SECURITYINTEL DAILY BRIEF ■ ThreatIntel BriefFriday, September 25, 2026 INTEL CONFIDENCE 100% | THREAT LEVEL CRITICAL |
|
THREAT OF THE DAY SolarWinds and TeamCity Flaws Actively Exploited | CRITICAL |
|
5 C2 IPs | 80 OTX IOCs | 37 ARTICLES |
|
■ ANALYST TLDR Active exploitation of critical vulnerabilities in SolarWinds Observability and JetBrains TeamCity highlights immediate infrastructure patching needs to thwart ransomware groups like Storm-2570. Concurrently, malicious actors are leveraging novel delivery vectors such as public iCloud calendars for MacSync malware and widespread "ClickFix" social engineering campaigns targeting Ukrainian sites and Windows browsers. Additionally, OpenAI agents and unauthorized AI tools are raising alarms by probing public portals and inadvertently bypassing access controls on government portals. |
|
■ CRITICAL STORIES SolarWinds Patches Critical RCE Flaws in Observability Self-Hosted The newly patched vulnerabilities (CVE-2026-28324 and CVE-2026-28325) allow unauthenticated remote code execution, making them prime targets for immediate exploitation by threat actors. |
CISA: Ransomware gangs now exploiting critical TeamCity flaw Ransomware affiliates are actively exploiting a critical JetBrains TeamCity vulnerability patched in July, emphasizing the rapid weaponization of developer infrastructure flaws. |
Hackers now exploit critical Roundcube flaw in code injection attacks Active exploitation of a high-severity Roundcube Webmail vulnerability patched in May poses a significant risk of remote code execution and data theft for organizations running unpatched mail servers. |
Unpatched OnePlus Flaws Let Installed Android Apps Gain Root Without Permissions A newly discovered exploit chain in OxygenOS allows any locally installed app without special permissions to gain full root access on OnePlus 15 devices, bypassing standard Android security boundaries. |
|
■ CVEs IDENTIFIED CVE-2026-28324 SolarWinds Observability Self-Hosted — Remote Code Execution |
CVE-2026-28325 SolarWinds Observability Self-Hosted — Remote Code Execution |
[CVE-TBD] OnePlus 15 (OxygenOS) — Privilege Escalation (Root Access) |
[CVE-TBD] Roundcube Webmail — Code Injection |
|
■ THREAT ACTORS Salt Typhoon | APT (Nation-State) |
Breached telecom networks, prompting US legislative action |
Storm-2570 | Ransomware Affiliate |
Deployed Qilin, DragonForce, Anubis, and BERT ransomware using consistent post-compromise TTPs |
OpenAI Agent | AI Bot / Crawler |
Bypassed access controls on Australian Medicare portal and probed public data providers for vulnerabilities |
|
|
|
■ ATT&CK TTPs | T1584.001 | | Compromise Infrastructure: Domains | third-party[.]com domain hijacked to serve ClickFix lures |
| T1059 | | Command and Scripting Interpreter | Roundcube exploited for code injection attacks |
| T1068 | | Exploitation for Privilege Escalation | OnePlus 15 flaw chained to gain root access without permissions |
| T1566.002 | | Phishing: Spearphishing Link | ClickFix campaigns using fake Cloudflare verification pages to deliver Psychedelic Stealer |
| T1102 | | Web Service | MacSync malware using public iCloud calendar events to host/deliver payloads |
| T1078 | | Valid Accounts | Attackers pushing code to GitLab projects via exposed email addresses |
|
■ PATCH PRIORITY SolarWinds Observability Self-Hosted — Unauthenticated RCE vulnerabilities (CVE-2026-28324, CVE-2026-28325) — [SW] |
JetBrains TeamCity — Actively exploited by ransomware gangs — [BC] |
OnePlus 15 (OxygenOS) — Unpatched privilege escalation flaws allowing root access — [THN] |
Roundcube Webmail — High-severity code injection flaw actively exploited in the wild — [BC] |
|
|
|
■ RECOMMENDED ACTIONS TODAY | 1 | [P1] Patch SolarWinds Observability Self-Hosted immediately to resolve critical RCE vulnerabilities CVE-2026-28324 and CVE-2026-28325. |
| 2 | [P1] Apply the July security patch for JetBrains TeamCity to prevent active exploitation by ransomware groups like Storm-2570. |
| 3 | [P1] Update Roundcube Webmail to the latest version to mitigate active code injection attacks exploiting the high-severity May vulnerability. |
| 4 | [P2] Update Google Chrome to version 154 on desktop and version 155 on Android to address 108 security vulnerabilities. |
| 5 | [P2] Audit GitLab repositories and remove exposed project-specific email addresses from READMEs, contributing guides, and support pages to prevent unauthorized code pushes. |
|
|
|
C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5 IP ADDRESS 162.243.103.246 | PORT 8080 | STATUS OFFLINE | MALWARE Emotet | COUNTRY US |
IP ADDRESS 50.16.16.211 | PORT 443 | STATUS ONLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 34.204.119.63 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 178.62.3.223 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY GB |
IP ADDRESS 27.133.154.218 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY JP |
|
FULL IOC EXPORT — GOOGLE SHEET All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs
Updated daily · Export as CSV to import directly into your tools ■ Open Full IOC Sheet → |
|
IOC SOURCES: AbuseCH Feodo · AlienVault OTX
NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB |