Cyber Threat Intelligence Digest: Week 40

Executive Summary -
Highlights of Cyber Threat Intelligence Digest

Vulnerabilities

ASUS Discloses Three Vulnerabilities Affecting Router Firmware and Multiple Motherboards - On 1 October 2026, ASUS disclosed three vulnerabilities: CVE-2026-13313, CVE-2026-14157, and CVE-2026-93495. CVE-2026-13313 affects ASUS Router Firmware in the 3.0.0.4_386, 3.0.0.4_388, and 3.0.0.6_102 series, while CVE-2026-14157 affects the 3.0.0.6_102 series. CVE-2026-93495 affects multiple ASUS motherboard models. At the time of writing, there are no reports of active exploitation.

CVE-2026-13313 is an active debug code vulnerability in ASUS Router Firmware, and successful exploitation allows authenticated threat actors to enable Telnet and execute arbitrary commands with root privileges. CVE-2026-14157 is a use of externally controlled format string vulnerability in ASUS Router modules, which allows authenticated threat actors to execute arbitrary commands by uploading a crafted file through the web management interface. CVE-2026-93495 is an improper initialisation vulnerability affecting ASUS motherboards; exploitation requires physical access and allows threat actors to read or modify arbitrary memory using a specially crafted device.

Atlassian Patches Critical Vulnerability CVE-2026-21589 Affecting Multiple Data Center Products - On 5 October 2026, Atlassian disclosed and patched CVE-2026-21589, a critical vulnerability affecting all versions of Bitbucket Data Center, Confluence Data Center, Jira Software Data Center, Jira Service Management Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. CVE-2026-21589 is a 9.3-severity arbitrary file access vulnerability that could allow an unauthenticated threat actor to access specific files within the affected product's web application root directory. Exploitation requires prior knowledge of the target file's exact name and path and does not allow directory listing or enumeration, although Atlassian noted that some configurations may contain sensitive files in the affected location, increasing risk. There is no evidence of exploitation at the time of writing.

Atlassian stated that affected Cloud products have been patched and no action is required from Cloud customers. For self-managed deployments, Atlassian recommended immediate upgrades to the following fixed versions: Bitbucket Data Center 9.4.26, 10.2.8, or 10.5.1; Confluence Data Center 9.2.26 or 10.2.19; Jira Service Management Data Center 5.12.40, 10.3.26, or 11.3.12; Jira Software Data Center 9.12.40, 10.3.26, or 11.3.12; Bamboo Data Center 10.2.24 or 12.1.12; Crowd Data Center 6.3.7, 7.0.3, 7.1.7, or 7.2.4; Crucible 4.9.15; and Fisheye 4.9.15.

Apache Discloses OpenOffice Vulnerability CVE-2026-59265 - On 2 October 2026, the Apache Software Foundation disclosed CVE-2026-59265, a high-severity untrusted search path vulnerability affecting the Java integration in Apache OpenOffice versions 4.1.16 and earlier. Successful exploitation allows a threat actor to execute arbitrary code via a maliciously crafted document.

Apache plans to fix the vulnerability in version 4.1.17. Until the fixed release is available, users are advised to disable Java runtime integration and avoid opening suspicious documents.

Potential Threats

Threat Actors Abuse Smart Contracts to Evade Traditional C2 Disruption - Threat actors are using public blockchain smart contracts to store loader code and references to malicious infrastructure, a technique known as EtherHiding. This provides a persistent location from which compromised websites or infected devices retrieve the next attack stage, and where contracts permit updates, operators can change the returned code or destination without modifying the loader or reinfecting victims. The Recorded Future Payment Fraud Intelligence team observed this in two investigations involving the BNB Smart Chain testnet. In a Magecart campaign active from April 2025, injected website code queried smart contracts to load an e-skimmer that exfiltrated payment data over WebSocket, compromising at least 105 online stores and an estimated 3,595 payment cards from 24 countries. In October 2026, analysts recovered an on-chain loader referencing an external JavaScript file on alrosha[.]com, alongside a ClickFix lure. An infostealer infection was confirmed, although the full execution chain remains under investigation.

These cases show how blockchain storage makes one stage of malware delivery more resistant to disruption, and wider adoption across threat groups and blockchains reduces the effectiveness of domain blocking and takedowns. External script hosts, payload servers, and data collection infrastructure nonetheless remain intervention points. Defenders should combine detection of suspicious RPC traffic, behavioural monitoring, and tracking of malicious contracts and wallets with website remediation, network controls, and endpoint investigation.

Mir0Auth Phishing Kit Targets Microsoft 365 Authentication Tokens Through Device Code Phishing - On 30 September 2026, ANY.RUN reported Mir0Auth, a newly identified phishing kit targeting Microsoft 365 (M365) authentication tokens, primarily against organisations in the United States. Threat actors deliver DocuSign-themed lures directing victims to Mir0Auth pages imitating Microsoft authentication workflows, hosted on Cloudflare Workers infrastructure such as hxxps://click-to-continue[.]cloud-ack[.]workers[.]dev/. On access, the victim's browser beacons via a POST request to /task_queue.cs, then requests /context.go, prompting the command-and-control (C2) infrastructure to obtain a Microsoft device code and return the user code to the page. Mir0Auth XOR-obfuscates hex-encoded C2 URLs and JSON request data using M1r0AuthBinProT0c0l_2024!, transmitting it as raw application/octet-stream traffic.

The page displays the device code, copies it to the clipboard, and opens Microsoft's legitimate login page at microsoft[.]com/devicelogin in a pop-up, instructing the victim to enter it. Meanwhile, Mir0Auth polls the C2 via POST requests to /window.rs roughly every three seconds. Once the victim authenticates, they authorise the threat actor-controlled session, and Microsoft issues M365 tokens to the threat actor, granting account access without capturing the victim's password.

ClickFix Campaign Uses Browser Cache to Stage a VBScript Payload - On 3 October 2026, Microsoft Threat Intelligence reported a ClickFix campaign that used compromised websites to cache malicious scripts in victims' browsers. Unlike typical ClickFix activity, which downloads a remote payload after command execution, compromised websites prefetched a VBScript payload into the browser cache disguised as a PNG file. This concealed the payload, staged it before execution, and bypassed the Run dialog's character limit with a shorter pasted command. The command invoked cmd.exe to recursively enumerate files beginning with f_ in the browser profile directory, such as %LOCALAPPDATA%\Mozilla\Firefox\Profiles, matching each by an expected byte length that varied across variants. The matching cache entry was silently copied to %LOCALAPPDATA%\Temp\t.vbs and executed with wscript.exe. The VBScript collected system information via WMI, then retrieved and launched v.ps1 from cocojambo[.]us[.]com/alfa with no PowerShell profile and execution-policy restrictions bypassed.

A later PowerShell stage downloaded cab.dat and executed it in a hidden window, triggering .NET compilation via csc.exe and cvtres.exe before launching timeout.exe. Subsequent payloads loaded .NET assemblies into memory and injected code into timeout.exe to target browser and device credentials. The compromised process then launched PowerShell to retrieve an in-memory stage from capsysnet[.]vg and connected to ciliabula[.]cc. For persistence, the payload set the per-user PowerShell execution policy to Bypass in the registry, unpacked a Python environment with tar.exe, and created a scheduled task launching a Python payload through pythonw.exe. At the time of writing, all listed infrastructure returns error messages.

General News

Belarusian hacktivists spent two years inside Russian healthcare network - The Belarusian Cyber Partisans, an activist hacking group, reportedly spent nearly two years inside the network of an unnamed Russian healthcare organisation, according to Solar, a cyber security subsidiary of state-controlled Rostelecom. Solar discovered the intrusion in December 2025 and traced initial compromise to early 2024. The threat actors accessed sensitive medical data without disrupting systems, which researchers attributed to the value of retaining access for espionage and trusted-relationship attacks, given the victim's connections to numerous other healthcare organisations. Tooling included a newer version of Vasilek, a Telegram-controlled Windows backdoor first documented by Kaspersky in 2025, capable of host reconnaissance, command execution, process control, file transfer, screenshot capture, keylogging, and self-update or removal. Solar noted Russian Telegram restrictions made command-and-control (C2) less reliable, although operators can switch channels.

The Cyber Partisans emerged after protests against Belarusian President Alexander Lukashenko following the disputed 2020 election. The group has claimed major attacks on the Belarusian government, including state institutions and the national railway, and has increasingly targeted Russian organisations since the war in Ukraine began. In July, Russia's Supreme Court designated the group an extremist organisation for allegedly seeking to destabilise Russia and Belarus, the first such designation of a hacking group. The Cyber Partisans dismissed the ruling and vowed to continue their campaign.

Shares in British clothing company ASOS dive after hackers apparently send push notification - Shares in British online fashion retailer ASOS fell more than 10% on Tuesday after customers received a push notification through the company's app titled "ASOS HACKED". Addressed to the company's Data Protection Officer and IT team, it claimed full compromise of its Snowflake instance and threatened to leak data unless ASOS engaged. The message linked to a Telegram channel calling itself Xuanye Group, a name previously unseen by those tracking extortion groups, which typically contact victims privately before going public. The group provided no evidence of the compromise. An executive at Check Point described the incident as particularly brazen if confirmed, noting the attackers had turned the company's own app into a ransom note, and that investors priced in the consequences before ASOS had established what happened.

In a regulatory statement on the London Stock Exchange, ASOS confirmed an unauthorised notification had been sent and that it was investigating activity involving third-party customer communication platforms, access to which has been restricted. The company is working with specialist advisers and authorities, and stated that names and contact details may have been accessed, but not payment card information or passwords. Its website and app are operating normally, although it is too early to quantify any trading impact. Xuanye Group later claimed payment data was unaffected, the app was safe to use, and customer data would not be released for a designated period, but did not specify what it held or provide any supporting samples.

South Korean officials believe AI agents were used to hack several banks - South Korean President Lee Jae Myung said officials are investigating a series of recent bank breaches likely carried out by AI agents, with the Chinese cyber security tool Artex AI suspected of being used. The personal data of at least 68,000 people was reportedly exposed across at least seven financial institutions, including Hana Bank, KB Kookmin Bank, and Shinhan Bank, the last of which reportedly confirmed exposure of roughly 25,000 customers' data. According to the Korea Herald, this included names, phone numbers, incomes, and borrowing history. The incidents surfaced on 30 September and are the first known case of AI agents compromising the financial sector. The Financial Supervisory Service (FSS) has reportedly identified 33 attack IP addresses linked to at least 12 countries and territories, including Japan, the US, Thailand, Vietnam, and Hong Kong.

Lee said on Tuesday that signs indicated AI agents were used in at least some attacks, warning that AI now enables hacking without specialist skills, and pledged significant resources to limit the damage. The National Office of Investigation has formed a 28-person team. The incidents follow a wider rise in reported AI-powered attacks, including Australian officials' claim last month that OpenAI agents compromised the country's Medicare database, which holds data on most Australian citizens. OpenAI was criticised for notifying officials weeks later via a generic public email address. Its chief strategy officer apologised before the Australian parliament on Tuesday, reportedly stating the company now requires prompt breach notification, citing a recent disclosure made within 48 hours.

Threat Actor Weekly Graph

Over the past 7 days, we have been tracking the following intent and opportunity changes within our Threat Actor Landscape.

Intent represents the potential targets of a group. When a group is observed attacking a different organisation or entity, their intent will increase.

Opportunity represents the various methods and technologies these groups may use. For example, if a group started using a new attack vector, such as a new kind of ransomware, their opportunity would increase.

Both intent and opportunity are scored out of 100 and are responsible for scoring the group's severity. These updates can be seen below.