Cyber Threat Intelligence Digest: Week 39

Executive Summary -
Highlights of Cyber Threat Intelligence Digest

Vulnerabilities

Citrix Patches Eight Vulnerabilities Affecting NetScaler ADC and NetScaler Gateway; CVE-2026-88771 and CVE-2026-88772 Actively Exploited - On 27 September 2026, Citrix reported that threat actors are actively exploiting CVE-2026-88771 and CVE-2026-88772, two vulnerabilities affecting NetScaler ADC and NetScaler Gateway. The US Cybersecurity and Infrastructure Security Agency (CISA) has since added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue.

Citrix also disclosed six further vulnerabilities affecting the same products, CVE-2026-88773 through CVE-2026-88778, although no active exploitation has been reported for these. All eight vulnerabilities have been addressed in NetScaler ADC and NetScaler Gateway versions 14.1-73.37 and 13.1-64.23, NetScaler ADC 14.1-FIPS 14.1-73.37 FIPS, and NetScaler ADC 13.1-FIPS and 13.1-NDcPP 13.1-37.279 or later.

IBM Concert Buffer Overflow Vulnerability CVE-2026-6730 - On 23 September 2026, IBM reported CVE-2026-6730, a critical buffer overflow vulnerability affecting IBM Concert. The vulnerability impacts versions 1.0.0 through 3.0.0 of the product.

Successful exploitation of this vulnerability could allow an attacker to achieve arbitrary code execution on the affected system.

ManageEngine Patches CVE-2026-12370 SSTI Vulnerability Enabling Remote Code Execution Across Multiple Network Management Products - On 23 September 2026, Zoho patched CVE-2026-12370, a high-severity vulnerability affecting multiple ManageEngine products. Affected products include ManageEngine OpManager, OpManager Nexus, OpManager MSP, NetFlow Analyzer, and Network Configuration Manager.

CVE-2026-12370 is a server-side template injection vulnerability in Configlet processing that could enable remote code execution. Exploitation requires low privileges but no user interaction.

Potential Threats

Threat Actor Uses AI Harnesses to Compromise Online Retailers and Steal Payment-Card Data - On 22 September 2026, Gambit Security reported a financially motivated campaign in which a threat actor used the open-source AI agent tools Strix, Cairn, and Hermes to compromise online retailers, initiating 105 attack projects and compromising at least 27 organisations between 10 and 15 September 2026. Hermes served as the primary console, configured with a Chinese red-team persona and a skill to remove its content-security filters. Strix handled vulnerability discovery, while Cairn acted as an autonomous exploitation engine. In one intrusion, Cairn chained SQL injection, an MFA bypass via a plaintext OTP, an unvalidated file upload, sudo abuse, and a misconfigured NFS export to reach AWS Secrets Manager and decrypt payment-card data from the victim's Magento database.

The campaign exfiltrated more than 600,000 unexpired payment-card records from two organisations. Skimmers remained active on 19 named victims, with more than 100 additional sites found infected, deployed through modified JavaScript libraries, checkout page injection, S3 bucket poisoning, Kubernetes initContainers, and server-side cache injection. The actor concealed skimmers through timestamp restoration and Base64 encoding, and directed agents to wipe payment tables after extraction. Recorded Future assesses the activity at Level 4 (Transforming) on its AI Malware Maturity Model (AIM3), as the agents operated largely autonomously while the actor still selected targets and provided direction.

Custom ChatGPTs push ClickFix attacks to deploy RAT malware - Huntress has identified a campaign in which custom ChatGPT variants, promoted through sponsored Google results, direct users to malicious sites using ClickFix attacks to deliver malware. The threat actor published a malicious custom GPT named "Plus 5.6", which directed users to an alleged backup site on Google Sites displaying a fake Cloudflare check. Visitors were instructed to run a PowerShell command that installs a malicious MSI, launching a legitimate signed application alongside a modified DLL to load the payload. Hosting the lure on the legitimate ChatGPT.com domain lends it credibility, and the use of custom GPTs marks a novel evolution of earlier ClickFix campaigns abusing shared ChatGPT conversations. Of at least 40 incidents linked to the Google Sites page, two were confirmed to involve a custom GPT. OpenAI removed the first GPT by 25 September, but a second found on 27 September remained active at the time of reporting.

The payload is a remote access trojan (RAT) capable of remote desktop access, audio and camera capture, file searches, host reconnaissance, and execution of additional payloads. Persistence is achieved via a Registry Run key and scheduled task, both named "Canon Configuration Reader". Later attacks switched to a Stardock-signed host application and altered loader delivery, although the payload remained unchanged. The attackers also used a custom encrypted file system to conceal the persistence script and RAT. Huntress recommends process-based detections, including PowerShell silently launching an MSI from the temporary folder via msiexec.exe, signed applications executing from unusual folders under %LOCALAPPDATA%\Programs, and Run values and scheduled tasks that reappear after deletion.

Actively Exploited Remote File Inclusion Vulnerability Affecting Unpatched Branches of WordPress Core (CVE-2026-87902) - On 22 September 2026, Patchstack published a technical report detailing active exploitation of CVE-2026-87902, which it expanded in a 23 September update to describe PEAR-related probing and attempts to write PHP files. Its timeline records the first observed probe at 11:49 UTC and the first file-write attempt at 15:34 UTC on 22 September. On the same day, a security researcher shared an alleged proof-of-concept (PoC) exploit for the vulnerability. On 25 September 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-87902 to its Known Exploited Vulnerabilities (KEV) catalogue.

CVE-2026-87902 is a critical Remote File Inclusion vulnerability affecting unpatched branches of WordPress Core, the foundational software of the WordPress content management system that provides the built-in functions used to create, publish, and manage websites and their content. Exploitation allows a remote, unauthenticated threat actor to make WordPress load and execute readable PHP files located outside the active theme directories. When additional server conditions are met, this enables the execution of threat actor-controlled PHP code with the privileges of the website's server account, without user interaction. On 22 September 2026, WordPress published an advisory listing the affected versions and their respective patched releases.

General News

Cyberattack hits Welsh police force, may have affected staff data - Dyfed-Powys Police in Wales said on Friday that a cyberattack affecting the force had disrupted some non-emergency systems and may have compromised staff information. The force identified the incident earlier this month and has found no evidence that information belonging to members of the public was affected, although it is still investigating whether employee information was accessed or compromised. Dyfed-Powys Police covers south-west Wales and has more than 2,000 officers and staff.

Tarian, the regional organised crime unit for southern Wales, is leading the investigation with support from cyber security specialists. The police did not disclose how the breach occurred or what staff data may have been involved, and no group had claimed responsibility at the time of reporting. A spokesperson acknowledged the potential concern the incident may cause and said the force was taking steps to protect its information and systems.

Dutch police confirm arrest in ShinyHunters hacking investigation - Dutch police have confirmed that a 24-year-old man from Amsterdam, arrested earlier this month, was detained as part of an investigation into the ShinyHunters hacking group, with the suspect due to appear before the Rotterdam District Court on 29 September. He was previously arrested in January 2023 and charged with hacking and extorting more than a dozen companies in the Netherlands and worldwide, later pleading guilty and receiving a four-year sentence, with one year suspended, followed by a three-year probationary period. According to DataBreaches, he was arrested again on 15 September when a Dutch tactical police unit searched his Amsterdam home and seized electronic devices.

KrebsOnSecurity reports that authorities are examining a possible link to ShinyHunters, noting that the suspect's former alias referenced the Pokémon character Umbreon, which ShinyHunters recently used in its claimed FBI breach and its defacement of the Clop ransomware gang's leak site. However, the same character appeared in a 2020 HackForums defacement, a year before the suspect created his account using that alias. Dutch police had previously released a recording of a Dutch-speaking man suspected of involvement in the Odido hack, who allegedly posed as IT staff to trick a help desk employee into entering credentials and a verification code into a fake login page. DataBreaches, which has spoken to the suspect on several occasions, said the voice did not sound like him, and a ShinyHunters representative denied any association with the individual.

Microsoft Disrupts AI-Powered EvilTokens Cybercrime Platform Linked to More Than 12,000 Compromised Inboxes - On 22 September 2026, Microsoft reported that it had disrupted EvilTokens, an AI-enabled cybercrime platform used to compromise email accounts and support downstream financial fraud. Since its launch in February 2026, EvilTokens has been linked to more than 12,000 compromised inboxes across over 10,000 organisations worldwide, with the highest concentrations observed in the US, Canada, the UK, Australia, India, and France. Microsoft and Health-ISAC worked with Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation, TRM Labs, and law enforcement partners to disrupt the operation, seizing 50 websites used to run the platform and disabling more than 150 related domains. In the UK, the Metropolitan Police Service arrested two unidentified men on 11 September 2026 in connection with the alleged operation.

EvilTokens reportedly used device-code phishing to trick victims into entering authentication codes on Microsoft's legitimate sign-in page, granting threat actors access to email accounts without stealing passwords. Once inside an inbox, the service's AI chatbot could summarise and translate emails, identify trusted relationships, locate payment and invoice discussions, map organisational roles, and recommend fraud opportunities, including who to impersonate and how to craft convincing follow-up messages. The service was sold via Telegram for a $1,500 initiation fee and a $500 recurring subscription, packaging account compromise, mailbox analysis, target selection, and fraud preparation into a single commercial offering that lowers the technical and operational barriers for financially motivated threat actors.

Threat Actor Weekly Graph

Over the past 7 days, we have been tracking the following intent and opportunity changes within our Threat Actor Landscape.

Intent represents the potential targets of a group. When a group is observed attacking a different organisation or entity, their intent will increase.

Opportunity represents the various methods and technologies these groups may use. For example, if a group started using a new attack vector, such as a new kind of ransomware, their opportunity would increase.

Both intent and opportunity are scored out of 100 and are responsible for scoring the group's severity. These updates can be seen below.