SECURITYINTEL DAILY BRIEF ■ ThreatIntel BriefTuesday, September 22, 2026 INTEL CONFIDENCE 100% | THREAT LEVEL CRITICAL |
|
THREAT OF THE DAY Active Exploitation of Critical Linux Kernel Flaws | CRITICAL |
|
5 C2 IPs | 55 OTX IOCs | 38 ARTICLES |
|
■ ANALYST TLDR Active exploitation of three Linux kernel vulnerabilities has prompted urgent warnings from CISA, while a newly disclosed "Click2Shell" CSRF vulnerability in WordPress Core threatens servers with remote PHP execution. Concurrently, North Korean threat actors are intensifying campaigns targeting developers and IT providers, utilizing fake job interviews and compromised video calls to deploy backdoors. Additionally, a highly sophisticated campaign is distributing fake LastPass Authenticator installers on GitHub that leverage Microsoft-signed drivers to disable EDR and antivirus systems. |
|
■ CRITICAL STORIES CISA alerts of active exploitation of three Linux kernel flaws CISA has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog. Active exploitation of these flaws allows threat actors to achieve privilege escalation and execute arbitrary code, posing a severe threat to enterprise Linux environments. |
WordPress Click2Shell flaw lets hackers execute PHP on the server A newly disclosed Cross-Site Request Forgery (CSRF) vulnerability dubbed "Click2Shell" in WordPress Core allows attackers to execute arbitrary PHP code on the hosting server. A public proof-of-concept exploit increases the immediate risk of widespread exploitation. |
Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer Attackers are hosting fake LastPass Authenticator installers on GitHub that deploy a Microsoft-signed kernel driver. This driver uses Bring Your Own Vulnerable Driver (BYOVD) techniques to disable over 145 security and EDR products before executing the "Rapuncel" information stealer. |
Contagious Interview Campaign Compromises 30,000 Devices, Steals $10.71M in Crypto The North Korean "Contagious Interview" campaign has successfully compromised over 30,000 devices globally. By targeting developers with fake job interviews, the threat actors have siphoned millions in cryptocurrency, highlighting the extreme efficacy of their social engineering tactics. |
|
■ CVEs IDENTIFIED [CVE-TBD-1] Linux Kernel — Privilege Escalation and Arbitrary Code Execution |
[CVE-TBD-2] WordPress Core — Click2Shell Cross-Site Request Forgery (CSRF) leading to RCE |
[CVE-TBD-3] Microsoft Windows (BYOVD Driver) — Security Feature Bypass and EDR Evasion |
|
■ THREAT ACTORS Jade Sleet | Nation-State (North Korea) |
Compromised an Indian IT provider to deploy FLATROOF and ROOFDECK backdoors. |
Contagious Interview Actors | Nation-State (North Korea) |
Compromised 30,000 devices and stole crypto via fake job interview lures. |
ShinyHunters | Cybercrime / Extortion |
Hijacked the dark web leak site of the rival Cl0p ransomware gang. |
|
|
|
■ ATT&CK TTPs | T1068 | | Exploitation for Privilege Escalation | Active exploitation of Linux kernel flaws. |
| T1562.001 | | Disable or Modify Tools | Fake LastPass installer installs a Microsoft-signed driver to kill 145 AV/EDR products. |
| T1204.002 | | Malicious File | Fake LastPass Authenticator installers downloaded from GitHub. |
| T1566 | | Phishing | Contagious Interview campaign targeting developers with fake job offers; Rust team targeted via video calls. |
| T1195.002 | | Compromise Software Supply Chain | CrowdSec source code stolen via TanStack supply chain attack. |
| T1027.003 | | Steganography | TerminalFix campaign deploying reverse tunnels using PNG steganography. |
|
■ PATCH PRIORITY Linux Kernel — Actively exploited privilege escalation flaws — CISA |
WordPress Core — Click2Shell CSRF vulnerability allows remote PHP execution on the server — WordPress |
Microsoft Windows — Vulnerable to BYOVD attacks using fake LastPass installers to disable EDR — LastPass/Delphos Labs |
Microsoft Excel — September 2026 security update broke copy-and-paste functionality — Microsoft |
|
|
|
■ RECOMMENDED ACTIONS TODAY | 1 | [P1] Patch all Linux systems immediately to address the three actively exploited Linux kernel vulnerabilities [CVE-TBD-1] flagged by CISA. |
| 2 | [P1] Apply security updates or workarounds for WordPress Core to mitigate the "Click2Shell" CSRF vulnerability [CVE-TBD-2] and prevent unauthorized PHP execution. |
| 3 | [P1] Block and audit the execution of unauthorized Microsoft-signed drivers and monitor for GitHub-hosted fake LastPass Authenticator installers to prevent BYOVD attacks [CVE-TBD-3]. |
| 4 | [P2] Audit and restrict third-party application credentials, specifically Ribon apps on BigCommerce platforms, to prevent malicious script injections. |
| 5 | [P2] Migrate Microsoft Entra ID users from SMS first-factor authentication to phishing-resistant passkeys ahead of the February 2027 retirement. |
|
|
|
C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5 IP ADDRESS 162.243.103.246 | PORT 8080 | STATUS OFFLINE | MALWARE Emotet | COUNTRY US |
IP ADDRESS 50.16.16.211 | PORT 443 | STATUS ONLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 34.204.119.63 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 178.62.3.223 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY GB |
IP ADDRESS 27.133.154.218 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY JP |
|
FULL IOC EXPORT — GOOGLE SHEET All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs
Updated daily · Export as CSV to import directly into your tools ■ Open Full IOC Sheet → |
|
IOC SOURCES: AbuseCH Feodo · AlienVault OTX
NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB |