Inferlume

How it Works

Reports

Pricing

About

Get Free Access →

Get Free Access

Last Updated On

Monday, September 14, 2026

CCTTII--22002266--00991144

CCrriittiiccaall

AAccttiivvee EExxppllooiittaattiioonn CCoonnffiirrmmeedd

Your GitLab Secrets Are Already Being Read Tonight

Critical bugs hit immediate weaponization, led by a CVSS 10.0 GitLab flaw reaching active exploitation in roughly a day. Meanwhile, active bypasses in ScreenConnect, JFrog, and Windows leave systems exposed to SYSTEM-level compromises.

Threat group UNC3569 is weaponizing a popular Chinese input app into a malware loader across widespread Windows devices. Elsewhere, millions of records from Mathspace and IDScan are leaking alongside extorted Berlin government files.

Remediate immediately by patching GitLab, ScreenConnect, Artifactory, and Windows ahead of other exposed devices. Finally, actively hunt for suspicious authentications and rotate every credential stored on affected internet-facing hosts.

CVSS Score

247

IOC Count

Source Count

Confidence Score

CVEs

CVE-2026-85706, CVE-2026-84869, CVE-2026-42016, CVE-2026-42018, CVE-2026-82329, CVE-2026-67276, CVE-2026-67277, CVE-2026-86060, CVE-2026-85880, CVE-2026-81963, CVE-2026-51990, CVE-2026-72898, CVE-2026-0310, CVE-2026-84393, CVE-2026-19490, CVE-2026-20079, CVE-2026-85102, CVE-2026-85103, CVE-2026-86218, CVE-2026-85046, CVE-2026-87491, CVE-2025-53521

Actors

UNC3569, Storm-3121, Storm-3032, UNC6671, Rhysida, ShinyHunters claimed, multiple unattributed cybercrime actors, Under Attribution

Sectors

Technology, Software Development, Managed Service Providers, IT Services, Network Infrastructure, Telecommunications, Education, Identity Verification, Government Services, Financial Services, Government, Defense, Critical Infrastructure, Healthcare, Cloud Services, Retail, Hospitality, Transportation, NGOs, Aerospace

Regions

Global, China, Chinese speaking regions, Australia, New Zealand, North America, United States, Canada, Europe, United Kingdom, Asia Pacific

Chapter 01 - Executive Overview

What happened in this window is a stacked exploitation surge, not a single bug. Consulted sources show a CVSS 10.0 GitLab file read that went from patch to KEV in about 24 hours, a ScreenConnect client bug worming since 2026-08-20, a three flaw JFrog Artifactory chain that yields admin and Rust backdoors, two Microsoft elevation zero days exploited before Patch Tuesday, MikroTik MikroTrick taking SSH or btest exposed routers to admin, and UNC3569 turning Sogou Input Method into a one click GRAYRABBIT loader. Around that core sit a Metabase CVSS 10.0 breach at Mathspace, an IDScan dataset of about 153 million licenses, a Rhysida dump of about 1.44 million Berlin government files, Cisco FMC and Citrix KEV listings, an NCSC warning that Check Point VPN RCEs are imminent, BlueMoon browser to SYSTEM chaining, N-central leftover KEV exposure, a memory resident F5 rootkit, and passkey themed Microsoft 365 theft.

So what: any internet reachable GitLab, Artifactory, ScreenConnect, MikroTik SSH, Metabase, FMC, or NetScaler instance is already inside a confirmed exploit window. JFrog compromise is a software supply chain event because poisoned artifacts and stolen join keys outlive the first patched box. Sogou gives a nation aligned actor a civilian scale implant path. IDScan and Berlin leaks move the window from intrusion into identity fraud and political extortion. ShieldCrash means a fully patched Windows estate can still yield SYSTEM file read if Defender context is abused.

[+] Prioritize now, GitLab: Upgrade self managed CE/EE to 19.1.8, 19.2.6, or 19.3.2+. Hunt commits API requests with file.path traversal. Rotate SSH keys, deploy tokens, CI/CD variables, and database secrets on any instance that was reachable while unpatched.

[+] Prioritize now, Microsoft: Deploy the 2026-09-08 Patch Tuesday set for CVE-2026-85880 and CVE-2026-81963 and reboot. Treat ShieldCrash as unpatched. Use WDAC or AppLocker to constrain unsigned execution from MsMpEng.exe context.

[+] Prioritize now, ScreenConnect: Upgrade clients to 26.6.5. Hunt wscript.exe plus 1.vbs through 4.vbs and file transfers without Host confirmation. Isolate technician endpoints that show worm like reuse.

[+] Prioritize now, JFrog: Patch all three Artifactory CVEs. Rotate join keys and tokens issued since late August. Audit admin users, Groovy plugins, webshells, Rust binaries, and writes under /dev/shm, /tmp, and /var/tmp.

[+] Prioritize now, MikroTik: Upgrade to 6.49.21, 7.23.4, 7.24.2, or 7.25b3. Restrict SSH to management networks. Disable btest if unused.

[+] Prioritize now, Sogou: Upgrade to 16.3.0.3498+. Block the sgbiz: handler. Hunt 7zp.dll sideload and raw TCP 443 RC4 beacons.

[+] Prioritize now, Metabase: Upgrade to x.58.24, x.59.21, x.60.17, x.61.11, x.62.9, x.63.5+ and hunt unauthorized admin accounts.

[+] Prioritize now, edge and RMM: Patch Cisco FMC, Citrix NetScaler, N-able N-central, and Check Point R82.10 / R82 / R81.20. Pin Check Point UDP/500 and UDP/4500 to known peers if the patch is delayed.

[+] Prioritize now, identity and cloud: Review Microsoft 365 authentication method additions, device code use, and Graph plus SharePoint collection. Assume IDScan scanned licenses may be circulating and tighten fraud controls.

Chapter 02 - Threat & Exposure Analysis

GitLab CVE-2026-85706 is the cleanest maximum severity story in the window. Missing authentication enforcement and broken path confinement on /api/v4/projects/{id}/repository/commits let an unauthenticated caller supply file.path values with ../ or encoded traversal and read files outside the repository sandbox. Consulted sources say one public project on the target instance is enough. A single request can return SSH keys, database credentials, deploy tokens, CI/CD variables, gitlab.rb, and similar host files. GitLab assigned CVSS 10.0. Affected ranges are 18.7 through less than 19.1.8, 19.2 through less than 19.2.6, and 19.3 through less than 19.3.2, with 19.3.1 treated as last vulnerable per GitLab language. The vendor patched on 2026-09-10 in 19.1.8, 19.2.6, and 19.3.2. watchTowr saw honeypot probes about 06:00 UTC on 2026-09-11. CISA added KEV the same cycle and set a BOD 26-04 date of 2026-09-14, with some coverage treating 2026-09-15 as the operational close. GitLab.com is patched by the vendor. Self managed internet facing CE/EE remains the problem. Activity looks like opportunistic mass scanning. No named actor. No public attacker IP package.

Microsoft’s September 2026 Patch Tuesday is a parallel SYSTEM elevation event, not a side note. Consulted sources put the release at about 974 CVEs, 106 Critical, and about 20 additional unauthenticated RCE flaws. CVE-2026-85880 is a heap based buffer overflow in Advanced Local Procedure Call that takes a local attacker to SYSTEM and can escape AppContainer. CVE-2026-81963 is Update Stack elevation through incorrect link or path resolution, also to SYSTEM. Both were exploited before 2026-09-08. CISA KEV dates in consulted sources run to 2026-09-22. On 2026-09-09 Nightmare Eclipse published ShieldCrash, the third Malware Protection Engine bypass in four months. It performs arbitrary file read as SYSTEM on Windows 10, Windows 11, and Windows Server that already have the September updates. No CVE. No patch. No vendor timeline. Compensating control is application control, not hope.

ConnectWise ScreenConnect CVE-2026-84869 turned remote support into a propagation fabric. The client fails to enforce authorization during an active session, so a guest or modified client can write a file to host temp and execute it without Host confirmation. Huntress tracks abuse since 2026-08-20. Consulted sources describe modified clients looking for live sessions and launching wscript.exe against 1.vbs, 2.vbs, 3.vbs, and 4.vbs to recon, disable security tools, stage payloads, and persist via Run\WindowsServiceHost. CVSS 9.9. Fixed in 26.6.5. CISA KEV deadline 2026-09-14. MSPs and technician endpoints are the blast radius because the next customer session is the next hop.

JFrog Artifactory is the supply chain fracture. CVE-2026-42018 returns an internal anonymous JWT from POST /access/api/v1/aws/token/ even when anonymous access is disabled. CVE-2026-42016 accepts that token at /access/api/v1/tokens and issues admin scope because signature and issuer are checked and scope is not. CVE-2026-82329 forges admin tokens without the first two steps. Wiz watched chaining from 2026-08-15 to 2026-09-08, with CVE-2026-82329 also seen from 2026-09-01. CVE-2026-42016 was patched 2026-07-27 and CVE-2026-42018 on 2026-08-12, yet consulted telemetry still found about 59 percent and 62 percent of scanned instances vulnerable. Post exploitation includes new admin users, attacker SSH keys on those users, Groovy plugins, webshells, Rust C2, stolen cluster join keys, repository and token enumeration, and payload drops in /dev/shm, /tmp, and /var/tmp. CISA KEV federal date 2026-09-25. A compromised artifact server poisons every downstream build that trusts it.

MikroTik MikroTrick is two related takeover paths that consulted sources treat as one campaign. CVE-2026-67276 describes SSH public key verification that compares type and modulus and skips the exponent, so an attacker who knows the authorized modulus forges a signature with exponent=1 and lands passwordless SSH as that user, then escalates to admin. CVE-2026-67277 is unauthenticated btest on TCP/UDP 2000 that discloses kernel memory or reboots the box when packet size underflows. CVE-2026-86060 injects command arguments and rewrites the trusted policy mask, completing admin. Affected RouterOS includes 6.0.0 through 6.49.20, 7.0.0 through 7.23.3, and 7.24 through 7.24.1. Fixed in 6.49.21, 7.23.4, 7.24.2, and 7.25b3. CERT Polska disclosed 2026-09-05. CISA KEV date 2026-09-13. Internet exposed SSH or btest equals a pivot router.

UNC3569 is the named espionage line. Consulted sources tie the set to a PRC nexus and to GRAYRABBIT since at least 2024 Google TAG profiling. CVE-2026-51990 chains an unvalidated sgbiz: URI handler, unrestricted CEF navigation, and unsandboxed Chromium 80 V8 type confusion CVE-2021-38003. One click yields code execution. GRAYRABBIT loads through 7zp.dll, speaks RC4 over raw TCP 443, and ships plugins for shell, file upload, system information, and self terminate. Sogou 16.3.0.3498 auto updates the handler. Researchers warn Chromium 80 inside the product remains old and unsandboxed. Scale is hundreds of millions of Windows installs in China and diaspora. KEV listing was not confirmed.

Metabase CVE-2026-72898 is CVSS 10.0 unauthenticated SQL injection through the reset password path, including /api/session/properties. Admin takeover dumps the application database and connected sources. Mathspace disclosed on 2026-09-13 that 1,079,819 students, parents, teachers, and staff in Australia and New Zealand were exposed, including names, emails, hashed passwords, and usage analytics. Patched Metabase trains include x.58.24, x.59.21, x.60.17, x.61.11, x.62.9, and x.63.5+. No actor name.

IDScan.net detected unauthorized access around 2026-09-01. A Nexus marketplace listing advertised about 153 million scans, including roughly 1.1 million Canadian records, 10 million ID cards, 3 million travel documents, and 579 thousand medical cards. The company confirmed a third party may have accessed or copied names and government ID numbers and stopped short of verifying the 153 million figure. FBI New Orleans interest is reported. Nine class actions landed around 2026-09-02 to 2026-09-04. ShinyHunters claimed an adjacent Florida DMV hack. That claim stays uncorroborated. Initial access vector is not confirmed.

FortiOS CVE-2026-84393 is a CVSS 7.3 ZTNA certificate validation bypass that enables MITM. No exploitation evidence. Upgrade 7.6.7+. PAN-OS CVE-2026-0310 is a CVSS 9.2 XML buffer overflow to root RCE on PA-Series. Palo Alto Networks reported no known exploitation as of 2026-09-09. Restrict management interfaces.

Check Point CVE-2026-85102 fails certificate trust checks during VPN negotiation and yields unauthenticated RCE on Quantum Security Gateway and Spark. CVE-2026-85103 is an ASN.1 decoder heap overflow on gateway and management server. Both CVSS 9.8. Patched 2026-09-10 for R82.10, R82, and R81.20. LivePatch Take 24 and sk1000117 style pinning of UDP/500 and UDP/4500 are the delay controls. Dutch NCSC warned on 2026-09-12 that large scale attempts are imminent. This window had no confirmed exploitation.

Cisco FMC CVE-2026-20079 is CVSS 10.0 authentication bypass in the web interface. Crafted HTTP requests reach root OS command execution. Consulted sources say exploitation since 2026-08 by state sponsored and financially motivated actors, with credential theft and Qilin deployment on managed estates. Affected FMC 7.0.0 through 7.0.5 and Security Cloud Control Firewall Management. No workaround. CISA KEV from 2026-09-09. Citrix NetScaler CVE-2026-19490 is CVSS 9.3 and KEV from 2026-09-09. Public mechanics stayed thin.

N-able N-central CVE-2026-86218 is CVSS 10.0 pre auth static code injection fixed in Hotfix 4 / 2026.3.1.14 around 2026-09-05 to 2026-09-06. CISA KEV federal date 2026-09-11 already lapsed. Hunt unauthorized accounts.

BlueMoon, per Proofpoint, chains Chrome V8 CVE-2026-85046 type confusion, CVE-2026-87491 WebAssembly sandbox escape, and Windows CVE-2026-85880 ALPC elevation to SYSTEM. Delivery is phishing. Four mostly China aligned espionage clusters used the kit against NGOs, aerospace, and governments. Chrome dates are 2026-09-03 and 2026-09-08. KEV dates in consulted sources are 2026-09-18, 2026-09-22, and 2026-09-23.

Rhysida published about 1.44 million Berlin state government files on 2026-09-04 after a failed roughly €2 million demand. Content includes internal mail, airport drone security assessments, personnel files, defense contractor documents, passwords, and citizen data. Separate from the CVE wave, it is part of the same 24 hour decision cycle for government and contractor defenders.

Sophos describes a Linux rootkit on compromised F5 BIG-IP APM devices that injects a fileless web shell into process memory. It intercepts PHP loads, decrypts crafted requests, evals them, and returns HTTP 201 bodies dressed as CSS. Investigators suspect second stage after CVE-2025-53521, the RCE patched March 2026. Reboot clears memory resident code. Patch and memory inspection are required.

Passkey themed Microsoft 365 activity uses helpdesk impersonation, SMS and voice lures, adversary in the middle or device code phishing, then attacker registered authentication methods, Graph enumeration, and SharePoint, OneDrive, and Exchange collection. Microsoft associates Storm-3121 and Storm-3032, with overlap to UNC6671. This is identity compromise, not a Windows CVE.

Revolut and Telus reporting in consulted sources points to possible personal, financial, subscriber, and billing exposure adjacent to identity proofing and telecom customer data. Populations and regulator notices were not complete in those sources.

Chapter 03 - Operational Response

[+] Immediate 0 to 4 hours, GitLab: Patch self managed CE/EE to 19.1.8, 19.2.6, or 19.3.2+. If delayed, block or challenge unauthenticated access to /api/v4/projects/*/repository/commits at WAF or reverse proxy.

[+] Immediate 0 to 4 hours, Microsoft: Install September 2026 updates for CVE-2026-85880 and CVE-2026-81963 and reboot. Deploy WDAC or AppLocker to blunt ShieldCrash style unsigned execution from Defender context.

[+] Immediate 0 to 4 hours, ScreenConnect: Upgrade clients to 26.6.5. Disable file transfer until the estate is current. Isolate technician hosts with unexpected wscript.exe activity.

[+] Immediate 0 to 4 hours, Sogou: Upgrade to 16.3.0.3498+. Block sgbiz: via Group Policy or MDM on China and diaspora Windows fleets.

[+] Immediate 0 to 4 hours, MikroTik: Restrict SSH to management networks. Disable btest. Upgrade to 6.49.21, 7.23.4, 7.24.2, or 7.25b3.

[+] Immediate 0 to 4 hours, Cisco FMC and Citrix: Patch with no workaround assumed. Isolate management interfaces from the open internet.

[+] Immediate 0 to 4 hours, Check Point: Apply R82.10 / R82 / R81.20 updates or LivePatch Take 24. Disable implied VPN rules and pin UDP/500 and UDP/4500 to known peers.

[+] Short term 24 to 72 hours, JFrog: Patch CVE-2026-42016, CVE-2026-42018, and CVE-2026-82329. Target fixed trains 7.111.21+, 7.117.28+, 7.125.20+, 7.133.29+, 7.146.38+, or 7.161.20+ as listed in consulted advisories. Rotate join keys and every token issued since late August.

[+] Short term 24 to 72 hours, Metabase: Upgrade to the patched x.58.24 through x.63.5+ trains. Hunt unknown admin accounts and rotate application secrets.

[+] Short term 24 to 72 hours, credential rotation: Rotate secrets on any internet reachable GitLab, Artifactory, ScreenConnect, MikroTik, FMC, or Metabase instance that was unpatched in the exposure window.

[+] Short term 24 to 72 hours, Artifactory integrity: Audit admin users, Groovy plugins, webapp directories, authorized_keys on new accounts, and files in /dev/shm, /tmp, and /var/tmp.

[+] Short term 24 to 72 hours, N-central: Confirm Hotfix 4 / 2026.3.1.14 and hunt unauthorized accounts because the federal date already lapsed.

[+] Short term 24 to 72 hours, Chrome and Windows for BlueMoon: Confirm stable channel builds that include CVE-2026-85046 and CVE-2026-87491 plus the ALPC update.

[+] Short term 24 to 72 hours, Microsoft 365: Review new authentication methods, disable device code where unused, revoke odd OAuth grants, and force session reset on risky tenants.

[+] Medium term 1 to 2 weeks, segmentation: Split SSH, ZTNA, VPN, FMC, and artifact networks from general user access.

[+] Medium term 1 to 2 weeks, URI handler control: Allowlist custom handlers such as sgbiz: and peer collaboration schemes through MDM.

[+] Medium term 1 to 2 weeks, MSP review: Require patch attestation from ScreenConnect and other RMM providers. Treat technician endpoints as tier zero.

[+] Medium term 1 to 2 weeks, supply chain: Require artifact signing and SLSA style verification for anything that left a formerly exposed Artifactory.

[+] Medium term 1 to 2 weeks, F5: Patch residual CVE-2025-53521 exposure, reboot APM devices to clear memory resident code, and inspect PHP process memory for eval style web shells.

[+] Medium term 1 to 2 weeks, identity fraud: If IDScan scanned your customers, raise monitoring for synthetic identity and account opening abuse. Review KYC vendor retention of government ID images.

[+] Medium term 1 to 2 weeks, Berlin contractors: Review whether leaked airport, defense, or personnel documents change your threat model or password reuse exposure.

[+] 2026-07-27: JFrog patches CVE-2026-42016.

[+] 2026-08-12: JFrog patches CVE-2026-42018.

[+] 2026-08-15: Wiz first sees Artifactory chaining.

[+] 2026-08-20: ScreenConnect CVE-2026-84869 exploitation begins.

[+] 2026-08 month: Cisco FMC CVE-2026-20079 exploitation begins in consulted sources.

[+] 2026-09-01: IDScan detects access. Nexus listing appears. Berlin intrusion date in consulted sources. CVE-2026-82329 exploitation window opens in Wiz telemetry.

[+] 2026-09-03: Chrome patches CVE-2026-85046.

[+] 2026-09-04: Rhysida publishes about 1.44 million Berlin files. IDScan public notice and class actions begin. CVE-2026-82329 KEV addition in one consulted timeline.

[+] 2026-09-05: CERT Polska discloses MikroTik flaws. N-central Hotfix 4 ships around 2026-09-05 to 2026-09-06.

[+] 2026-09-08: Microsoft Patch Tuesday, about 974 CVEs, exploited zero days CVE-2026-85880 and CVE-2026-81963. Chrome patches CVE-2026-87491. Microsoft pair enters KEV in consulted sources.

[+] 2026-09-09: ShieldCrash proof of concept published. Cisco FMC and Citrix NetScaler KEV additions in consulted sources. Passkey campaign reporting active.

[+] 2026-09-10: GitLab patches CVE-2026-85706. Gen Threat Labs publishes Sogou / UNC3569 analysis. Check Point patches CVE-2026-85102 and CVE-2026-85103. Wiz publishes Artifactory exploitation.

[+] 2026-09-11: watchTowr sees GitLab probes. CISA adds GitLab, ScreenConnect, JFrog token pair, and MikroTik items across consulted timelines. ConnectWise patched client coverage lands. N-central federal date lapses.

[+] 2026-09-12: Dutch NCSC warns Check Point exploitation is imminent. Additional KEV coverage of Artifactory, ScreenConnect, and MikroTik in some timelines.

[+] 2026-09-13: Mathspace discloses Metabase breach. MikroTik federal date in consulted sources. Public GitLab proof of concept repositories noted.

[+] 2026-09-14: GitLab and ScreenConnect federal dates in consulted sources. This window closes 21:27 IST.

[+] 2026-09-15: Some consulted coverage treats this as the operational GitLab KEV close.

[+] 2026-09-18 to 2026-09-23: BlueMoon component KEV dates in consulted sources.

[+] 2026-09-22: Microsoft zero day KEV date in consulted sources.

[+] 2026-09-25: JFrog Artifactory KEV date.

Chapter 04 - Detection Intelligence

[+] GitLab CVE-2026-85706 root cause: The repository commits API takes a user controlled path, does not confine that path to the repository root, and under stated conditions does not require authentication. One public project on the target instance is enough. A single GET or POST to /api/v4/projects/{id}/repository/commits with file.path set to a traversal or an absolute host path returns file bytes in the HTTP body.

[+] GitLab conversion path: A read of SSH keys, deploy tokens, CI/CD variables, gitlab.rb, or database.yml becomes estate compromise through credential reuse. Consulted sources treat that conversion as hours, not a leisurely rotation cycle.

[+] GitLab request shape:

GET /api/v4/projects/123/repository/commits?path=../../../../etc/ssh/sshd_config HTTP/1.1
Host: gitlab.example[.]

[+] GitLab version bound: Affected trains are 18.7 through less than 19.1.8, 19.2 through less than 19.2.6, and 19.3 through less than 19.3.2. Treat 19.3.1 as last vulnerable per vendor language. Fixed builds are 19.1.8, 19.2.6, and 19.3.2+. GitLab.com is patched by the vendor. Self managed internet facing CE/EE remains the exposed class.

[+] JFrog Artifactory chain: CVE-2026-42018 returns an internal anonymous JWT from POST /access/api/v1/aws/token/ even when anonymous access is disabled. The trailing slash variant is the working tell. CVE-2026-42016 exchanges that JWT at POST /access/api/v1/tokens for admin scope because signature and issuer are checked and scope is not. CVE-2026-82329 forges admin without the first two steps.

[+] JFrog post exploit: New admin users, attacker SSH keys on those users, Groovy plugins that execute as the service, webshells in the webapp tree, Rust C2, stolen cluster join keys, repository and token enumeration, and payload drops in /dev/shm, /tmp, and /var/tmp. Wiz observed the chain from 2026-08-15 through 2026-09-08. Consulted telemetry still found about 59 percent of instances open to CVE-2026-42016 and about 62 percent open to CVE-2026-42018.

[+] JFrog flow:

[+] ScreenConnect CVE-2026-84869 root cause: During an active remote session the client does not enforce Host confirmation on file transfer and execution. A modified client or guest writes a payload to host temp and launches it in the session user context, often administrator.

[+] ScreenConnect worm behavior: Consulted sources describe wscript.exe launching 1.vbs, 2.vbs, 3.vbs, and 4.vbs to recon, weaken local controls, stage follow on code, and persist as Run\WindowsServiceHost. Abuse is tracked from 2026-08-20. Fixed client train is 26.6.5. The next technician session is the next hop.

[+] MikroTik SSH path: Public key verification compares key type and modulus and skips the exponent. An attacker who knows an authorized modulus builds a keypair with that modulus and exponent=1. Verification passes. The session is passwordless as that user. Local policy then yields admin. This is CVE-2026-67276 chained with CVE-2026-86060.

[+] MikroTik btest path: CVE-2026-67277 exposes bandwidth test on TCP/UDP 2000 without authentication. Related connections can disclose kernel memory. Packet size underflow can reboot the box. CVE-2026-86060 then rewrites the trusted policy mask through command argument injection.

[+] MikroTik version bound: Affected RouterOS includes 6.0.0 through 6.49.20, 7.0.0 through 7.23.3, and 7.24 through 7.24.1. Fixed builds are 6.49.21, 7.23.4, 7.24.2, and 7.25b3.

[+] Sogou CVE-2026-51990 chain: The sgbiz: handler takes unvalidated command line arguments and hands an attacker URL to an unsandboxed CEF webview built on Chromium 80. CVE-2021-38003 V8 type confusion runs in that renderer. Escape is cheap because the embed is not sandboxed. Code execution loads GRAYRABBIT through 7zp.dll. Sogou 16.3.0.3498 updates the handler. Researchers warn the embedded Chromium 80 remains old.

[+] GRAYRABBIT internals: Modular C++ RAT used by UNC3569. C2 is raw TCP 443 with RC4. Plugins cover shell, file upload, system information, and self terminate. Mutexes follow a Global{GUID} pattern. Consulted sources overlap current infrastructure with 2023 to 2024 family campaigns.

[+] Metabase CVE-2026-72898: Unauthenticated SQL injection in the reset password flow, including /api/session/properties. UNION SELECT against core_user yields credentials and admin. Connected data sources follow. Mathspace impact is 1,079,819 student, parent, teacher, and staff records. Patched trains include x.58.24, x.59.21, x.60.17, x.61.11, x.62.9, and x.63.5+.

[+] Metabase payload concept:

{
  "email": "attacker@example[.]

[+] Microsoft CVE-2026-85880: Heap overflow in Advanced Local Procedure Call. Local code reaches SYSTEM and can leave AppContainer. BlueMoon uses this as the last hop after two Chrome V8 bugs.

[+] Microsoft CVE-2026-81963: Windows Update Stack resolves a link or path incorrectly. A local actor follows that object to SYSTEM. Both zero days were exploited before 2026-09-08.

[+] ShieldCrash: Third Malware Protection Engine bypass in four months. Arbitrary file read as SYSTEM on Windows 10, Windows 11, and Windows Server that already have September updates. No CVE. No patch in consulted sources. Control is application allowlisting around MsMpEng.exe spawned content.

[+] BlueMoon: CVE-2026-85046 gives V8 type confusion inside the sandbox. CVE-2026-87491 corrupts WebAssembly metadata and escapes the sandbox. CVE-2026-85880 elevates to SYSTEM. Delivery is phishing into the Chrome patch gap. Proofpoint describes use by multiple mostly China aligned espionage clusters against NGOs, aerospace, and governments.

[+] Cisco FMC CVE-2026-20079: A boot time system process leaves the web interface able to accept crafted HTTP that skips authentication and runs scripts as root. Consulted sources attach later credential theft and Qilin deployment on managed firewalls. Affected FMC includes 7.0.0 through 7.0.5 and Security Cloud Control Firewall Management. No workaround.

[+] Check Point CVE-2026-85102: Bad certificate trust data during VPN negotiation yields unauthenticated RCE on Quantum Security Gateway and Spark.

[+] Check Point CVE-2026-85103: ASN.1 certificate decoder heap overflow yields RCE on gateway and management. Both score CVSS 9.8. Patched 2026-09-10 for R82.10, R82, and R81.20. Dutch NCSC warned on 2026-09-12 that a mass wave is imminent. This window had no confirmed exploitation.

[+] Citrix CVE-2026-19490: KEV confirmed exploitation of NetScaler ADC/Gateway. Public mechanics stayed thin in consulted sources. Treat internet facing management as hostile until patched.

[+] N-able N-central CVE-2026-86218: Pre auth static code injection, CWE-96, CVSS 10.0. Fixed in Hotfix 4 / 2026.3.1.14. Vendor and KEV reporting say exploitation occurred. Unauthorized console accounts are the first artifact.

[+] FortiOS CVE-2026-84393: ZTNA certificate validation bypass enables MITM. CVSS 7.3. No exploitation evidence. Upgrade 7.6.7+.

[+] PAN-OS CVE-2026-0310: XML buffer overflow to root RCE on PA-Series. CVSS 9.2. No known exploitation as of 2026-09-09. Restrict management interfaces.

[+] F5 memory rootkit: After suspected CVE-2025-53521, a Linux rootkit hooks PHP loaders in APM processes, decrypts a crafted request, evals it, and answers HTTP 201 with a CSS content type. Disk scanners miss it. Reboot clears the resident stage.

[+] Passkey campaign: Helpdesk voice or SMS lure, lookalike sign in, adversary in the middle or device code, attacker registered authentication method, Graph enumeration, then SharePoint, OneDrive, and Exchange collection. Microsoft associates Storm-3121 and Storm-3032 with overlap to UNC6671.

[+] Combined count: About 247 unique indicators and indicator patterns after deduplication across input versions, including behavioral URIs. The richest named public value set is 44 items before deduplication.

[+] GitLab infrastructure: No named attacker IPs, domains, or payload hashes were published. Detection is the commits API plus file.path plus ../ or %2e%2e%2f or absolute OS paths. About 47 scanning IPs in the broad corpus looked like mass scanners. Verdict Malicious for the pattern, Unknown for specific hosts.

[+] ScreenConnect infrastructure: 1.vbs, 2.vbs, 3.vbs, 4.vbs, wscript.exe, Run\WindowsServiceHost. About 23 C2 domains and 15 payload hashes in the broad corpus. Verdict Malicious.

[+] JFrog infrastructure: Token endpoints /access/api/v1/aws/token/ and /access/api/v1/tokens and /access/api/v1/registry/join. Usernames anonymous and token:anonymous. Staging paths /dev/shm, /tmp, /var/tmp. Defanged published values:

log[.]gitclone[.]org:45678/smtp

3[.]88[.]162[.]79:36789/smtp

64[.]207[.]232[.]6:8443

513a907b69edffc3cb77a494da395178d21ef9bd

[+] JFrog remainder: About 31 C2 IPs plus Groovy, webshell, and Rust hashes in the broad corpus. Verdict Malicious after local correlation.

[+] MikroTik infrastructure: SSH success from outside management subnets. Unauthenticated btest on TCP/UDP 2000. Policy mask change events. About 19 scanning IPs in the broad corpus. Verdict Malicious for the exploit pattern.

[+] UNC3569 / GRAYRABBIT infrastructure: 7zp.dll sideload paths, raw TCP 443 RC4, Global{GUID} mutexes, Run keys, about 14 C2 IPs overlapping 2023 to 2024 family infrastructure, about 9 family hashes. Verdict Malicious.

[+] Metabase / Mathspace infrastructure: /reset_password and /api/session/properties with UNION SELECT against core_user. About 3 associated IPs in the broad corpus. Verdict Malicious for the SQLi pattern.

[+] Passkey infrastructure, defanged:

passkeyhelpdesk[.]com

secure-passkey[.]com

setupmypasskey[.]com

add-passkey[.]com

integratedsso[.]com

oktasession[.]com

keysyncos[.]com

oskeysync[.]com

oskeysetup[.]com

oskeyregister[.]com

syncmykey[.]com

myconnectkey[.]com

oskeyconnect[.]com

validationsetupac[.]com

portalsetuphub[.]com

[+] IDScan infrastructure: Two dark web marketplace URLs and one seller PGP key. Verdict Suspicious. The 153 million figure is seller reported.

[+] Check Point, Citrix, BlueMoon samples, F5 rootkit hashes, FortiOS, PAN-OS: No reliable public atomic package in consulted sources. Verdict Unknown at host level.

[+] Enrichment notes: 34 of 89 broad corpus IPs flagged mass scanner or malicious. 12 of 67 domains resolved to bulletproof hosting in NL, RU, BG, or HK. 28 of 38 SHA256 values exceeded 15/70 detections. TTL guidance is 24 hours for IP and domain reputation, 7 days for hashes, 30 days for CVE metadata. Confirm locally before production blocks.

[+] Sensor rule: Your own logs are the sensor for GitLab, Check Point, Citrix, BlueMoon, and F5. Consulted sources did not publish host packages for those clusters.

[+] GitLab detection: Unauthenticated GET or POST to /api/v4/projects/*/repository/commits when file.path or the query contains ../, %2e%2e%2f, /etc/passwd, .ssh/, gitlab.rb, or database.yml. A 200 from an internet source on an unpatched host is file disclosure. Rotate secrets the same hour.

index=web sourcetype IN (gitlab:production, nginx:access)
| regex uri_path="/api/v4/projects/[^/]+/repository/commits(/|$)"
| regex uri_query="(?i)file\.

[+] JFrog detection: 401 on the bare token path then 200 on the trailing slash path from one client, then anonymous mint, then admin creation, plugin deploy, authorized_keys write, or staging under /dev/shm, /tmp, or /var/tmp.

[+] ScreenConnect detection: FileTransfer true with HostConfirmation false and extensions .exe, .ps1, .bat, .dll, .msi, or .scr, plus wscript.exe spawning numbered VBS files.

[+] Sogou and GRAYRABBIT detection: sogoucloud.exe command line contains sgbiz: and an hxxp:// or hxxps:// destination, then children cmd.exe, powershell.exe, rundll32.exe, or wscript.exe, then 7zp.dll load and RC4 on TCP 443.

rule GRAYRABBIT_Backdoor_Family
{
    meta:
        description = "GRAYRABBIT modular backdoor DLL sideload via 7zp.dll"
        author = "CTI Pipeline"
        date = "2026-09-14"
    strings:
        $dll_sideload = "7zp.dll" ascii wide
        $c2_rc4 = "RC4" ascii wide
        $port_443 = "443" ascii wide
        $plugin_shell = "cmd.exe /c" ascii wide
        $plugin_upload = "UploadFile" ascii wide
        $plugin_sysinfo = "GetSystemInfo" ascii wide
        $self_terminate = "ExitProcess" ascii wide
        $mutex_pattern = "Global\\

[+] Metabase detection: POST to /api/session/properties or /reset_password when the body contains UNION, SELECT, or core_user.

[+] MikroTik detection: SSH admin success from outside approved management subnets, unauthenticated btest connects to TCP/UDP 2000, and policy mask changes.

[+] Microsoft 365 detection: Unusual or unmanaged sign in followed within 30 minutes by a new authentication method, device code use, new OAuth grant, Graph enumeration, or high volume SharePoint, OneDrive, and Exchange access.

[+] Cisco FMC detection: Non browser clients hitting /api/ with HTTP 200 and script, command, or exec parameters, plus later Qilin indicators on managed firewalls.

[+] Check Point detection: VPN negotiation from unknown peers on UDP/500 or UDP/4500 and ASN.1 decode crashes on gateway or management.

[+] F5 detection: PHP processes with injected mappings, HTTP 201 responses with CSS content type, and eval style strings in process memory rather than on disk.

[+] ShieldCrash detection: Unsigned or unexpected execution originating from MsMpEng.exe context after September 2026 updates are already applied.

[+] N-central detection: Unauthorized console accounts created during the unpatched window after the lapsed 2026-09-11 KEV date.

[+] T1190 Exploit Public Facing Application, source mapped: GitLab commits API, JFrog token endpoints, MikroTik btest and SSH exposure, Metabase reset password, ScreenConnect session abuse, Sogou sgbiz: handler, Cisco FMC web interface, Check Point VPN, Citrix NetScaler, N-able N-central. D3FEND: D3-FWA, D3-NAC.

[+] T1133 External Remote Services, source mapped: ScreenConnect live sessions, MikroTik SSH, Check Point VPN, Citrix Gateway. D3FEND: restrict remote services to managed paths.

[+] T1189 Drive by Compromise, inferred: Sogou crafted link loads unrestricted CEF then Chromium 80. Behavioral basis is embedded browser exploitation after one click.

[+] T1204.001 User Execution Malicious Link, inferred: Required click on sgbiz: or a passkey helpdesk URL.

[+] T1566 and T1566.002 Phishing, source mapped for identity and BlueMoon: SMS and voice lures to lookalike pages. D3FEND: phishing resistant authentication.

[+] T1078 Valid Accounts, source mapped: Artifactory anonymous token reuse and later real admin tokens. Stolen GitLab deploy tokens and SSH keys after file read.

[+] T1528 Steal Application Access Token, inferred: Artifactory anonymous JWT theft and Microsoft 365 device code or OAuth theft.

[+] T1098 Account Manipulation, source mapped and inferred: Attacker added Microsoft 365 authentication methods. Artifactory admin creation. T1098.004 inferred where SSH keys were added to new Artifactory accounts.

[+] T1136 Create Account, source mapped: Persistent Artifactory admin and service accounts.

[+] T1059 Command and Scripting Interpreter, source mapped: T1059.001 PowerShell, T1059.003 Windows Command Shell, T1059.004 Unix Shell and Groovy, T1059.007 JavaScript in CEF. D3FEND: D3-ASE, D3-SA.

[+] T1053 Scheduled Task/Job, source mapped for ScreenConnect persistence after the VBScript chain.

[+] T1547.001 Registry Run Keys, source mapped: ScreenConnect Run\WindowsServiceHost and GRAYRABBIT Run keys.

[+] T1574.002 DLL Side Loading, source mapped: GRAYRABBIT as 7zp.dll. D3FEND: D3-DLL, D3-AA.

[+] T1505.003 Web Shell, source mapped: Artifactory post exploit and F5 fileless web shell in process memory. D3FEND: D3-FIM, D3-WFI.

[+] T1055 Process Injection, inferred: F5 memory resident eval and ScreenConnect in session execution.

[+] T1068 Exploitation for Privilege Escalation, source mapped: Windows CVE-2026-85880 and CVE-2026-81963, MikroTik CVE-2026-86060, JFrog scope bypass, Sogou elevation, BlueMoon ALPC stage. D3FEND: D3-PLA, D3-UEBA.

[+] T1210 Exploitation of Remote Services, inferred: MikroTik SSH admin after MikroTrick and ScreenConnect technician to customer pivot.

[+] T1552.001 Credentials in Files, inferred: GitLab arbitrary file read of SSH keys, database credentials, deploy tokens, and CI/CD variables.

[+] T1530 Data from Cloud Storage Object, inferred: GitLab repository and CI secret exposure plus Microsoft 365 SharePoint and OneDrive collection.

[+] T1003.001 LSASS Dumping, inferred: Historical GRAYRABBIT credential access described by Google TAG, not a new dump sample in this window. D3FEND: D3-CDP, D3-LSA.

[+] T1082 System Information Discovery, inferred: GRAYRABBIT sysinfo plugin.

[+] T1087 Account Discovery, inferred: Artifactory user, token, and repository enumeration. Graph enumeration in Microsoft 365.

[+] T1021.004 SSH, source mapped: MikroTik passwordless SSH admin.

[+] T1105 Ingress Tool Transfer, inferred: Payloads written to /dev/shm, /tmp, /var/tmp and ScreenConnect temp.

[+] T1573.001 Symmetric Encrypted Channel, source mapped: GRAYRABBIT RC4 over raw TCP 443. D3FEND: D3-NTA, D3-SSL where lawful.

[+] T1071 Application Layer Protocol, inferred: HTTP API exploit and C2 paths.

[+] T1041 Exfiltration Over C2 Channel, inferred: GRAYRABBIT upload plugin. GitLab file read returns content in the HTTP response.

[+] T1213 Data from Information Repositories, inferred: SharePoint, OneDrive, and Exchange collection.

[+] T1499 Endpoint Denial of Service, inferred: MikroTik btest underflow reboot.

[+] T1070.004 File Deletion, source mapped for GRAYRABBIT self terminate. F5 also avoids disk artifacts.

[+] T1036 Masquerading, source mapped for F5 HTTP 201 CSS replies.

[+] T1027 Obfuscated Files or Information, inferred: Lookalike passkey pages and packed follow on payloads.

[+] T1203 Exploitation for Client Execution, inferred: BlueMoon V8 exploit before ALPC elevation.

[+] Window D3FEND priorities: D3-FWA on GitLab, JFrog, Metabase, Sogou, and FMC paths. D3-AA against GRAYRABBIT sideload and ScreenConnect payloads. D3-NTA for RC4 on 443, odd SSH, Artifactory C2, and unknown VPN peers. D3-FIM on Artifactory plugins, GitLab config, ScreenConnect temp, Metabase databases, and F5 web roots. D3-PLA on GitLab, Artifactory, ScreenConnect, and FMC service accounts.

Chapter 05 - Governance, Risk & Compliance

[+] BOD 26-04 United States federal: Patch KEV items on the catalog clock. Consulted dates: N-central 2026-09-11 already lapsed, MikroTik 2026-09-13, GitLab and ScreenConnect 2026-09-14, BlueMoon components 2026-09-18 / 2026-09-22 / 2026-09-23, Microsoft pair 2026-09-22, JFrog 2026-09-25. Non federal organizations should treat those dates as the working SLA.

[+] GDPR and UK GDPR: 72 hour notification if EU or UK personal data sits inside IDScan, Mathspace, Berlin, Revolut, or Telus scopes once those scopes are verified.

[+] NIS2: 24 hour early warning and 72 hour full report for essential entities when JFrog supply chain, MikroTik telecom edge, Check Point or PAN-OS or FortiOS or FMC critical infrastructure, or ScreenConnect MSP paths are involved.

[+] CIRCIA United States: Identity infrastructure and software supply chain incidents sit inside the proposed 72 hour critical infrastructure reporting frame.

[+] SEC 8-K: Public companies with material vendor impact, including identity processors and build systems, have a four business day clock after materiality is determined.

[+] EU Cyber Resilience Act: Consulted sources mark duties effective 2026-09-11 for products on the EU market. A poisoned Artifactory or GitLab pipeline can create downstream product security reporting.

[+] Patch management policy: Enforce a 24 hour SLA for KEV and actively exploited CVEs. This window had an unusually high catalog count.

[+] MSP and RMM policy: Require written patch attestation for ScreenConnect and peer tools. Technician endpoints are high water access into customer estates.

[+] Software supply chain policy: Classify GitLab and Artifactory as high impact development infrastructure. Sign and verify artifacts. Rotate CI/CD, deploy, signing, and join credentials after suspected file read or admin takeover.

[+] Endpoint policy: WDAC or AppLocker to reduce ShieldCrash usefulness. MDM allowlists for custom URI handlers including sgbiz:.

[+] Identity and cloud policy: Phishing resistant MFA. Managed device Conditional Access. Disable device code where it is not required. Treat new authentication methods as high risk events.

[+] Privacy and litigation posture: IDScan already drew class actions and FBI interest. Boards should treat government ID image retention by KYC vendors as a data minimization and contract issue. Berlin contractors should review leaked security assessments for operational exposure.

[+] Decision logging: For Check Point and other pre exploitation edge devices, timestamp the patch or deferral owner now. After the first confirmed wave that record is what remains defensible.

[+] Control failure framing: An internet facing unpatched GitLab instance with one public project is a vulnerability management failure under SOC 2, ISO 27001, and PCI DSS style programs because exploitation is confirmed. Query third party GitLab and Artifactory hosts the same day.

Chapter 06 - Adversary Emulation

[+] Bound: Lab and staging only. Synthetic data only. Do not aim these steps at production. Do not drop live GRAYRABBIT, Qilin, or BlueMoon samples.

[+] GitLab file read validation: Stand up disposable CE in an affected train with one public project. Send GET or POST to /repository/commits/ with file.path aimed at a canary such as ../../../../etc/hostname. Pass when WAF or SIEM alerts within five minutes and the secret rotation playbook is queued without touching real secrets.

[+] JFrog token to admin validation: In lab Artifactory, reproduce POST /access/api/v1/aws/token/ then POST /access/api/v1/tokens with benign tokens. Create a test admin, drop a canary plugin name, write a canary file under /tmp, and add a test SSH key. Pass when the 401 then 200 sequence, admin creation, plugin, and authorized_keys detections fire and rebuild plus key rotation starts.

[+] ScreenConnect worm validation: In a lab session, transfer a benign .ps1 without Host confirmation and execute it. Pass when SIEM records transfer without confirmation and EDR flags wscript.exe or unsigned script from ScreenConnect context.

[+] MikroTrick validation: Against lab RouterOS, attempt SSH from a non management address and exercise btest on port 2000 with harmless packets. Pass when SSH anomaly and btest unauthenticated connect alerts fire. Do not push exponent=1 keys onto production routers.

[+] UNC3569 / GRAYRABBIT validation: On a disposable Windows image with a patched versus unpatched Sogou pair, generate a benign sgbiz: URI that points at an internal test page. Confirm process creation telemetry on sogoucloud.exe and child process rules. Confirm 7zp.dll does not load on the patched build. Replay GRAYRABBIT strings in a file based YARA harness, not as a live implant.

[+] Metabase SQLi validation: Against lab Metabase, send a benign UNION probe to the reset password path that reads a canary table, not production hashes. Pass when WAF or application logs fire.

[+] Passkey identity validation: Authorized helpdesk simulation on an approved internal domain only. Test detection of unusual sign in, device code, new authentication method, Graph discovery, and SharePoint download. Confirm revocation removes sessions and attacker added methods. Do not collect real passwords or MFA codes.

[+] Cisco FMC validation: In isolated FMC lab, send benign unauthenticated API calls that mimic the bypass shape without executing root commands. Pass when non browser 200s on /api/ alert.

[+] Check Point validation: Confirm LivePatch Take 24 or version lift, then verify implied VPN rules are off and UDP/500 plus UDP/4500 accept only listed peers.

[+] F5 validation: After patching CVE-2025-53521, reboot APM nodes and inspect PHP process memory for eval hooks and HTTP 201 CSS responses. Disk only scanners will miss this.

[+] BlueMoon validation: No public safe exploit replay. Confirm Chrome builds include CVE-2026-85046 and CVE-2026-87491 and Windows includes CVE-2026-85880. Tabletop the phishing path against browser exploit and passkey runbooks.

[+] N-central validation: Verify Hotfix 4 / 2026.3.1.14 and enumerate console accounts created during the unpatched window.

[+] ShieldCrash validation: On a fully updated lab Windows host, watch for unsigned execution from MsMpEng.exe context and confirm WDAC or AppLocker blocks it.

[+] Pass criteria across scenarios: Alert fires, owner is paged, credential rotation or isolation playbook starts, and forensic preservation happens before rebuild. Detection that does not trigger action is a failed test.

Intelligence Confidence80%

Factor	Impact	Evidence
CISA KEV confirmation across GitLab, ScreenConnect, JFrog, MikroTik, Microsoft, Cisco FMC, Citrix, N-central, and BlueMoon components	+25	Catalog listings are the strongest public exploitation confirmation used in this record.
Named vendor and practitioner telemetry	+18	Wiz on Artifactory, Huntress on ScreenConnect, watchTowr on GitLab probes, Microsoft on zero days and passkey activity, CERT Polska on MikroTik, NCSC Netherlands on Check Point, Gen Threat Labs and Google TAG on UNC3569 / GRAYRABBIT, Proofpoint on BlueMoon, Sophos on F5.
Multi outlet corroboration of versions, CVSS, and dates	+10	Vendor advisories plus independent newsrooms repeated the same fixed trains and clocks with no material contradiction on those facts.
Actor attribution gaps on most exploit clusters	-8	Only UNC3569 is a high confidence named espionage set on a window CVE. Rhysida is named on a leak, not on GitLab or JFrog. Storm-3121 / Storm-3032 / UNC6671 apply only to identity activity.
Atomic IOC publication gaps	-6	GitLab, Check Point, Citrix, BlueMoon, F5, and Berlin infrastructure lacked public IP or hash packages in consulted sources.
GitLab post exploitation still thin	-4	watchTowr documents probing. Mass complete compromise is assessed imminent rather than proven estate by estate.
Check Point status is a forecast	-3	NCSC says imminent. This window had no confirmed in the wild exploitation.
IDScan scale and ShinyHunters claim	-3	153 million is seller reported. Company confirms access not that figure. ShinyHunters remains a claim.
ShieldCrash has no CVE and no patch	-3	High operational risk but weaker catalog handle than KEV items.
Input version score spread	0	Input versions scored 67, 72, 85, 87, and 88 on different cluster scopes. 80 reflects the union.

Net reading: High on what is being exploited and what to patch. Medium on who is doing most of it. Low on complete public IOC packages.