2 covers CVE-2026-20079, a maximum-severity (CVSS 10.0) authentication-bypass in Cisco Secure Firewall Management Center (FMC) and related management paths. Improper process creation at boot lets an unauthenticated remote attacker send crafted HTTP requests to the web interface and execute scripts/commands as root. Cisco updated the advisory on 9 September 2026 to state PSIRT became aware of active exploitation in August 2026 (no public attribution or start date). Cloud-hosted Security Cloud Control is already patched per Cisco; on-prem FMC has no workaround — upgrade to a fixed release. BleepingComputer (9 Sep) notes CISA added CVE-2026-20079 to the KEV catalog with FCEB remediation due 12 September 2026. Hunt guidance from related July FMC coverage includes /var/log/messages activity around /var/tmp/license.tmp. (source: Cisco PSIRT) NEW 10 September 2026 (Cisco Talos “Active exploitation of Cisco Secure Firewall Management Center vulnerabilities”; BleepingComputer same day): Talos tracks three post-compromise clusters on FMC — UAT-11988 (high confidence Qilin ransomware affiliates), UAT-11823 (high confidence APT tooling overlap with Sandworm / Cyclops Blink deployment), and UAT-12197 (state-sponsored/crimeware mix). Actors abused CVE-2026-20079 and companion CVE-2026-20316 (static low-privileged credentials; CVSS 5.3 per report, Cisco High because it chains with other FMC bugs) to plant web shells, steal AD/MySQL credentials, stand up SOCKS5/SSH tunnels, and in one cluster deploy Qilin ransomware. At the time, Talos advised installing Cisco's hot fixes for both CVEs and said a comprehensive hardening package was forthcoming. Distinct companion CVE covered here rather than a sibling card. UPDATE (26 Oct 2026): Cisco's advisory (version 2.6, 16 September 2026) replaced the hot fixes with security hardening releases that fix this flaw and other internally found ones: first fixed releases are 7.0.10 (for 7.0 and earlier), 7.2.12, 7.4.8, 7.6.6, 7.7.13, 10.0.2 and 10.1.0. Cisco recommends upgrading to the hardening release for your train. (source: Cisco Security Advisory cisco-sa-onprem-fmc-authbypass-5JPp45V2)
Palo Alto Networks security advisory CVE-2026-0310 (published 9 September 2026): buffer overflow in PAN-OS XML processing lets an unauthenticated network attacker with access to the management web or dataplane interface cause DoS on VM-Series firewalls or execute arbitrary code as root on PA-Series. Vendor severity 7.2 HIGH; urgency HIGHEST; exploit maturity UNREPORTED. Panorama is impacted. Risk is reduced when management is restricted to trusted internal IPs per Palo Alto best practice. Fixed builds include PAN-OS 12.2.3; 12.1.4-h10 / 12.1.7-h5 / 12.1.10; 11.2.4-h21 / 11.2.7-h20 / 11.2.10-h14 / 11.2.13-h2; 11.1.4-h36 / 11.1.6-h38 / 11.1.7-h10 / 11.1.10-h33 / 11.1.13-h12 / 11.1.16-h2; 10.2.7-h37 / 10.2.10-h40 / 10.2.13-h24 / 10.2.16-h10 / 10.2.18-h10 (confirm against the live advisory for your branch). Prisma Access / Cloud NGFW called medium severity on the same advisory and are scheduled for maintenance upgrades. (source: Palo Alto Networks advisory)
