-
UNC6671, a vishing-focused extortion group, has rebranded and expanded its operations against organizations in the U.S. financial sector.
-
A zero-day vulnerability in Metabase is being actively exploited in the wild to compromise vulnerable instances.
-
The “Plug and Pwn” attack uses malicious USB devices to gain SYSTEM-level access to Windows systems.
-
Lazarus hackers are exploiting Roundcube and a Windows zero-day in suspected espionage-focused attacks.
-
New research into the Citrix NetScaler CVE-2026-8452 vulnerability could accelerate exploitation against vulnerable appliances.
-
A Microsoft Defender local privilege escalation, “ShieldBreak,” has been disclosed publicly by Nightmare Eclipse.
1. Vishing extortion group UNC6671 rebrands and diversifies activity targeting US finance sector
Summary
UNC6671, formerly known as BlackFile, has evolved its vishing and SSO compromise tactics under multiple new brands. The group targets financial services and other sectors, posing as IT helpdesk staff to steal credentials and MFA tokens. Its TTP profile has remained consistent across attacks despite the varied extortion branding.
Category: Threat Actor Activities
Industry: Primarily within US regions for Financial and Fintech, Healthcare, Transportation and Warehousing
Sources
-
https://www.securityweek.com/vishing-extortion-group-unc6671-rebrands-after-making-millions/
-
https://socradar.io/blog/pink-data-extortion-group-phishing-kits/
Analyst comments
UNC6671, a sophisticated vishing and SSO compromise threat group originally known as BlackFile, has rebranded into multiple identities including Redact, Pink, Helix, and Falcon, while maintaining consistent TTPs. The group targets organizations primarily in the financial services, private equity, and professional services sectors. It poses as IT helpdesk employees to gain access to cloud environments via spoofed login portals and compromised SSO infrastructure such as Microsoft 365 and Okta. Researcher monitoring indicates that UNC6671 uses common root domains, with subdomains tailored to each victim, to harvest credentials. Recent tactics have evolved to include the use of legitimate helpdesk phone numbers and resetting passwords for non-SSO applications to avoid detection. Between January and May, the group accumulated over $10 million in ransom payments across multiple Bitcoin wallets. Typical demands initially ranged from $1 million to $3 million, but were often reduced during negotiations to around $750,000 on average.
The threat actor has a consistent playbook that has been used over the long term during intrusions. A caller claiming to be from the IT helpdesk usually engages a user via vishing. The caller then directs the victim to a phishing landing page, where AiTM techniques are used to steal and reuse credentials. Credentials are either reset, or an additional MFA device is registered, for continued access into predominantly cloud environments. The threat actor favors interacting with the user through personal devices, which are less likely to carry enterprise security monitoring that might raise alerts and less likely to generate forensic artifacts for investigation. This is largely the same playbook used by most COM-related threat actors such as ShinyHunters. The use of legitimate IT helpdesk numbers may indicate additional SIM-swapping operations to obtain those numbers.
The domain and subdomain naming has remained largely consistent, with some variation of “passkey” used as part of the root domain and the targeted company used as a subdomain. Based on submissions to URLScan, the last activity from the known domains was 6 days ago, which indicates that the most recent domain is likely still active. We were also able to get a sense of the potential victims that the threat actor was targeting. This is consistent with the original reporting that these are finance related organizations, particularly those dealing with asset management and venture capital. Only one target deviated from the rest, a company dealing primarily in residential pool supplies.
The groups have been largely consistent in their TTPs and domain structure despite the disclosure of public researcher reports, and this is unlikely to change in the short term. Recent researcher reports indicate that Helix deviates from the root domain structure of using “passkey” and “sso” related domains. However, the veracity of that information cannot be confirmed at this time and is likely full of false positives, based on checking against associated hash values of the malware used. The groups do engage with PhaaS platforms, so the use of seemingly more random domain names in line with major phishing kits is not outside the realm of possibility. They also specifically target victims on personal devices that are unlikely to have enterprise security applied, which makes attribution and log analysis of past activity difficult if a breach is confirmed. This likely partially relieves the need for extensive domain rotation. The currently known IoCs are detailed below. Many of the URLs used during phishing are no longer in use, as most do not resolve when navigated to. This indicates most of the phishing landing pages are ephemeral with short uptimes. The following, however, are still resolving and known to be emitting phishing-related behavior:
# Infrastructure IoCs from external reporting
31.7.56.61 Panel AiTM Reverse Proxy AS51852 Private Layer INC (Switzerland)
31.7.56.52 Panel AiTM Reverse Proxy AS51852 Private Layer INC (Switzerland)
# Recent victims claimed by threat actor brands
# Redact
Holologic - Healthcare
FCCI Insurance Group - Finance
# Helix
Venture Logistics - Transportation
Uber Freight - Transportation
Highwood Properties - Real Estate / Finance
Morguard - Real Estate / Finance
Westland Insurance - Finance
# Both Pink and Falcon related brands have no recent data available. However past
# reporting indicates a majority of their targets were in healthcare, technology
# (specifically SaaS service related), and Finance related sectors based on domain identifiers.Actionable guidance
At risk organizations in finance, transportation, and healthcare should monitor for lookalike domains or subdomains seen on the network. Typical domains used for this actor will usually be assembled as <company_name>.<root domain containing "sso" or "passkey" variations>.com. An unknown domain carrying the company’s name as a subdomain is a high signal of potential targeting and can be hunted proactively for indications of imminent compromise. Organizations should audit user devices associated with MFA in order to identify rogue devices being used for abuse, especially where additions are preceded by user password changes. Implementation of phishing-resistant MFA is also recommended to help prevent attacks from this threat actor. A vetting process for IT communications should also be established, in case IT helpdesk numbers are spoofed, so that an unprompted caller can be confirmed as legitimate IT personnel. Alternatively, in the event of an unprompted call from the IT helpdesk, users should call their organization’s known helpdesk number in order to minimize risk of unknown persons claiming to be IT. Unprompted calls from IT engaging the user to change passwords or navigate to a specific URL should be seen as highly suspicious.
2. Metabase 0-day exploited in the wild
Summary
Framework and other companies suffered a data breach due to a zero-day vulnerability in Metabase’s service. The breach led to unauthorized access of customer information, including names, email addresses, and login IP addresses, but not payment details. Metabase has since pushed out fixes for the affected versions.
Category: Critical Vulnerabilities
Industry: Technology, Multiple
Sources
-
https://www.helpnetsecurity.com/2026/08/10/metabase-zero-day-framework-tally-kilo-code/
-
Internal OSec Research
Analyst comments
Framework, Tally, and Kilo Code experienced data breaches due to a zero-day SQL injection vulnerability in Metabase 58 and above. The flaw allows unauthenticated access and potential administrator privileges. Framework’s breach exposed customer names, email addresses, phone numbers, physical addresses, and login IP addresses. ShinyHunters has claimed responsibility for the attacks on their leak site.
The vulnerability is a SQL injection flaw that primarily takes advantage of the /reset_password endpoint on vulnerable Metabase instances.
Actionable guidance
Organizations should ensure that Metabase is up to date with the latest patches available. If compromise is suspected, it is also recommended to revoke core sessions, API keys, and user passwords for Metabase hosts. Auditing of rogue users or administrators should also be undertaken to ensure threat actors do not have persistent access to the Metabase host. The following versions are affected:
# Affected versions
>= x.58.0, < x.58.23
>= x.59.0, < x.59.20
>= x.60.0, < x.60.16
>= x.61.0, < x.61.10
>= x.62.0, < x.62.8
>= x.63.0, < x.63.3If a patch cannot be applied immediately, it is recommended to block the /api/session/reset_password endpoint until a patch can be applied.
3. Plug and Pwn attack uses fake USB devices for Windows SYSTEM access
Summary
Security researchers have uncovered “Plug and Pwn” attacks that exploit Windows’ Plug and Play feature to automatically install vulnerable vendor software and gain SYSTEM privileges. The research highlights critical security risks in how Windows handles USB device connections and RDP sessions.
Category: Critical Vulnerabilities
Industry: Multiple
Sources
-
Internal OSec Research
Analyst comments
Security researchers disclosed “Plug and Pwn” attacks that exploit Windows’ Plug and Play feature to install vulnerable software and gain SYSTEM privileges. These attacks use hardware emulation or RDP USB redirection to trick Windows into installing signed packages with exploitable components, often without requiring user interaction. The vulnerabilities stem from the automatic installation process of vendor-supplied components as SYSTEM, bypassing UAC prompts. Researchers demonstrated several attack scenarios using emulated USB devices and remote RDP sessions, affecting fully updated systems.
We tested the remote RDP implementation of this technique within a Windows 11 lab environment, simulating an external attacker with credential access. The code available from the researchers was not weaponized and simply demonstrated the techniques. Further development of that code would be needed to fully exploit a Windows system through this technique. Exploitation requires three things: Device and Resource Redirection enabled, which opens the vector of abuse; a credential pair to log into the vulnerable host; and weaponized driver code that can be sent through RDP PnP install paths. Device and Resource Redirection was disabled by default in our Windows 11 Pro instance prior to configuring the victim host.
# Group Policy location of Device and Resource Redirection
Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Device and Resource RedirectionRDP is the likely vector that threat actors will choose to abuse this technique. This is because it only requires executing remote code from a script, with no physical hardware. The other techniques require either physical access or a physical device to fully take advantage of this issue.
Actionable guidance
It is recommended to keep Device and Resource Redirection disabled in order to mitigate the remote vector through RDP. Additionally, disabling co-installers through the registry is also recommended. USB restrictions in workplace environments will further reduce the possibility of successful compromise.
4. Lazarus hackers exploit Roundcube and Windows 0-day in likely espionage-focused attacks
Summary
North Korean hackers linked to the Lazarus group are using a Windows zero-day vulnerability (CVE-2026-68820) in Operation Dream Job to target defense sector companies globally. They are leveraging this exploit alongside new backdoors and web shells for privilege escalation and data exfiltration.
Category: Threat Actor Activities
Industry: Public Sector and Government Administration, Education, Technology
Sources
-
https://www.infosecurity-magazine.com/news/china-aligned-cluster-roundcube/
-
https://www.welivesecurity.com/en/eset-research/gotta-fly-lazarus-targets-uav-sector/
Analyst comments
North Korean hackers are using a Windows zero-day vulnerability (CVE-2026-68820) in their Operation Dream Job campaign to target defense-sector companies. Microsoft has patched this “use-after-free” flaw in afd.sys, which allows privilege escalation to SYSTEM without requiring user interaction. Since early July, the Lazarus group has been exploiting this vulnerability and incorporating it into a new FudModule rootkit variant targeting Windows 11 builds 26100 and 26200. The variant improves stealth by tampering with EDR telemetry and Smart App Control.
Researchers have also identified a backdoor named Troy, which supports 17 commands including reconnaissance, file manipulation, hidden command execution, and DLL injection. Lazarus has been leveraging Roundcube server vulnerabilities to deploy RelayShell, a new PHP web shell, for remote code execution on at least 17 servers worldwide. This campaign has primarily targeted the defense sector in Europe, India, South America. The group has also focused on the aviation and aerospace sectors with similar attacks.
The custom malicious domains set up by the threat actor pull resources from the legitimate site they mimic, as is the case with the Enveil-related fake websites. All of the custom domains carried a Gmail address within the site’s source code. The following address was used across all of the network locations associated with this campaign:
# Associated with the following network locations
envell.xyz Finland AS24940 Hetzner Online GmbH - 135.181.67.203
enveil.online Germany AS47583 Hostinger International Limited - -
uxtramine.org Finland AS24940 Hetzner Online GmbH - 135.181.185.158
135.181.67[.]203 Finland AS24940 Hetzner Online GmbH - 135.181.67.203
135.181.185[.]158 Finland AS24940 Hetzner Online GmbH - 135.181.185.158The threat actor is also targeting Roundcube servers with CVE-2025-49113, an RCE through the _from parameter of the upload.php endpoint. Roundcube is a common webmail implementation used in sectors such as education and technology, usually with cPanel deployments. North Korean actors are financially motivated overall. However, based on the sectors and technologies targeted, this campaign indicates a primarily espionage-related focus. Wider targeting of other industries is done primarily to drop RelayShell and turn vulnerable web servers into proxies for use in their attacks. This is likely the primary purpose of targeting Roundcube servers, and by extension cPanel.
# Currently known IoCs
# DLL Loader / Dropper
2b4987c07a3d9a9a5d1a9bf4efa3d1903e775090b611710edafdc92874265ca8
3a02d0d798e8d35555776886d92b20ff38a101c9ef7e0eebc8ce5d259516525a
92106b0c62a0a42678232f8273f030b2d3c8e92efce81b98b9eec70cfe98afa1
396192d92d17ace1a521f1351eeeba2825e60badd0d799cc5c338e4934b3c82c
f7e620134ca935067797ab957317b346ce0df84a4e9b9ca54a6acc9b75afda4d
75b93a7103b0562f6497d30052c0c5cf7aa58c1bf0e9297022b74469a7f096f1
a45144d22cac70a45d71cf4dffa4efbc373658779a56cf1300d6ac863d6cc7e2
1de949c71efcfb0ffc41f33d38833dbc4b082075b1a540fc68c18c535d7ad86c
4c9b804d6155b29f1e27a9ffe531e10bc42a7bdab42f905b50146bf2026768d9
29e24c007549e51319ff3aee011da6f9f93568e8c85a5ad69c9e53bd3f4533a2
4ebdce2f47c23ff8c9e8e80c8b5239c7a5764da31cd3ab8f0505926890adc105
c2aa28bb5e2a749c693712008276f311edd912f689371ef9e8a1ee5fb4167461
# MISTPEN
2db25ac41a66aa523c79e23e00443573530dd7bd82b8371bcc87bd7232e141eb
5278ee922838352f1480a73e971161017d643a80b7ec22bf725897dfd088696d
b4082d21070d9ddf53fde4ea22524d09e41ec9826ce63cef3c6235e458d21afb
fb3fc5626f68677fb1269a2fefbe70e719211b4065e836ab92e06a8210139a2d
ea7056f2bf36c66a61ff787ff5be975a85f534c3c5ca178791dac2504db2c619
13d10bc99f7f7abe7ee0902be87920b73b2ea41bd9683dbfcad340dacbcdef79
4fd32432341dfcf54d0517a6bbc38e5d265be70933493e4183c2a340cdde9a2d
4dd792c9f672bbdcc8d363d745994efe90f4ffc5fdc2c059c8e379a48ad6a68a
ba96c603e44046de703c67b2c3b7e4ca974afef7b437a0244418bc4edc781bb7
# ForestTiger
72dccae85e062f541fecad9ec7a18a3123e7ae5ac5d53c91709b53a46dbbd289
231b1ef8b95bf77887d5377e2a60f649035e78f543af1b82877db36a5759d858
6da9b1e6f3315ceb77dd14a937a26cc3602bf6a7e2c2ecafb3c65ce5319837be
a0578a2b7821d7e2c573530648f26d7a0d98b373ab24fb7f0c792736761e542d
82268052f94df6f4870d02e57b18d4c54136cc7a8c8d80ad162631f99462c943
# FudModule
3b6378df8442e63a6ed7317075913e4720847a510d95022d4a8347b2637c245d
# PDF Payload
a673ae661593c0de9bbb815593b816a6853dad6d55ad5042d2ef1875cd13d6e7
8ce6c29f92dc45b1474417cbdff4ed0c18e58fa63e3a071ee9f85aa9d2aac07c
acb97cec84e08b89f41967a24e965d1fd2c51751cef158f7aa35bb4306b87b97
3601060c62edeeaa49def6a13be6e126e1024ce011faad4e2d9f585ccf6bd5a6
fecf12088843801215898442bd1ff3e266f29d14e29a94780e857f69c4915d6b
d578c28c9afe7457a0d81f6701332ef8197e8f7468de654935fb29a50ea66459
# SecurityPDF.exe
743172aab606974b054a64561534ae66baa3a840657f79d7c6fa18350e8d45d1
db3d69b7eeda2e35e23006bf4b7e206281fce809584207214fc213f9bc30376d
# Troy Backdoor
590fb6ae19480d694e08ee85859cad8066f2f87e7e5abba2960c6d115e1615d6
68d4fba7b1300a59cd6212c08910a260cd71b40cd9f51cac933030a68faac0bb
a738059ce07c951c31ab2da3d93d8f69bff32f9b7d933dbf5943441b9cc99075
# RelayShell
21c3ad4838c4324bc5f081021da5fb2e9073d0c9304087811c21eb47c9e22762
cc4e06aa378a190f71384c03023bb3d18a6d66e297d46701220e132963d2e222Actionable guidance
Defending against the vulnerabilities used by the threat actor includes ensuring that all patches are up to date for both Windows and Roundcube webmail (and cPanel) hosts. Exploitation of Windows vulnerabilities affecting afd.sys is likely to show SYSTEM elevation that cannot be attributed to a known Windows service or binary. Applying the latest Windows patch will disrupt the threat actor’s attack chain and prevent privilege escalation based on their current behavior. Organizations outside the defense, aviation, and aerospace sectors that host cPanel or Roundcube webmail servers should look for unknown .php files being served over HTTP/HTTPS.
The threat actor’s primary approach is spear-phishing individuals already employed in the target sectors, in preference to enterprise users, and directing them to download malicious files at the end of the chain. Given this, monitor for suspicious user behavior on the network, such as attempts to access sensitive locations and logins from atypical source IP addresses, especially those associated with VPS infrastructure. An additional high-signal detection is the high volume of API calls that the Troy backdoor makes to unknown domains at the /proxy/api.php endpoint.
5. Citrix NetScaler CVE-2026-8452 research disclosure may prompt exploitation in the short term
Summary
Researchers have disclosed details regarding CVE-2026-8452, a recently reported vulnerability in Citrix NetScaler devices. While a fully weaponized proof of concept (PoC) is not yet available, it could emerge in the coming days or weeks.
Category: Zero-day
Industry: Technology
Sources
-
https://labs.watchtowr.com/youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452/
-
Internal OSec Research
Analyst comments
CVE-2026-8452 is a recently disclosed buffer overflow vulnerability in Citrix NetScaler devices that can cause a denial of service (DoS) or allow remote code execution (RCE). Exploitation is expected within the SAML implementation of NetScaler devices. The malicious input targets the PrefixList parameter under InclusiveNamespaces in the decoded SAML request. There are currently no known indications of exploitation in the wild. Patches addressing this issue are available.
Once a functional proof of concept emerges, it will likely lead to widespread attacks against vulnerable devices. Citrix NetScaler remains a high-impact target that has historically been exploited by threat actors. A weaponized proof of concept is not yet available. However, researchers have shared enough technical detail to potentially develop one within a few days. The flaw is triggered through the PrefixList parameter during a SAML POST request to the /cgi/samlauth endpoint. Attackers can flood this parameter with malicious data to overflow the buffer and crash the host. Alternatively, they could craft the input to execute custom shellcode and achieve remote code execution.
Actionable guidance
A patch is available from the vendor that remediates this vulnerability. Organizations should prioritize applying the update, as Citrix NetScaler devices are high-value targets for threat actors. Alternatively, blocking traffic to the /cgi/samlauth endpoint can mitigate exploitation until a patch is applied. If compromise is suspected, investigate unusually large SAML requests. After decoding the request, checking the PrefixList parameter for excessive amounts of data will positively identify abuse of this issue.
# Affected versions
NetScaler ADC and NetScaler Gateway 14.1 BEFORE 14.1-72.61
NetScaler ADC and NetScaler Gateway 13.1 BEFORE 13.1-63.18
NetScaler ADC FIPS BEFORE 14.1-72.61 FIPS
NetScaler ADC FIPS and NDcPP BEFORE 13.1-37.2726. New Microsoft Defender ‘ShieldBreak’ zero-day grants SYSTEM privileges
Summary
A security researcher named Nightmare Eclipse has released a new exploit called ShieldBreak, which bypasses recent patches for Microsoft Defender. This exploit allows attackers to gain SYSTEM privileges on fully patched Windows systems. Its release escalates the ongoing dispute between the researcher and Microsoft over vulnerability disclosure practices.
Category: Zero-day
Industry: Technology
Sources
-
Internal OSec Research
Analyst comments
A security researcher known as Nightmare Eclipse has released a new exploit called “ShieldBreak” which bypasses Microsoft’s August 2026 Patch Tuesday updates for Defender. This zero-day exploit allows attackers to gain SYSTEM privileges on fully patched Windows systems. It abuses a user-mode callback hook that alters file contents during Defender cloud-hydration scans via the Cloud Filter API (cfapi). ShieldBreak is different from the previously disclosed RoguePlanet flaw, but it indicates Microsoft’s incomplete patching efforts for CVE-2026-50656.
We tested the vulnerability within our lab environment and verified that it works. Retesting several days later on newer builds of Windows 11, as of August 14th, shows initial detections added to Microsoft Defender. These alert on abuse of this vulnerability. Newly stood-up Windows 11 instances also showed some unreliability in exploitation. This was most pronounced against clean, isolated Windows 11 25H2 deployments installed from .iso files dated a month prior to the disclosure. However, allowing Windows 11 to apply updates to Defender and other components allowed execution to progress to spawning a shell. Once triggered, the exploit registers a new cloud provider and initiates a scan using an EICAR file, which creates a new threat alert. It also writes a .dll named phoneinfo.dll into C:\Windows\System32 on execution. We found several application event log entries for Windows Error Reporting referencing “AngryPeopleBug.exe”. That name is a placeholder in the fabricated error report, which causes phoneinfo.dll to execute a SYSTEM cmd.exe shell. This is similar to DLL hijacking. It was the only relevant Windows Event entry tied to this bug’s exploitation.
So far there has been no major abuse by threat actors successfully integrating these PoCs into their campaigns. The researcher has disclosed several PoCs at this point, and only a select few have been exploited in the wild. According to one external report, those attempts were unsuccessful overall. It remains a possibility that threat actors may attempt exploitation and abuse of this bug.
Actionable guidance
Detection opportunities should focus on creation of EICAR alerts and interactions with MpClient.dll from non-Defender processes. Defenders should also watch for rogue processes loading the Windows Cloud Filter API (cldapi.dll). If both are seen in rapid succession, this is a high signal of potential abuse. The creation of phoneinfo.dll in C:\Windows\System32 is a signal of the original PoC’s use. However, threat actors are likely to change this filename and the named pipes used, so it should not be relied on alone. The newest Microsoft Defender signatures have initial detections in place, but it is unknown whether they would detect exploitation with altered PoC code.