# Weekly Situation Report — 9/14/26 2026-09-17 · Threat Brief Canonical: https://www.osec.com/resources/threat-briefs/weekly-situation-report-9-14-26 --- - A critical Citrix NetScaler authentication bypass vulnerability is now being leveraged in attacks to gain unauthorized access to vulnerable appliances. - Attackers are compromising MikroTik routers by creating rogue users and installing backdoor code for persistent access. - A new "ShieldCrash" zero-day targets Microsoft Defender and can potentially be used to bypass endpoint security protections. - Chinese espionage actors are using the BlueMoon exploit kit to compromise targeted victims in ongoing cyberattacks. ## 1. Critical Citrix NetScaler auth bypass now leveraged in attacks **Summary** A critical Citrix NetScaler flaw (CVE-2026-19490) is being targeted by attackers, allowing unprivileged threat actors to bypass authentication remotely. Despite Citrix's warnings to patch affected appliances, evidence of exploitation attempts has been observed in the wild from multiple locations. **Category:** Critical Vulnerabilities **Industry:** Multiple **Sources** - https://www.bleepingcomputer.com/news/security/hackers-target-critical-citrix-netscaler-auth-bypass-in-attacks/ - https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696939 - Internal OSec Research **Analyst comments** CVE-2026-19490 is a critical flaw in Citrix NetScaler that enables unprivileged actors to bypass authentication remotely under certain configurations. It was patched in August's Patch Tuesday. Researchers report exploitation attempts from multiple geographic locations in the days following public PoC disclosure. The Centre for Cybersecurity Belgium has also issued warnings urging administrators to patch promptly. Our analysis of the available PoC finds that large portions of the code appear to be LLM/AI-generated, based on characteristic comment patterns and code structure. The PoC also requires a lab environment configured to mimic a Citrix NetScaler SAML endpoint rather than a real device. These two attributes cast doubt on its veracity and whether it would function against a real target without further development. We did not observe exploitation activity consistent with the available PoC code in data from two public honeypot providers or our own internal honeypots. This indicates either a non-working PoC or limited exploitation attempts at this time. No successful exploitation or publicly disclosed IoCs have been reported as of this writing. NetScaler administrators can check whether their deployments meet the preconditions for exploitation using the configuration checks below. ``` # Inspect NetScaler configuration files for the following specified strings: # SAML action configuration add authentication samlAction.* # Auth or VPN vserver add authentication vserver .* # Or add vpn vserver .* ``` The signature supplied with the SAMLResponse will not include `` within it. The lack of this XML is potential evidence of exploitation attempts. **Actionable guidance** Applying the available vendor patch remediates this vulnerability. If compromise is suspected, look for suspicious configuration changes, unfamiliar files, and unexpected network callbacks at regular intervals. Also check for newly created user accounts, particularly Administrator accounts, created recently on the device. The following Citrix NetScaler versions are affected: ``` 14.1-43.56 or later: Applicable only when configured with a SAML action AND NetScaler is configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver 14.1-66.68-FIPS or later: Applicable only when configured with a SAML action AND NetScaler is configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver 14.1-43.55 or earlier: Applicable when configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver 13.1-61.28 or later: Applicable only when configured with a SAML action. 13.1-61.27 or earlier: Applicable when configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver 13.1 FIPS: Applicable when configured with Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA vserver. ``` ## 2. MikroTik RouterOS compromised with rogue users and backdoor code **Summary** MikroTik RouterOS devices with exposed SSH are under active exploitation via a zero-day attack chain dubbed MikroTrick, combining an authentication bypass and privilege escalation flaw. **Category:** Known Exploited Vulnerabilities **Industry:** Multiple (primarily within Polish regions however this is highly likely to expand beyond this region) **Sources** - https://securityaffairs.com/198538/security/your-mikrotik-router-may-already-be-compromised-look-for-ssh-user-2.html - https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/ **Analyst comments** A critical SSH zero-day vulnerability called MikroTrick, affecting MikroTik RouterOS versions prior to 7.25beta3, 7.24.2, 7.23.5, and 6.49.21, has been actively exploited since September 2nd. The exploit combines an authentication bypass (CVE-2026-67276) and a privilege escalation flaw (CVE-2026-86060), allowing attackers to take full control of RouterOS devices with SSH access. Based on external reporting by CERT Polska (cert.pl) and analysis of the Polish forum post, initial access is through exposed SSH services on MikroTik devices. After successful exploitation, the threat actor creates new users named either `-2` or `ops`. Several files were found on compromised devices: two Python scripts and a `launch.sh` script. We identified analysis and code for all three files via social media. CERT Polska identifies several SSH vulnerabilities potentially in use during the intrusion. Of the three primary ones listed, two have public PoCs or research available. These have not been independently verified through lab testing. ``` # SSH Auth CVE-2026-67276 - PoCs available # SSH Session Privilege manipulation via crafted username CVE-2026-86060 - Public research available # SSH Memory Disclosure and Crash CVE-2026-67277 - No PoCs or research available. ``` **Actionable guidance** Immediate patching is recommended, along with thorough log inspection for signs of compromise, including failed login attempts with the username `-2` or creation of an `ops` account. The attack originated from specific IPs and involved hosting the files `ftpsrv.py`, `launch.sh`, and `serve.py`, which are IoCs. Unknown traffic to and from ports 21, 80, and 1414, combined with identification of rogue users, is a high-confidence indicator of compromise. Take SSH access offline and do not expose it to the public internet until the patch is applied. If indicators of compromise are found, rebuilding the device from a fresh deployment may be necessary, as configuration artifacts may persist and can be difficult to identify. ## 3. New 'ShieldCrash' zero-day exploit targets Microsoft Defender **Summary** Security researcher Nightmare Eclipse has released a new Microsoft Defender zero-day exploit called ShieldCrash. This exploit allows for privilege escalation on fully patched Windows systems, highlighting ongoing vulnerabilities and the need for more comprehensive patching by Microsoft. **Category:** Zero-day **Industry:** Multiple **Sources** - https://www.securityweek.com/new-shieldcrash-zero-day-exploit-targets-microsoft-defender/ - Internal OSec Research **Analyst comments** Nightmare Eclipse has unveiled ShieldCrash, a new zero-day targeting fully patched Windows systems. It allows arbitrary file reads with SYSTEM privileges and can potentially dump the SAM database. This exploit circumvents Microsoft's recent fixes for ShieldBreak (CVE-2026-69414), itself a bypass for RoguePlanet (CVE-2026-50656). We compiled and tested the exploit in our lab environment; while it functioned, it was unreliable. We also observed results consistent with external researchers: output file sizes do not match the targeted files (such as SAM and ELAM). This may indicate the exploit requires further development before reliable weaponization. The researcher's social media also notes that the PoC can likely reuse code from Bluehammer, or chain with it, to access other sensitive Windows-related files such as SAM (which cannot typically be read while Windows is running). **Actionable guidance** No patch is currently available for this vulnerability. Defender signature updates may include detections for this exploit; ensure AV/EDR definitions are kept current. Unexplained Defender alerts involving eicar.com that cannot be attributed to routine security testing may indicate abuse of this PoC. This is particularly significant when correlated with phishing, external device compromise, credential theft, or other initial access indicators. ## 4. BlueMoon exploit kit used by Chinese espionage actors **Summary** Multiple China-linked cyber-espionage groups have simultaneously exploited a previously unknown Google Chrome vulnerability using an exploit kit named BlueMoon, raising questions about their coordination and the source of their tools. **Category:** State-Sponsored Espionage **Industry:** Public Administration and Government, Mining and Mineral Trading, Aerospace, Manufacturing **Sources** - https://therecord.media/china-hackers-chrome-browser-zero-day-multiple-groups - https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit - https://nvd.nist.gov/vuln/detail/cve-2026-87491 - https://thehackernews.com/2026/09/chrome-v8-zero-day-exploited-in-wild.html **Analyst comments** Researchers identified at least four Chinese state-linked cyber-espionage groups using a shared exploit kit dubbed BlueMoon. The kit exploits Chrome V8 vulnerabilities (CVE-2026-85046 and CVE-2026-87491) and a Windows ALPC zero-day patched in September's Patch Tuesday (CVE-2026-85880), with activity observed since late August. Targeted organizations include U.S. defense contractors, NGOs, and Southeast Asian government agencies. The groups share the kit but deploy distinct malware, indicating separate operations with a common tool supply. There is also evidence that AI aided in BlueMoon's development through reverse-engineering of public Chromium patch information. However, it should be assumed that most sophisticated threat actors incorporate AI in some capacity during tool development. Initial access is through phishing and spear-phishing against organizations in the targeted regions and sectors. Once a victim opens the email and clicks the link, they are redirected to an attacker-controlled site that executes the Chrome V8 vulnerabilities to achieve OS-level access. The kit then queries operating system details to determine exploitability and attempts privilege escalation via the Windows ALPC vulnerability (CVE-2026-85880). The malware subsequently executes shellcode to download a group-specific second stage. The following is a breakdown of the groups using this kit. - TA412 / APT31 / Violet Typhoon - Deploys GemStone malware, targets US NGOs, mining, and physical commodity trading organizations - UNK_LateNight - Deploys ShadowPad and targets US aerospace organizations - UNK_DoubleCheck - Deploys RustLoader, targeting Vietnamese manufacturing - UNK_QuietRacket - Deploys .NET payloads, targeting governments, consulting, and finance sectors in Southeast Asia Each group's malware and persistence tactics differ. TA412 favors GemStone, which installs as a Chrome/Chromium-based browser extension masquerading as a Google Gemini AI extension. It records user activity and steals credentials when Chrome or Chromium-based applications are in use. The extension drops `background.js` on the user's desktop, per VirusTotal analysis, and makes regular JSON requests to `/api/extension/{id}/ingest` for data exfiltration. The other three groups use COM hijacking and scheduled tasks for persistence. The exploit kit follows a distinctive execution pattern useful for threat hunting: a Chrome or Chromium-based browser spawns `cmd.exe`, followed by `curl.exe` execution, which downloads and executes `msgbox.exe`. **Actionable guidance** The most effective mitigation is applying the latest available patches for both Chrome and Windows, preventing further initial compromise. Applying the Chrome patch will prevent initial infection, with the Windows patch preventing privilege escalation after initial compromise. Organizations that may have been affected should look for suspicious downloads initiated by `curl.exe`, unknown scheduled tasks, unusual file paths referenced in `InprocServer32` registry entries within userland directories, and unknown Chrome/Chromium browser extensions claiming to be Google Gemini.