Cyber Threat Brief — March 12 2026

1. n8n RCE (CVE-2025-68613) — CISA KEV, Active Exploitation Confirmed

Summary

n8n’s workflow expression evaluation sandbox is being actively exploited in the wild. CISA added CVE-2025-68613 (CVSS 9.9) to its KEV catalog on March 11 — the first n8n flaw to make the list. Over 24,700 unpatched instances remain internet-exposed, with 12,300+ in North America alone. Any authenticated user can escape the expression sandbox and execute arbitrary code with the privileges of the n8n process. A secondary critical flaw (CVE-2026-27577, CVSS 9.4) was disclosed the same day by Pillar Security, classified as “additional exploits” in the same evaluation system. FCEB agencies must patch by March 25, 2026.

What’s New (Last 24 Hours)

• CISA added CVE-2025-68613 to KEV on 2026-03-11 based on confirmed active exploitation evidence.
• Pillar Security disclosed CVE-2026-27577 (CVSS 9.4) — a second exploitable path in the same n8n expression evaluator (Hacker News, 2026-03-11).
• Shadowserver data: 24,700+ unpatched public instances as of early March 2026; no specific exploit mechanism details released publicly.
• Fixed in n8n versions 1.120.4, 1.121.1, and 1.122.0 (December 2025 patch).

Actionable Intel

Artifact	Type	ATT&CK Technique	Data Source	How to Use
n8n process spawning unexpected child processes (shell, python, etc.) post-authentication	TTP	T1059	EDR process telemetry	Alert on node / n8n parent process spawning interpreter children (bash, sh, python, cmd)
Authenticated HTTP POST to n8n /rest/ or /webhook/ endpoints resulting in OS execution	TTP	T1059.007	Web/App logs	Hunt for n8n HTTP 200 responses on /rest/workflows/ followed by unexpected outbound connections
Outbound connections from n8n process to external IPs following workflow execution	TTP	T1071.001	EDR network telemetry, Proxy	Alert on n8n process initiating outbound connections to non-whitelisted IPs
n8n version strings < 1.120.4 in HTTP response headers or service banners	Indicator	T1190	Asset inventory, Web server logs	Inventory exposed n8n instances; version compare against patched baseline
/jffs/.asusrouter file creation (co-infection indicator from KEV exposure)	Indicator	T1505	File integrity monitoring	Flag unexpected hidden files in web app directories

Potential Detection Coverage Based on MITRE ATT&CK Technique

Source	Detections	Coverage
Splunk	JetBrains TeamCity RCE Attempt · Ollama Possible RCE via Model Loading · Confluence Pre-Auth RCE via OGNL Injection	No n8n-specific Splunk ESCU rule exists. Closest coverage: NodeJS RCE web patterns (URL-based detection via web logs). Gap — recommend creating a custom SPL hunting for n8n process ancestry anomalies (n8n → shell/python child).
Elastic	React2Shell (CVE-2025-55182) Exploitation Attempt · GitHub Actions Workflow Modification Blocked	No n8n-specific Elastic rule. Workflow expression injection pattern is analogous to React2Shell’s server-side code execution path — adapt that rule’s process spawn logic to n8n parent process.
Sigma	Potential RCE Exploitation Attempt In NodeJS · Windows Defender AMSI Trigger Detected	Sigma’s NodeJS RCE rule is the closest match — it targets NodeJS process execution anomalies that align with n8n’s runtime. Tune the nodejs_rce_exploitation_attempt.yml rule to scope specifically to the n8n process on applicable log sources.

Sources

• CISA Flags Actively Exploited n8n RCE Bug as 24,700 Instances Remain Exposed — Published 2026-03-11
• CISA KEV — CVE-2025-68613 — Published 2026-03-11
• Shadowserver n8n Exposure Dashboard — Ongoing

---

2. UNC6426: nx npm Supply Chain → GitHub OIDC → AWS Admin in 72 Hours

Summary

Google’s Cloud Threat Horizons H1 2026 report detailed a full cloud compromise executed by threat actor UNC6426 — all stemming from the August 2025 nx npm supply chain attack. The attacker leveraged stolen GitHub Personal Access Tokens (PATs) extracted by the QUIETVAULT credential stealer to abuse GitHub-to-AWS OIDC trust, escalate to AWS administrator, exfiltrate S3 data, destroy EC2/RDS production instances, and rename all victim GitHub repos to public /s1ngularity-repository-* strings. Total time from stolen token to full cloud destruction: under 72 hours.

What’s New (Last 24 Hours)

• Google Cloud Threat Horizons H1 2026 published 2026-03-11 — first public case study of UNC6426 post-compromise chain.
• Full attack path documented: QUIETVAULT stealer → GitHub PAT → Nord Stream CICD secret extraction → OIDC STS token → CloudFormation stack deploy → AdministratorAccess IAM role → S3 exfil + EC2/RDS destruction.
• Detection hints published: hunt for CreateStack events with CAPABILITY_NAMED_IAM + AdministratorAccess policy attachment; hunt for repo rename events matching s1ngularity-repository-* pattern.

Actionable Intel

Artifact	Type	ATT&CK Technique	Data Source	How to Use
QUIETVAULT JavaScript credential stealer (postinstall script in trojanized nx package)	Malware	T1195.002	EDR file/process telemetry	Alert on postinstall scripts spawning processes that read env variables or access ~/.npmrc, ~/.gitconfig, SSH key paths
GitHub PAT exfiltration to public repo /s1ngularity-repository-1	TTP	T1552.001	GitHub Audit Logs	Alert on GitHub repo creation events with pattern s1ngularity-repository-*; monitor for PAT usage from anomalous geo/IP
Nord Stream tool (--aws-role parameter) used to extract CI/CD secrets	Tool	T1552.004	CI/CD logs, CloudTrail	Hunt for sts:AssumeRoleWithWebIdentity calls from GitHub Actions service accounts outside expected workflow context
AWS CreateStack with CAPABILITY_NAMED_IAM + arn:aws:iam::aws:policy/AdministratorAccess	TTP	T1098	AWS CloudTrail	Alert on cloudformation:CreateStack events attaching AdministratorAccess managed policy to new IAM roles
GitHub repo bulk rename to s1ngularity-repository-[random] + visibility set to public	TTP	T1485	GitHub Audit Logs	Alert on bulk repository rename events + visibility change to public within a short time window
EC2/RDS instance termination following IAM privilege escalation	TTP	T1485	CloudTrail	Correlate IAM role creation events with subsequent ec2:TerminateInstances / rds:DeleteDBInstance calls

Potential Detection Coverage Based on MITRE ATT&CK Technique

Source	Detections	Coverage
Splunk	AWS Create Policy Version to allow all resources · ASL AWS SAML Update identity provider · AWS IAM Successful Group Deletion	Strong IAM policy attachment coverage via AWS Create Policy Version to allow all resources — directly maps to UNC6426’s CloudFormation stack deploying AdministratorAccess. Tune to also alert on cloudformation:CreateStack with that policy ARN specifically.
Elastic	AWS IAM AdministratorAccess Policy Attached to Role · AWS IAM Assume Role Policy Update · AWS Access Token Used from Multiple Addresses	Excellent direct coverage: AdministratorAccess Policy Attached to Role precisely matches UNC6426’s privilege escalation step. AWS Access Token Used from Multiple Addresses would catch the stolen STS token being reused. High-fidelity detections — enable these if not already active.
Sigma	Github New Secret Created · AWS Suspicious SAML Activity · AWS Root Credentials	Sigma covers GitHub secret creation (useful for PAT monitoring) and SAML/OIDC abuse patterns. No direct rule for the s1ngularity-repository-* rename pattern — recommend creating one targeting GitHub audit log repo.rename events with that string pattern.

Sources

• UNC6426 Exploits nx npm Supply-Chain Attack to Gain AWS Admin Access in 72 Hours — Published 2026-03-11
• Google Cloud Threat Horizons Report H1 2026 — Published 2026-03-11

---

3. KadNap Botnet — ASUS Routers Hijacked via Kademlia DHT P2P C2

Summary

Black Lotus Labs (Lumen) has published a full analysis of KadNap, a sophisticated router botnet first detected in August 2025 that has now compromised 14,000+ edge devices — mostly ASUS routers, but also targeting any ARM/MIPS edge device with unpatched RCE vulnerabilities. What makes KadNap notable is the use of a custom Kademlia DHT (Distributed Hash Table) implementation to hide C2 server IPs inside a peer-to-peer network, making traditional blocklist-based detection useless. Infected nodes are then leased as anonymous proxies through the “Doppelgänger” criminal proxy service (believed to be a rebrand of the Faceless service that previously powered the TheMoon botnet). Over 60% of victims are US-based. Lumen has blocked all known C2 traffic and released IoCs into public feeds.

What’s New (Last 24 Hours)

• Lumen Black Lotus Labs full technical analysis published 2026-03-10 with IoCs and malware behavior.
• THN follow-up published 2026-03-12 with additional victim geographic breakdown and Doppelgänger proxy service linkage.
• Ars Technica coverage 2026-03-12 — emphasis on takedown-resistance due to DHT C2.
• Key artifacts: dropper script aic.sh pulled from 212.104.141[.]140; persistence ELF renamed to .asusrouter; cron job runs at 55-minute mark hourly; executable renamed to kad; port 22 closed by fwr.sh and /tmp/.sose files.
• Doppelgänger proxy service: doppelganger[.]shop — launched May/June 2025; claims 50+ country coverage.
• C2 IPs from secondary botnet version: 74.194.191[.]52, 38.59.219[.]27, 83.252.42[.]112.
• SHA-256: 691e4ec280aaff33270f33a9bb48a3fc38e2bd91c7359e687e3f0bd682f20b54

Actionable Intel

Artifact	Type	ATT&CK Technique	Data Source	How to Use
212.104.141[.]140 — Initial dropper C2 (aic.sh download server)	IP IOC	T1190	Firewall/proxy logs, DNS	Block/alert on outbound connections to this IP from SOHO/edge device ranges
74.194.191[.]52 · 38.59.219[.]27 · 83.252.42[.]112 — Secondary botnet C2 IPs	IP IOC	T1571	Firewall, NetFlow	Alert on outbound traffic to these IPs from router/gateway management segments
/jffs/.asusrouter — Hidden persistence script file path	File IOC	T1053.003	File integrity monitoring, EDR	Alert on creation of .asusrouter hidden file in /jffs/ on router filesystems
kad — ELF binary filename (Kademlia DHT implant)	File IOC	T1027	EDR file telemetry	Alert on new ELF binary creation with filename kad on Linux/embedded systems
Cron job created to run at minute 55 every hour pulling remote shell script	TTP	T1053.003	Cron/syslog, EDR	Hunt for cron entries containing external URLs or curl/wget at interval 55
fwr.sh / /tmp/.sose — Scripts closing SSH (port 22) and extracting C2 IP lists	TTP	T1562.004	System logs, network monitoring	Alert on iptables DROP rules being applied to port 22 by non-administrative processes
691e4ec280aaff33270f33a9bb48a3fc38e2bd91c7359e687e3f0bd682f20b54 — KadNap ELF SHA-256	Hash IOC	T1027	EDR, VirusTotal	Hash-match on file scan telemetry
doppelganger[.]shop — Criminal proxy service domain	Domain IOC	T1090	DNS, Proxy logs	Alert on DNS resolution or HTTP connections to this domain from enterprise egress
NTP query burst followed by Kademlia DHT peer lookups (non-standard UDP traffic on router)	TTP	T1071	NetFlow, PCAP	Hunt for routers initiating high-volume UDP traffic to random IPs after NTP sync

Potential Detection Coverage Based on MITRE ATT&CK Technique

Source	Detections	Coverage
Splunk	Linux Add Files In Known Crontab Directories · Linux Possible Append Cronjob Entry on Existing Cronjob File · Cisco Isovalent - Cron Job Creation	Solid cron-persistence coverage maps directly to KadNap’s hourly cron job mechanism. The /jffs/.asusrouter cron payload would trigger linux_add_files_in_known_crontab_directories. However, no SOHO router-specific telemetry integration — these rules assume Linux EDR data, which most ASUS router environments won’t ship.
Elastic	Cron Job Created or Modified · Executable Bit Set for Potential Persistence Script · Potential Persistence via File Modification	File modification and cron creation rules would catch KadNap persistence if Elastic Agent is deployed on managed Linux systems. Primary gap: ASUS routers typically cannot run Elastic Agent. Best coverage comes from network-layer detection — alert on the C2 IPs at the perimeter firewall/DNS layer.
Sigma	Persistence Via Cron Files · Modifying Crontab · Scheduled Cron Task/Job - Linux	Good cron detection coverage. These rules would fire if syslog data from the router is shipped to a SIEM. Pair with network-layer IoC blocking (IPs above) for organizations without router-level log ingestion.

Sources

• Silence of the Hops: The KadNap Botnet — Published 2026-03-10
• KadNap Malware Infects 14,000+ Edge Devices to Power Stealth Proxy Botnet — Published 2026-03-12
• 14,000 routers infected by malware highly resistant to takedowns — Published 2026-03-12

---

4. CISA Triple KEV: SolarWinds WHD + Ivanti EPM + Workspace One SSRF

Summary

CISA added three actively exploited enterprise vulnerabilities to KEV on March 9, 2026. The most urgent: SolarWinds Web Help Desk’s AjaxProxy deserialization bug (CVE-2025-26399, CVSS 9.8) is being actively exploited by the Warlock ransomware crew for initial access. The Ivanti Endpoint Manager credential-leak auth bypass (CVE-2026-1603, CVSS 8.6) has a known exploitation IP. The legacy Workspace One SSRF (CVE-2021-22054) is being chained with other SSRF vulns in coordinated campaigns. FCEB deadline for SolarWinds patch: today, March 12, 2026. Remaining two due March 23, 2026.

What’s New (Last 24 Hours)

• CISA KEV triple-add published 2026-03-09; THN coverage 2026-03-11.
• Warlock ransomware crew confirmed as exploitation actor for CVE-2025-26399 (SolarWinds WHD AjaxProxy deserialization → RCE).
• CVE-2026-1603 exploitation IP confirmed: 103.69.224[.]98 (Ivanti EPM auth bypass).
• CVE-2021-22054 (Workspace One SSRF) being chained with other SSRF vulns — GreyNoise flagged coordinated multi-product SSRF campaign.
• FCEB deadline for SolarWinds WHD patch is today (2026-03-12).

Actionable Intel

Artifact	Type	ATT&CK Technique	Data Source	How to Use
103.69.224[.]98 — Exploitation IP for Ivanti EPM CVE-2026-1603 auth bypass	IP IOC	T1190	Firewall/WAF logs, Web logs	Block/alert on inbound connections from this IP to Ivanti EPM management interfaces
HTTP POST to /helpdesk/WebObjects/Helpdesk.woa/ws/ (SolarWinds WHD AjaxProxy endpoint) with deserialization payload patterns	TTP	T1190	Web/App logs, WAF	Alert on requests to WHD AjaxProxy endpoint with unexpected content types or large binary payloads
Unauthenticated outbound HTTP requests from Workspace One UEM server to internal/arbitrary IPs (SSRF)	TTP	T1090.002	Web proxy, Firewall	Alert on UEM server initiating outbound connections to RFC1918 ranges or metadata services
Warlock ransomware: SolarWinds WHD exploitation for initial access → lateral movement	TTP	T1133	Auth logs, VPN/RDP logs	Alert on administrative access from SolarWinds WHD process context; hunt for LOLBin execution under WHD service account
Ivanti EPM stored credential leak via unauthenticated path bypass	TTP	T1078	Web logs, Auth logs	Hunt for successful access to Ivanti EPM API endpoints without preceding authentication events; correlate with 103.69.224[.]98

Potential Detection Coverage Based on MITRE ATT&CK Technique

Source	Detections	Coverage
Splunk	Ivanti Connect Secure SSRF in SAML Component · Ivanti Sentry Authentication Bypass · Ivanti EPM SQL Injection Remote Code Execution · VMware Workspace ONE Freemarker Server-side Template Injection	Strong Ivanti-family and Workspace One coverage. Ivanti EPM SQL Injection RCE is close to CVE-2026-1603’s auth-bypass pattern — adapt URI pattern to match the EPM credential-leak endpoint. No SolarWinds WHD-specific ESCU rule exists; recommend hunting web logs for the AjaxProxy endpoint.
Elastic	Suspicious SolarWinds Web Help Desk Java Module Load or Child Process · Command Execution via SolarWinds Process	Direct SolarWinds WHD exploit coverage via Suspicious SolarWinds Web Help Desk Java Module Load — this rule was purpose-built for WHD exploitation and maps precisely to CVE-2025-26399’s deserialization-to-RCE path. Enable immediately if running SolarWinds WHD.
Sigma	VMToolsd Suspicious Child Process · Potential Persistence Via VMwareToolBoxCmd.EXE	Sigma has VMware/Workspace One process-level persistence rules but no SolarWinds WHD or Ivanti EPM-specific rules. For WHD, adapt the vmtoolsd_susp_child_process.yml pattern to the WHD Java process; hunt for unexpected cmd/powershell children under the WHD service.

Sources

• CISA Flags SolarWinds, Ivanti, and Workspace One Vulnerabilities as Actively Exploited — Published 2026-03-11
• CISA KEV — Three Vulnerabilities Added 2026-03-09 — Published 2026-03-09
• U.S. CISA adds Ivanti EPM, SolarWinds, and Omnissa Workspace One flaws to KEV — Published 2026-03-10

---

5. March 2026 Patch Tuesday — Six “More Likely Exploited” LPE Flaws

Summary

March 2026 Patch Tuesday dropped 80+ patches, with zero actively exploited zero-days but six vulnerabilities rated “more likely to be exploited” — all local privilege escalation paths to SYSTEM or Admin. The most notable: ATBroker.exe (Windows Accessibility Infrastructure, CVE-2026-24291) is a particularly prized target because it escalates all the way to SYSTEM (not just Admin), capable of bypassing EDR tools. Print Spooler gets another authenticated RCE (CVE-2026-23669). Two Office RCE bugs (CVE-2026-26110 and CVE-2026-26113) are exploitable via the Preview Pane. An Excel XSS bug (CVE-2026-26144) could coerce the Copilot Agent to exfiltrate data.

What’s New (Last 24 Hours)

• Microsoft released March 2026 Patch Tuesday updates on 2026-03-11 patching 84 CVEs.
• Six LPE vulnerabilities flagged “more likely to be exploited”: CVE-2026-24289 and CVE-2026-26132 (Windows Kernel use-after-free), CVE-2026-23668 (Windows Graphics race condition), CVE-2026-24294 (SMB Server improper auth), CVE-2026-25187 (Winlogon), CVE-2026-24291 (ATBroker.exe).
• CVE-2026-24291 (ATBroker.exe): SYSTEM-level — particularly high-value for post-compromise LPE.
• CVE-2026-23669: Print Spooler authenticated RCE — another in a long line of Spooler bugs reaching weaponization.
• CVE-2026-26144: Excel XSS capable of triggering Copilot Agent data exfiltration — novel attack class.
• Two publicly disclosed (not yet exploited) zero-days: CVE-2026-21262 (SQL Server SQLAdmin priv), CVE-2026-26127 (.NET DoS).

Actionable Intel

Artifact	Type	ATT&CK Technique	Data Source	How to Use
ATBroker.exe spawning unexpected child processes or registry key modifications under HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility	TTP	T1068	EDR process/registry telemetry	Alert on ATBroker.exe spawning cmd/powershell children or writing registry outside expected Accessibility paths
Print Spooler service (spoolsv.exe) spawning unexpected child processes (CVE-2026-23669)	TTP	T1068	EDR process telemetry	Alert on spoolsv.exe spawning cmd, wscript, powershell, or cscript children
Kernel use-after-free exploitation patterns: process from non-SYSTEM parent acquiring SYSTEM token (CVE-2026-24289, CVE-2026-26132)	TTP	T1068	EDR process integrity	Alert on user-mode process integrity change from Medium to System without explicit service context
SMB Server improper auth (CVE-2026-24294): unexpected SMB session authentication without prior Kerberos/NTLM negotiation	TTP	T1021.002	Windows Security event logs	Alert on Event ID 4624/4625 with unusual logon type from SMB sessions targeting unpatched systems
Winlogon (winlogon.exe) creating unexpected child processes or writing new DLL paths (CVE-2026-25187)	TTP	T1547	EDR process/file telemetry	Alert on winlogon.exe spawning non-standard children or creating files in System32
Excel .xlsx file previewed in Outlook triggering network connections (CVE-2026-26110, CVE-2026-26113)	TTP	T1566.001	Email logs, EDR network telemetry	Hunt for Excel/Outlook preview pane process initiating outbound network connections

Potential Detection Coverage Based on MITRE ATT&CK Technique

Source	Detections	Coverage
Splunk	Print Spooler Adding A Printer Driver · Print Spooler Failed to Load a Plug-in · Windows Privilege Escalation System Process Without System Parent · Windows Privilege Escalation User Process Spawn System Process	Excellent Spooler and kernel privilege escalation coverage. Windows Privilege Escalation System Process Without System Parent directly catches the kernel UAF LPE pattern for CVE-2026-24289/26132. Ensure print_spooler_adding_a_printer_driver is tuned for CVE-2026-23669 exploitation context.
Elastic	Unusual Print Spooler Child Process · Suspicious PrintSpooler Service Executable File Creation · Expired or Revoked Driver Loaded · First Time Seen Driver Loaded	Strong Print Spooler and kernel driver coverage. Unusual Print Spooler Child Process is the primary rule for CVE-2026-23669. First Time Seen Driver Loaded catches novel kernel drivers often used for UAF privilege escalation chains.
Sigma	Atbroker Registry Change · DCERPC SMB Spoolss Named Pipe · Winlogon Helper DLL · Winlogon Notify Key Logon Persistence	Sigma has excellent targeted coverage for all the high-priority CVEs: Atbroker Registry Change maps directly to CVE-2026-24291 exploitation; Winlogon Notify Key Logon Persistence covers CVE-2026-25187; DCERPC SMB Spoolss Named Pipe covers Print Spooler abuse. Enable all four if not already active.

Sources

• Microsoft patches 80+ vulnerabilities, six flagged as “more likely” to be exploited — Published 2026-03-11
• Microsoft Patches 79 Vulnerabilities Including Two Publicly Disclosed Zero-Days — Published 2026-03-11
• The March 2026 Security Update Review — ZDI — Published 2026-03-10