SECURITYINTEL DAILY BRIEF ■ ThreatIntel BriefThursday, September 24, 2026 INTEL CONFIDENCE 100% | THREAT LEVEL CRITICAL |
|
THREAT OF THE DAY Active Exploitation of Check Point VPN RCE Vulnerability | CRITICAL |
|
5 C2 IPs | 43 OTX IOCs | 35 ARTICLES |
|
■ ANALYST TLDR Today's threat landscape is dominated by the active exploitation of critical enterprise edge infrastructure, notably a pre-authentication RCE in Check Point Security Gateways (CVE-2026-85102) and an actively exploited zero-day in Arista VeloCloud Orchestrator. Additionally, threat actors are leveraging advanced techniques, including malicious AI agent frameworks for automated e-commerce credit card skimming and supply chain compromises targeting the HashiCorp Terraform Registry and npm/PyPI repositories. Organizations must immediately prioritize patching internet-exposed gateways and securing developer pipelines against credential harvesting and unauthorized code execution. |
|
■ CRITICAL STORIES Check Point Security Gateway VPN RCE Actively Exploited Threat actors are actively exploiting CVE-2026-85102, a pre-authentication remote code execution vulnerability in the VPN certificate-handling functionality of Check Point Security Gateways, presenting an immediate risk of full network perimeter compromise. |
Arista Patches Actively Exploited VeloCloud Orchestrator Zero-Day Arista Networks has released urgent patches for an actively exploited zero-day vulnerability affecting VeloCloud Orchestrator (VCO) On-Prem deployments, highlighting an ongoing trend of targeting enterprise network management systems. |
Attackers Exploit Critical WordPress Flaw for Code Execution Threat actors are actively exploiting CVE-2026-87902 to write malicious files to disk and execute shell commands, escalating from initial scanning to active site takeover. |
Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry Threat actors have compromised the software supply chain by hosting malicious Go-based malware within the centralized HashiCorp Terraform Registry, marking a novel distribution vector for developer-targeted attacks. |
|
■ CVEs IDENTIFIED CVE-2026-85102 Check Point Security Gateway VPN — Pre-authentication remote code execution (RCE) via certificate-handling functionality. |
CVE-2026-87902 WordPress Core/Plugin — Arbitrary file write leading to remote code execution (RCE) via shell commands. |
[CVE-TBD] Arista Networks VeloCloud Orchestrator (VCO) On-Prem — Actively exploited zero-day vulnerability allowing unauthorized access or control. |
[CVE-TBD] cPanel CalDAV and CardDAV service — Privilege escalation allowing hosting accounts to run arbitrary code as root. |
|
■ THREAT ACTORS ShinyHunters | Cybercriminal / Extortion Group |
Breached FBIjobs.gov, defaced the site with a mascot image, and claimed theft of sensitive agent and applicant data. |
Ryuk Operator (Armenian National) | Ransomware Gang |
Sentenced to two years in federal prison for launching extortion attacks totaling $1.2 million. |
[Unknown] | Cybercriminal Group |
Deployed malicious AI agent frameworks to automate the compromise of over 100 e-commerce sites and steal 600,000 credit cards. |
|
|
|
■ ATT&CK TTPs | T1190 | | Exploit Public-Facing Application | Active exploitation of Check Point VPN (CVE-2026-85102), Arista VeloCloud Orchestrator, and WordPress (CVE-2026-87902). |
| T1195.002 | | Supply Chain Compromise: Compromised Software Dependency | Malicious MemTensor packages on npm/PyPI and malicious Terraform providers in HashiCorp Registry. |
| T1204.002 | | User Execution: Malicious File | ClickFix attacks using "third-party.com" placeholder domain to trick users into running PowerShell. |
| T1566.002 | | Phishing: Spearphishing Link | Fake Claude Max giveaway phishing Google credentials; device code phishing scams. |
| T1059.001 | | Command and Scripting Interpreter: PowerShell | ClickFix attacks executing PowerShell via fake Cloudflare verification pages. |
| T1539 | | Steal Web Credentials | "CLOSEDQUORUM" malware and "sckit" implant stealing browser credentials and crypto keys. |
|
■ PATCH PRIORITY Check Point — Security Gateway VPN (CVE-2026-85102) — Pre-authentication RCE actively exploited in the wild — BleepingComputer |
Arista Networks — VeloCloud Orchestrator (VCO) On-Prem — Zero-day vulnerability actively exploited in the wild — BleepingComputer |
WordPress — WordPress Core/Plugin (CVE-2026-87902) — Critical vulnerability actively exploited to write files and execute shell commands — BleepingComputer |
cPanel — CalDAV and CardDAV service — Privilege escalation to root allowing full server control — The Hacker News |
|
|
|
■ RECOMMENDED ACTIONS TODAY | 1 | [P1] Immediately apply security patches for Check Point Security Gateway VPN to address CVE-2026-85102 to prevent pre-auth RCE. |
| 2 | [P1] Patch Arista VeloCloud Orchestrator (VCO) On-Prem deployments immediately to mitigate the actively exploited zero-day vulnerability. |
| 3 | [P1] Update vulnerable WordPress installations to remediate CVE-2026-87902 and prevent remote code execution. |
| 4 | [P2] Audit and restrict access to GitLab private issue-by-email addresses to prevent unauthorized code commits and CI/CD job execution. |
| 5 | [P2] Update Google Chrome to version 154 to patch 108 vulnerabilities, including critical memory safety issues. |
|
|
|
C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5 IP ADDRESS 162.243.103.246 | PORT 8080 | STATUS OFFLINE | MALWARE Emotet | COUNTRY US |
IP ADDRESS 50.16.16.211 | PORT 443 | STATUS ONLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 34.204.119.63 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 178.62.3.223 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY GB |
IP ADDRESS 27.133.154.218 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY JP |
|
FULL IOC EXPORT — GOOGLE SHEET All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs
Updated daily · Export as CSV to import directly into your tools ■ Open Full IOC Sheet → |
|
IOC SOURCES: AbuseCH Feodo · AlienVault OTX
NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB |