Get SCALR AI for Free!

TIGR Threat Watch

Threat Watch Feed

🚩 – IOCs Added

The red flag indicates that Indicators of Compromise (IOCs) have been added to SRA’s Threat Feed used by CyberSOC clients. Articles may not be flagged if IOCs are not available at the time or are not applicable to the article.

GitLab CVSS 10.0 File-Read Flaw Draws In-the-Wild Probing After Patch Release

Sep 11, 2026

GitLab released versions 19.3.2, 19.2.6, and 19.1.8 to address 18 security vulnerabilities, including two critical flaws and several high-severity issues affecting self-managed GitLab CE and EE deployments. The most severe, CVE-2026-85706, is a CVSS 10.0 path traversal vulnerability in the repository commits API that can allow an unauthenticated remote attacker to read arbitrary files from the GitLab server because of improper path confinement and missing authentication enforcement. Affected versions include GitLab CE/EE 18.7 through versions before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2. GitLab strongly recommends that affected self-managed installations upgrade immediately; GitLab.com is already patched and GitLab Dedicated customers do not need to take action.

The Hacker News reported that watchTowr began observing in-the-wild probing for CVE-2026-85706 within hours of public disclosure on September 11, with attempts potentially seeking GitLab configuration files, logs, credentials, and other secrets. The patch release also fixes CVE-2026-87719, a critical CVSS 9.9 insecure-deserialization vulnerability allowing an authenticated GitLab EE user with Duo Chat access to retrieve Advanced Search configuration and sensitive credentials through crafted GraphQL subscription arguments. Additional high-severity fixes include CVE-2026-88765, which can result in remote code execution through a malicious Git project export, as well as flaws affecting protected CI/CD variables, environment-variable scoping, Markdown rendering, and GraphQL resource exhaustion.

Impact: Exploitation of CVE-2026-85706 could expose files containing GitLab configuration, credentials, access tokens, CI/CD secrets, or other sensitive server-side information without authentication. Compromise of these secrets can expand beyond the GitLab host itself by providing access to source repositories, build infrastructure, deployment environments, cloud services, or downstream software supply-chain resources. The broader patch set also includes paths to credential exposure, protected-variable access, remote code execution, and service disruption, making unpatched self-managed GitLab instances particularly high-value targets.

Recommendation:

  • Upgrade affected instances to GitLab 19.3.2, 19.2.6, 19.1.8, or a later supported patched release as soon as possible.

  • Identify all self-managed GitLab servers running versions from 18.7 through affected 19.x branches and prioritize externally accessible instances for emergency remediation.

  • Until patching is complete, restrict unnecessary public access to GitLab management and API interfaces and reduce exposure through trusted administrative networks, VPNs, or other access controls.

  • Review web and application logs for suspicious POST requests to /api/v4/projects/{id}/repository/commits/, particularly requests containing unusual file.Path parameters or traversal-like values.

  • Investigate unexpected access to GitLab configuration files, logs, secret stores, repository metadata, and other sensitive server-side paths around the time of suspicious API activity.

  • If exploitation is suspected, rotate GitLab access tokens, CI/CD variables, deployment credentials, cloud keys, database credentials, signing material, and other secrets that may have been accessible from the server.

  • Review privileged CI/CD, repository, and deployment activity for evidence that exposed credentials were subsequently used to access source code, modify pipelines, create tokens, or reach downstream systems.

Anthropic Reports AI-Enabled Cyber Operations Scaling Espionage, Exploitation, Data Theft, and Credential Abuse

Sep 11, 2026

Anthropic’s September 2026 threat intelligence report documents a significant shift from attackers using AI as a technical assistant toward using it as an orchestration layer for cyber operations. Across cases observed from December 2025 through August 2026, suspected state-sponsored actors, financially motivated criminals, and hacktivists used multi-agent frameworks to conduct reconnaissance, vulnerability research, exploitation, malware development, credential harvesting, persistence, and data exfiltration with reduced human involvement. Anthropic assesses that AI is eroding the traditional relationship between operational sophistication and actor resources: workflows that previously required teams of specialized operators can increasingly be run by individuals or small groups. In one Russian espionage case, GTG-20006—whose activity Anthropic says is consistent with reporting on Midnight Blizzard—used AI-driven workflows across phishing, infrastructure management, malware development, credential theft, and exfiltration, including autonomous agents that monitored whether deployed malware was detected and repeatedly modified and rebuilt the tooling until it evaded available detections.

Other cases demonstrate the same automation model across financially motivated and vulnerability-research operations. Suspected ShinyHunters affiliates used AI to harvest exposed credentials at scale, expand from individual credentials into cloud and SaaS environments, create tooling for cross-tenant collection, and exfiltrate large volumes of downstream customer data; one compromised SaaS provider yielded more than 2,100 Azure AD token sets spanning over 40 corporate tenants. Anthropic also identified GTG-10007, a Chinese-speaking cluster operating autonomous “exploit foundries” in which AI agents continuously reverse-engineered firmware, generated vulnerability hypotheses, wrote and tested exploit code, and maintained persistent campaign state. Separately, threat actors increasingly targeted the AI supply chain itself, stealing API keys and session tokens from victim environments and then using that access as both attacker compute and cover for subsequent operations.

Impact: AI-enabled orchestration can increase attacker speed, scale, and persistence without requiring novel exploitation techniques. The operations Anthropic observed still relied heavily on familiar weaknesses—stolen credentials, exposed secrets, vulnerable internet-facing systems, phishing, token abuse, and misconfigured services—but AI allowed actors to enumerate environments, adapt scripts, process stolen data, and operate against multiple victims in parallel. This compresses intrusion timelines, makes static detections less durable when malware can be automatically retooled, and increases the value of AI API keys, cloud tokens, developer credentials, and service integrations as direct targets for theft and reuse.

Recommendation:

  • Prioritize behavioral detections over static malware signatures alone, particularly where a newly detected payload is rapidly replaced by functionally similar variants or rebuilt tooling from the same intrusion chain.

  • Monitor for compressed reconnaissance-to-exploitation sequences, including high-volume service enumeration, vulnerability probing, credential validation, and follow-on access occurring across multiple assets in short time windows.

  • Treat AI API keys, model-provider credentials, session tokens, and agent integrations as privileged production secrets; store them in managed secret stores, rotate exposed keys immediately, and restrict them by scope, environment, and usage where supported.

  • Hunt repositories, container images, mobile applications, CI/CD pipelines, browser stores, metadata services, and public storage for exposed cloud, SaaS, developer, and AI credentials before attackers can harvest them at scale.

  • Correlate newly created cloud credentials, service accounts, API keys, token amplification, session-store access, and OAuth or vendor-access expansion following an initial credential compromise.

  • Baseline AI and cloud API consumption and investigate unexplained shifts in usage volume, geography, automation patterns, or workloads that could indicate stolen credentials being used to fund attacker operations.

  • Detect defensive impairment and adaptation behaviors, including repeated security-product testing, malware recompilation or redeployment after detection, security-update suppression, and rapid replacement of blocked tooling.

🚩 JFrog Artifactory Vulnerabilities Chained for Unauthenticated Admin Access in Active Exploitation

Sep 11, 2026

Summary: Wiz Research published findings on September 10, 2026 confirming active in the wild exploitation of three JFrog Artifactory vulnerabilities by multiple unrelated threat actors. CVE-2026-82329 is a critical authentication bypass affecting Artifactory in its default configuration that allows an unauthenticated attacker with network access to obtain administrative privileges, and it has been added to the CISA Known Exploited Vulnerabilities catalog. CVE-2026-42018 causes Artifactory to return an internal anonymous user token to an unauthenticated requester even when anonymous access is disabled, and CVE-2026-42016 allows that low privileged token to be escalated because Artifactory validates a token signature and issuer but does not enforce its scope. Wiz observed the CVE-2026-42018 and CVE-2026-42016 chain against self hosted instances between August 15 and September 8, 2026, and CVE-2026-82329 exploitation between September 1 and September 8, 2026.

Neither of the chained flaws grants administrative control alone, but together they convert an unauthenticated request into an admin scoped token in two steps, with some actors moving from first request to created administrator account in under five minutes. The escalated token retains the anonymous username while carrying administrator authority, so follow on activity appears under an actor of token:anonymous. Post exploitation varied by actor and included persistent administrator account creation, malicious Groovy plugin deployment for code execution, command execution through the plugin endpoint, Rust based backdoors and second stage payloads written to world writable paths, webshell uploads, configuration exfiltration, cluster join key theft, and attacker controlled SSH keys attached to created accounts. Fixed versions are 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38, and 7.161.20 or later. Wiz reported that most organizations running Artifactory were vulnerable at each disclosure and that patching has lagged, with 59 percent still exposed to CVE-2026-42016 six weeks after publication.

Impact: Artifactory sits at the center of the software supply chain, so administrative control gives an attacker access to build artifacts, repository contents, stored credentials, and CI/CD and cloud integrations, creating a path from one exposed server to downstream compromise of everything consuming those artifacts. Groovy plugin deployment converts that access into arbitrary code execution on the host, and observed cluster join key theft extends reach beyond the initially compromised node. Because escalated tokens retain the anonymous username, malicious activity can blend into logs unless defenders correlate identity against action rather than trusting the recorded actor. Artifact poisoning is the most consequential outcome, since a backdoored package pushed into a trusted internal repository would be consumed by developers and pipelines with implicit trust.

Recommendation:

  • Identify all JFrog Artifactory instances and upgrade to a fixed release for the deployed branch, prioritizing internet accessible systems.

  • Restrict network access to Artifactory to trusted users and systems, since exploitation is possible remotely without authentication in the default configuration.

  • Hunt for unauthenticated POST requests to /access/api/v1/registry/join returning HTTP 200 or 201, and for a 401 on /access/api/v1/aws/token/ followed by a 200 on any variant of that path from the same client.

  • Alert on low privilege or internal anonymous identities minting tokens, enumerating users, or accessing plugin endpoints.

  • Review all administrator accounts for unauthorized additions and investigate any activity attributed to token:anonymous.

  • Audit installed Groovy plugins against a known good baseline and inspect /dev/shm, /tmp, and /var/tmp for dropped binaries and outbound C2.

  • Rotate the cluster join key, access tokens, and any credentials reachable from Artifactory if compromise is suspected.

  • Validate the integrity of artifacts published during the exposure window and apply the indicators published by Wiz to perimeter and proxy logs.

🚩 NSA, CISA, and FBI Warn of Industrial-Scale Distillation Campaigns Targeting U.S. Frontier AI Models

Sep 10, 2026

NSA, CISA, and the FBI released a joint advisory warning that several China-based AI companies are conducting what the agencies characterize as systematic, industrial-scale knowledge distillation against U.S. frontier AI providers. The advisory names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI and states that, since at least late 2024, these companies have extracted billions of tokens through millions of requests involving models from providers including Anthropic, OpenAI, Google, and xAI. According to the agencies, the campaigns target capabilities such as chain-of-thought reasoning, coding and software engineering, agentic functions, reinforcement and supervised fine-tuning, specialized domain knowledge, and model-evaluation behavior. The advisory further assesses that these efforts are central not merely supplementary to the companies’ model-development strategies and are likely occurring with Chinese government awareness.

The campaigns reportedly distribute activity across native APIs, cloud providers, third-party aggregators, shared premium subscriptions, and gray-market proxy services known as “transfer stations” to bypass regional restrictions, obscure attribution, and evade provider safeguards. The agencies describe additional techniques including fraudulent account pools, automated metadata sanitization, coordinated request routing, quota and cost optimization, rapid failover when access is blocked, jailbreak and prompt-injection attempts intended to extract restricted reasoning, and production-grade quality-assurance pipelines that identify degraded responses or other defensive countermeasures. Detection therefore depends less on individual prompts and more on behavioral patterns such as 24/7 sustained usage, immediate maximum consumption from new accounts, synchronized activity across account pools and providers, repeated extraction-oriented prompts, and enterprise-scale throughput inconsistent with normal adoption.

Impact: The agencies assess that industrial-scale distillation can allow competing AI developers to reproduce proprietary capabilities while substantially reducing the compute, research, data-generation, and development costs normally required to build frontier systems. Distributed infrastructure and third-party relays can also make coordinated campaigns appear as isolated customer activity, limiting any single provider’s visibility. Beyond intellectual-property and competitive risks, persistent attempts to extract reasoning behavior, agentic capabilities, coding performance, and specialized model functions create an ongoing model-security problem that traditional account-abuse or rate-limit controls may not identify in isolation.

Recommendation:

  • Baseline subscription and API consumption patterns and alert on new accounts that immediately reach maximum usage, continuously exhaust quotas, or generate enterprise-scale throughput inconsistent with normal adoption.

  • Correlate accounts sharing payment characteristics, prompt structures, timing, user agents, or operational patterns, particularly when activity is distributed across multiple IPs, regions, cloud providers, aggregators, or proxy services.

  • Detect sustained 24/7 querying with little human variation or idle time, repeated requests targeting the same capability domains, and highly coordinated prompt sequences across otherwise unrelated accounts.

  • Monitor for extraction-oriented behavior including repeated attempts to elicit hidden reasoning, chain-of-thought, grading logic, system behavior, agentic workflows, or other restricted model capabilities through jailbreak or prompt-injection techniques.

  • Apply per-account, API-key, IP, and infrastructure-level quotas with progressive throttling, while monitoring coordinated failover to alternate accounts, providers, or routing pathways after limits are imposed.

  • Strengthen identity and account verification for high-volume access and investigate gray-market “transfer station,” aggregator, proxy, or account-sharing infrastructure used to obscure the true organization behind requests.

🚩 Passkey-Themed Social Engineering Leads to Microsoft 365 Identity Persistence and Cloud Data Theft

Sep 10, 2026

Microsoft Security Research is tracking active cloud intrusions observed since May 2026 in which threat actors use passkey, MFA, and SSO-themed social engineering to compromise Microsoft 365 identities. Attacks commonly begin with phone calls or SMS messages impersonating internal IT support and directing employees to organization-specific authentication sites. The passkey narrative is often only a pretext: victims are guided through adversary-in-the-middle phishing that captures credentials and session tokens or device-code authentication that causes the victim to authorize an attacker-controlled client. Actors may also use previously compromised accounts to send similar lures through Microsoft Teams. Following access, observed sessions moved rapidly through OfficeHome, My Apps, My Profile, My Sign-Ins, Microsoft Approval Management, SharePoint, OneDrive, Outlook, and other applications to identify accessible resources.

Attackers then establish persistence by registering an MFA method they control, including new phone numbers, authenticator applications, or software OTP tokens, before conducting broad Microsoft Graph reconnaissance across users, groups, directory roles, authentication methods, applications, service principals, OAuth grants, SharePoint, OneDrive, and mailboxes. Reconnaissance progresses into sustained cloud collection, with Microsoft observing high volumes of FileAccessed and FileDownloaded activity and REST API-based email access. Rather than always performing rapid bulk theft, actors frequently kept collection below 1,000 files or emails per hour and sustained activity for hours or days, potentially helping it blend with normal usage. Microsoft attributes the initial-access ecosystem to multiple actors, including Storm-3121, whose activity can lead to ShinyHunters and Falcon extortion, and Storm-3032, actors that splintered from BlackFile and now operate under the Helix extortion banner.

Impact: Successful compromise can provide persistent access to a victim’s Microsoft 365 identity and expose email, attachments, SharePoint and OneDrive content, enterprise applications, authentication settings, and other cloud resources available to the account. Actor-controlled MFA enrollment can extend access beyond the initial stolen session, while systematic Graph reconnaissance identifies privileged identities, application permissions, service principals, OAuth grants, and high-value repositories for further targeting. The activity is largely cloud-native, meaning organizations may see little or no malicious endpoint activity before significant data collection or potential extortion occurs.

Recommendation:

  • Train users to independently verify unsolicited calls, texts, or Teams messages claiming passkeys, MFA, SSO, or authentication settings require immediate changes, particularly when directed to a link on a personal device.

  • Block device-code and authentication-transfer flows through Conditional Access where they are not explicitly required for business operations.
    Enforce phishing-resistant MFA such as FIDO2/passkeys or Windows Hello for Business and require managed, compliant devices for Exchange, SharePoint, and Graph-privileged applications.

  • Alert on new phone, authenticator, or software-token registration following unusual sign-ins, especially changes involving StrongAuthenticationPhoneAppDetail or software tokens identified as NO_DEVICE and SoftwareTokenActivated.

  • Correlate broad Microsoft Graph enumeration of users, groups, directory roles, authentication methods, service principals, OAuth grants, sites, drives, messages, and attachments within the same identity or session.

  • Hunt for automated SharePoint and OneDrive traversal using /search, /children, /delta, $top, $skip, or $skiptoken, and investigate when discovery progresses into content retrieval.
    Detect sustained or high-volume FileAccessed, FileDownloaded, attachment, and Exchange REST activity, including python-httpx usage, but evaluate user agent, volume, source infrastructure, authentication history, and preceding reconnaissance together rather than treating one indicator as conclusive.

  • For confirmed compromise, revoke active sessions and refresh tokens, reset credentials, remove attacker-added authentication methods and mailbox rules, require secure MFA re-registration, and review service principals and OAuth permissions accessible to the compromised identity.

🚩 Actively Exploited Critical N-able N-central Vulnerabilities Allow Unauthenticated Remote Code Execution Across Managed Endpoints

Sep 10, 2026

Between August and September 2026, N-able disclosed a series of critical vulnerabilities affecting N-central, its remote monitoring and management platform used by MSPs to manage customer environments. Huntress began investigating on September 4, 2026 after a customer’s fully patched N-central production environment was compromised, leading to the discovery of an exploit chain involving CVE-2026-86206 and CVE-2026-86207, which can be chained to allow an unauthenticated remote attacker to bypass authentication and create attacker-controlled system administrator accounts. A separate independently reported zero-day, CVE-2026-86218 (CVSS 10.0), was subsequently disclosed as a static code injection vulnerability enabling pre-authentication remote code execution and added to CISA’s Known Exploited Vulnerabilities catalog on September 9, 2026 with a federal patch deadline of September 11, 2026. N-able confirmed CVE-2026-86218 has been observed exploited in the wild. Patches are available in N-central 2026.3 Hotfix 4, which supersedes all prior hotfixes. Hosted N-central instances have already been patched by N-able.

Observed post-exploitation activity shows threat actors conducting targeted reconnaissance to identify domain controllers, requesting process lists, and moving laterally across downstream managed endpoints using N-central’s built-in Take Control feature. Attackers have been observed deploying Cloudflare-based tunnels for persistence, manipulating user accounts by appending strings such as .invalid to email addresses during unauthorized account creation, and probing the /remoteControlAction.do?method=getPierDetails endpoint to map connected environments. The August campaign activity was traced to IP addresses associated with Mullvad and NordVPN exit nodes. Huntress has initiated communications with Cloudflare to disable identified adversary tunnel infrastructure.

Impact: A compromised N-central server grants an attacker the same level of administrative control normally reserved for trusted managed service provider staff, enabling the deployment of scripts, tools, and remote sessions across every downstream endpoint under management. The authentication bypass vulnerabilities allow unauthenticated attackers to create fully privileged system administrator accounts, while CVE-2026-86218 enables pre-authentication remote code execution with no credentials required. N-central’s role as a centralized management platform means a single compromised instance can serve as a force multiplier against all connected customer environments, with confirmed lateral movement to domain controllers and other critical infrastructure observed in active intrusions.

Recommendation:

  • Organizations running N-central on-premises should consider immediately upgrading to N-central 2026.3 Hotfix 4, as all prior hotfix versions remain vulnerable to CVE-2026-86218.

  • Teams may want to audit all N-central user accounts for anomalous creation, paying particular attention to accounts with .invalid email suffixes or subtle domain spoofing, and review role assignments for unauthorized privilege escalation.

  • Review N-central UI and remote access logs including envoy_proxy_HTTPS.log and syslog ncentraldms for successful requests to internal API routes using URL-encoded values and unusual Take Control sessions originating from identified IOC IP addresses.

  • Organizations should consider restricting all inbound access to the N-central console behind strict IP allowlisting or mandatory VPN, and may want to enforce multi-factor authentication across all N-central accounts where not already in place.

  • Where immediate patching is not feasible for higher-risk environments, temporarily taking N-central offline until Hotfix 4 can be applied may be worth considering.

  • Teams running Huntress Managed EDR are encouraged to verify that Managed Response isolation and active remediation are enabled to support rapid containment if malicious activity is detected.

Sign up here!

To receive the TIGR Threat Watch email bulletin and critical vulnerability notifications, simply complete the form below.

 

Follow on Twitter

@SRA_ThreatWatch will keep you up to date with the most recent posts on your social media feed.

Subscribe to the RSS

Just copy and add this link to your RSS app and be notified immediately when new intel is posted.

How to use RSS

Following the RSS feed is easy. RSS can be added in your Outlook desktop app, and there are many free RSS readers available for your mobile device.

To follow using Outlook:

  • In Outlook, right-click the RSS Feeds folder and choose Add a New RSS Feed.
  • In the New RSS Feed dialog box, enter the URL of the RSS Feed: https://sra.io/category/tigr/feed

(click here for detailed instructions and additional options for Outlook)

Popular mobile RSS reader apps include:

  • Feedly
  • NewsBlur
  • RSS Reader
  • Inoreader

After installing your preferred RSS reader, you will be able to add this feed by entering the URL: https://sra.io/category/tigr/feed

Threat Bulletin Archive

See full archive here

About TIGR Threat Watch

Our Threat Intelligence Gathering & Research (TIGR) team is focused on threat intelligence and curates a daily intelligence report, TIGR Threat Watch, with information collected from several industry intel sources. We also create and publish ad-hoc critical vulnerability notifications in case of critical and time-sensitive vulnerabilities or threats. These notifications include details and recommendations for mitigation/remediation.