Exploitation Report
Executive Summary
Active exploitation campaigns are intensifying across multiple vectors, with threat actors leveraging both newly disclosed critical vulnerabilities and AI platforms to accelerate attacks. GitLab's maximum-severity path traversal flaw (CVE-2026-85706) drew in-the-wild probes within hours of disclosure, while Cisco FMC authentication bypass (CVE-2026-20079) is being exploited by three distinct threat clusters—including ransomware and state-sponsored groups—to steal credentials and deploy Qilin ransomware. Simultaneously, attackers are chaining two JFrog Artifactory vulnerabilities to seize administrative control of self-hosted servers and implant Rust-based backdoors, with observed activity between August 15 and September 8 on unpatched instances.
A parallel surge in AI-assisted operations sees Russian state-sponsored actors (GTG-20006, linked to Midnight Blizzard) using Claude to rebuild malware after detection, while seven China-based AI labs conduct industrial-scale model distillation attacks. Financially motivated groups including ShinyHunters and Helix deploy passkey-themed phishing to compromise Microsoft 365 environments, and China-linked UNC3569 exploits a Sogou Input Method flaw to deliver the GRAYRABBIT backdoor. PaperCut has issued maintenance releases replacing emergency patches for two actively exploited flaws, and Android-focused campaigns—including GoldFactory's Work Profile abuse and the Mantax Otax ransomware-spyware hybrid—demonstrate expanding mobile threat landscapes.
Active Exploitation Details
CriticalActive exploitationPatchCVE-2026-85706#
- Description: A maximum-severity path traversal vulnerability in the GitLab repository commits API that allows an unauthenticated user to read arbitrary files from the GitLab server.
- Impact: Unauthenticated remote attackers can access sensitive files on the GitLab server, potentially including configuration files, source code, and authentication tokens.
- Status: Actively probed in the wild within hours of public disclosure; patches released by GitLab.
CriticalActive exploitationPatchCVE-2026-20079#
- Description: An authentication bypass vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) software that allows an unauthenticated, remote attacker to bypass authentication controls.
- Impact: Attackers can gain unauthorized administrative access to FMC, enabling credential theft and deployment of Qilin ransomware.
- Status: Actively exploited by three distinct threat clusters (ransomware and state-sponsored) since recent patch release.
CriticalActive exploitationPatch#
- Description: Two vulnerabilities in JFrog Artifactory that attackers chain to bypass authentication and gain administrative privileges on self-hosted servers, followed by deployment of a Rust-based backdoor.
- Impact: Full administrative control of Artifactory instances, allowing supply chain compromise through malicious artifact injection and persistent backdoor access.
- Status: Actively exploited between August 15 and September 8, 2026; JFrog released fixes prior to observed attacks, leaving only unpatched servers vulnerable.
CriticalActive exploitationPatch#
- Description: Two security flaws in PaperCut NG/MF that have come under active exploitation, prompting emergency patches now replaced by regular maintenance releases.
- Impact: Attackers can exploit these flaws to compromise PaperCut print management servers, potentially leading to lateral movement and data access.
- Status: Actively exploited; PaperCut released versions 26.0.5, 25.0.13, and 24.1.10 as regular maintenance releases replacing earlier emergency patches.
HighActive exploitationPatch#
- Description: A vulnerability in Sogou Input Method, a widely used Chinese character input tool for Windows, exploited via a crafted link to install the GRAYRABBIT backdoor.
- Impact: Attackers gain the same privileges as the logged-in user, enabling full system control, data theft, and persistent access via the GRAYRABBIT backdoor.
- Status: Actively exploited by China-linked threat group UNC3569; Tencent (Sogou owner) notified.
HighActive exploitationInvestigate#
- Description: Multiple threat groups—including financially motivated and state-sponsored espionage actors linked to Russia and China—abuse Anthropic's Claude AI model to extract secrets from 1.8 million Android applications.
- Impact: Massive credential harvesting from Android apps, enabling supply chain attacks, unauthorized access to backend services, and intellectual property theft.
- Status: Ongoing campaigns identified and disrupted by Anthropic between December 2025 and August 2026.
HighActive exploitationMitigate#
- Description: Social engineering campaigns using passkey and single sign-on-themed lures to compromise corporate Microsoft accounts and exfiltrate data from Microsoft 365 services.
- Impact: Unauthorized access to corporate Microsoft 365 environments, data theft, and potential business email compromise.
- Status: Active campaigns attributed to ShinyHunters, Helix, and other extortion gangs.
HighActive exploitationMitigate#
HighObservedMonitor#
- Description: Russian state-sponsored threat actor GTG-20006 (aligned with Midnight Blizzard) uses Claude for an AI-assisted workflow to rapidly rebuild malware after detection, staying ahead of defensive signatures.
- Impact: Accelerated malware iteration and evasion capabilities, reducing defender response windows and increasing campaign resilience.
- Status: Campaign disrupted by Anthropic; attributed to GTG-20006.
MediumObservedMonitor#
- Description: Seven China-based AI labs (Alibaba, Moonshot, DeepSeek, Z.ai/Zhipu, MiniMax) conduct industrial-scale illicit knowledge distillation attacks against Claude to replicate model capabilities without authorization.
- Impact: Intellectual property theft, model capability replication, and potential erosion of AI safety controls.
- Status: Identified and disrupted by Anthropic; ongoing industrial-scale activity.
HighActive exploitationMitigate#
- Description: The GoldFactory threat group exploits the Android Work Profile feature to deliver the Gigabud Trojan, targeting banking applications in Indonesia.
- Impact: Financial credential theft, banking fraud, and persistent mobile device compromise.
- Status: Active campaign targeting Indonesian users.
HighActive exploitationInvestigate#
- Description: A new Android malware strain combining ransomware and spyware capabilities to encrypt files, steal sensitive data, and harass victims via spam.
- Impact: Data encryption, exfiltration of personal information, financial loss, and psychological harassment.
- Status: Active distribution; capabilities include ransomware, spyware, and harassment modules.
HighObservedInvestigate#
- Description: Attackers accessed the Florida Department of Highway Safety and Motor Vehicles (FLHSMV) DAVID driver database using credentials stolen from a police department employee.
- Impact: Exposure of driver license records and personal identifiable information for Florida residents.
- Status: Confirmed breach; investigation ongoing.
HighObservedInvestigate#
- Description: Phishing attacks targeting 347,000 Trezor cryptocurrency wallet users using email addresses exposed in the Brevo breach, with 2,500 users clicking malicious links.
- Impact: Cryptocurrency wallet compromise, credential theft, and financial loss for affected users.
- Status: Active campaign leveraging breached contact data.
HighObservedMonitor#
- Description: Threat actors leverage Microsoft's Graph API to identify high-value targets in BYOD environments, then pass access to extortion groups including ShinyHunters.
- Impact: Targeted credential theft, data exfiltration from Microsoft 365, and extortion operations.
- Status: Active technique observed in voice caller campaigns.
Affected Systems and Products
- GitLab (self-hosted): All versions prior to patched releases addressing CVE-2026-85706; repository commits API component affected.
- Cisco Secure Firewall Management Center (FMC): Versions vulnerable to CVE-2026-20079; web interface authentication bypass.
- JFrog Artifactory (self-hosted): Unpatched instances vulnerable to two chained flaws allowing auth bypass and admin escalation; Rust backdoor deployed post-exploitation.
- PaperCut NG/MF: Versions prior to 26.0.5, 25.0.13, and 24.1.10; two actively exploited flaws addressed in maintenance releases.
- Sogou Input Method (Windows): Vulnerable versions exploited via crafted links; Tencent-owned input method editor for Chinese characters.
- Android Applications: 1.8 million apps analyzed via Claude for secret extraction; API keys, tokens, and credentials harvested.
- Microsoft 365 / Entra ID: Corporate environments targeted via passkey-themed phishing and Graph API reconnaissance; ShinyHunters and Helix extortion activity.
- Claude AI Platform (Anthropic): Model abused for credential extraction, malware development, distillation attacks, and automated exploitation across multiple victims.
- Android Devices (Work Profile): Devices with Work Profile feature enabled targeted by GoldFactory/Gigabud banking trojan campaign in Indonesia.
- Android Devices (General): Mantax Otax malware infecting devices with ransomware, spyware, and harassment capabilities.
- Florida DAVID Driver Database: FLHSMV database accessed via compromised police department employee credentials.
- Trezor Hardware Wallet Users: 347,000 email addresses targeted in phishing campaign following Brevo breach.
- Surfshark VPN Internal Infrastructure: Internal test and proxy servers breached via configuration error exposure.
Attack Vectors and Techniques
-
AI-Assisted Credential Harvesting: Attackers use LLMs (Claude) to automate extraction of secrets from massive datasets (1.8M Android apps), accelerating supply chain reconnaissance.
- Vector: AI model API abuse; prompt injection for data extraction tasks.
-
AI-Assisted Malware Development: State-sponsored actors (GTG-20006) use Claude to rapidly rebuild and obfuscate malware after detection, creating an AI-augmented development lifecycle.
- Vector: Legitimate AI platform access; iterative code generation and testing.
-
Model Distillation Attacks: Industrial-scale knowledge distillation from proprietary models (Claude) by competitor labs to replicate capabilities without authorization.
- Vector: High-volume API queries to extract model behavior patterns; teacher-student training paradigm abuse.
-
Passkey/SSO-Themed Social Engineering: Phishing lures mimicking passkey enrollment and single sign-on flows to harvest Microsoft 365 credentials.
- Vector: Email and web-based phishing; exploitation of user familiarity with new authentication methods.
-
Authentication Bypass via Path Traversal: Unauthenticated file read via GitLab commits API (CVE-2026-85706) enabling server filesystem access.
- Vector: HTTP requests to vulnerable API endpoint; directory traversal sequences in repository paths.
-
Authentication Bypass in Management Interface: Cisco FMC web interface flaw (CVE-2026-20079) allowing unauthenticated remote admin access.
- Vector: Direct HTTP requests to FMC management console; no credentials required.
-
Vulnerability Chaining for Privilege Escalation: Two Artifactory flaws chained—first for authentication bypass, second for administrative privilege escalation—followed by backdoor deployment.
- Vector: Sequential exploitation of repository manager endpoints; Rust backdoor implantation for persistence.
-
Input Method Editor Exploitation: Sogou IME flaw triggered by crafted link, achieving user-context code execution for GRAYRABBIT backdoor installation.
- Vector: Malicious link delivery (likely phishing or watering hole); IME component handling of crafted input.
-
Android Work Profile Abuse: Legitimate enterprise feature (Work Profile) exploited to install Gigabud Trojan in isolated profile, evading user suspicion.
- Vector: Social engineering to enable Work Profile; malicious app distribution via phishing or third-party stores.
-
AI Platform Feature Weaponization: Claude Artifacts, shared conversations, and sponsored search results used to host and deliver malicious payloads.
- Vector: Legitimate AI platform features repurposed for malware hosting and social engineering (ClickFix-style lures).
-
Graph API Reconnaissance: Attackers use Microsoft Graph API to enumerate high-value targets in BYOD environments before passing access to extortion groups.
- Vector: Compromised credentials or tokens with Graph API permissions; automated tenant enumeration.
-
Credential Theft and Reuse: Stolen police employee credentials used to access Florida DMV database; Brevo breach data used for Trezor phishing.
- Vector: Credential stuffing, phishing, and infostealer malware output leveraged for downstream access.
-
Mobile Ransomware-Spyware Hybrid: Mantax Otax combines file encryption, data exfiltration, and victim harassment in single Android malware strain.
- Vector: Malicious app installation; overlay attacks, accessibility service abuse, and contact enumeration.
Threat Actor Activities
-
GTG-20006 (Russian State-Sponsored, Midnight Blizzard-aligned): Uses Claude for AI-assisted malware rebuild workflow to evade detection; campaign disrupted by Anthropic. Attribution links to broader Midnight Blizzard activity.
- Campaign: Automated malware iteration via LLM; accelerated development cycle to stay ahead of signatures.
-
ShinyHunters and Helix (Financially Motivated Extortion Groups): Conduct passkey-themed phishing campaigns targeting Microsoft 365 environments; receive target access from Graph API reconnaissance operators. Active data theft and extortion operations.
- Campaign: Social engineering leveraging new authentication paradigms; Microsoft 365 data exfiltration for extortion.
-
UNC3569 (China-Linked): Exploits Sogou Input Method flaw to deploy GRAYRABBIT backdoor; targets Windows users in Chinese-language environments. Tencent notified as Sogou owner.
- Campaign: Crafted link delivery → IME exploitation → GRAYRABBIT installation → full user-context control.
-
GoldFactory (Android Threat Group): Exploits Android Work Profile feature to deliver Gigabud banking trojan in Indonesia; Mantax Otax spreads separately with ransomware-spyware capabilities.
- Campaign: Regional banking credential theft via Work Profile abuse; parallel Mantax Otax deployment for broader compromise.
-
Seven China-Based AI Labs (Alibaba, Moonshot, DeepSeek, Z.ai/Zhipu, MiniMax): Conduct industrial-scale illicit distillation attacks against Claude; identified and disrupted by Anthropic.
- Campaign: High-volume API abuse for model capability extraction; competitive intelligence and IP theft.
-
Generative Threat Groups (GTGs) - Multiple: Anthropic-tracked clusters spanning state-sponsored, financially motivated, and commercial actors using Claude for cyber attacks, weapons design, propaganda, and mass surveillance (Dec 2025–Aug 2026).
- Campaign: Broad AI-assisted offensive operations across multiple verticals; automation of exploitation and data theft.
-
Three Distinct Threat Clusters (Ransomware + State-Sponsored): Exploit Cisco FMC flaws (CVE-2026-20079) for credential theft and Qilin ransomware deployment; mixed motivation actors sharing vulnerability access.
- Campaign: FMC compromise → credential harvesting → Qilin ransomware deployment; observed post-patch on unpatched instances.
-
Wiz-Observed Artifactory Attackers: Chain two Artifactory flaws for admin access and Rust backdoor deployment; active Aug 15–Sep 8, 2026 on unpatched self-hosted servers.
- Campaign: Supply chain positioning via artifact repository compromise; persistent backdoor access.
-
Conti Ransomware Gang: Member sentenced to 4 years for 2021–2022 attacks; demonstrates law enforcement progress against ransomware operators.
- Campaign: Historical ransomware operations; legal accountability milestone.
-
Brevo Breach Exploiters: Leverage exposed Trezor customer emails (347K) for targeted cryptocurrency phishing; 2,500 link clicks recorded.
- Campaign: Post-breach credential reuse; cryptocurrency wallet targeting via brand impersonation.