Cyber Threat Brief — August 11 2026
⚠️ This report is AI-generated. Always validate findings.
1. N-able N-central Auth Bypass — CVE-2026-18577
TL;DR: Unauthenticated RMM platform takeover actively exploited by Storm-1175 for StormEncryptor ransomware. Second hotfix shipped August 10 — Hotfix 1 was insufficient. Upgrade N-central to 2026.3.1.10 immediately.
What’s New:
- N-able shipped Hotfix 2 (2026.3.1.10) August 10, superseding Hotfix 1 with additional hardening after attackers evolved techniques
- Microsoft attributes exploitation to Storm-1175 (financially motivated), deploying new StormEncryptor ransomware (successor to Medusa)
- Post-exploitation chain: Take Control → Cloudflared tunnel persistence →
veeamdomain account creation → domain admin password resets → LSASS dump via Mimikatz → EDR evasion tool → ransomware deployment within days - Sophos confirmed EDR-evasion tool disabling Microsoft Defender and Sophos products; additional C2 and TacticalRMM servers identified
- Huntress observes multi-org targeting but not yet broad indiscriminate campaign
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| 173.249.252.176, 173.249.252.200, 185.156.46.150, 23.234.94.43, 37.153.90.88, 37.19.210.32 | Attacker IPs | T1190 | Firewall, VPN, proxy logs | Block |
| 68.235.46.214, 68.235.46.235, 87.249.138.34, 92.118.112.181 | Attacker IPs (VPN exits) | T1190 | Firewall, proxy logs | Block |
Windows service named Cloudflared | Persistence | T1090.001, T1543.003 | Windows EID 7045 (service install) | Hunt — alert on Cloudflared service creation |
svchost.exe in Users\Documents folder | Masquerading | T1036.005 | Sysmon EID 1, EDR process creation | Hunt — svchost.exe outside System32 |
Domain account veeam creation | Persistence | T1136.002 | Windows EID 4720, AD audit | Detect — rogue account creation |
| TacticalRMM server connections | C2 | T1219 | DNS, proxy, EDR | Hunt — unexpected RMM tool connections |
| Take Control sessions from compromised N-central | Lateral movement | T1219 | N-central audit logs | Hunt — unusual Take Control session origins |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Windows Service Creation Using SC.exe (generic) | No N-central Take Control abuse rule; no StormEncryptor-specific detection |
| Elastic | Cloudflare Tunnel Client Execution (partial) | No N-central auth bypass detection |
| Sigma | proc_creation_win_svchost_outside_system32.yml | No N-central-specific rules; need Take Control session anomaly detection |
Sources: Help Net Security, Rapid7, Huntress, The Hacker News, BleepingComputer
2. Abyssos RAT — New Modular C++ Remote Access Trojan
TL;DR: Zscaler ThreatLabz disclosed Abyssos, a new modular C++ RAT with hidden VNC, browser credential theft, and keylogging — actively evolving across multiple builds with heavy LLVM obfuscation to frustrate analysis.
What’s New:
- Modular architecture with plugin download capability from C2; custom TCP protocol with AES-GCM encryption
- Hidden VNC (HVNC_CLONE_START) copies browser data including cookies into
fontconfigsdirectory under Windows temp folder for operator-controlled browser sessions - UAC bypass via
fodhelper.exeandICMLuaUtilCOM elevation - Keylogger stores captures as
windows_update_cache.jsonin temp directory - LLVM obfuscation using Pluto: control-flow flattening, bogus control flow, encrypted integer constants, stack-based string obfuscation
- Dynamic API resolution via CRC32 hash matching for Windows API calls
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
52b400c5be1557a8df146f62fde76d906e7e0a92ed76788717ef61c758f315aa | SHA-256 (v2.4F) | T1059 | EDR, AV | Block |
ca94d95413210a2a325155740eb8a5c58627ad5c4e704478621e7fc8165fe173 | SHA-256 (v2.1F) | T1059 | EDR, AV | Block |
| 213.145.86[.]42 | C2 IP (v2.4F) | T1071.001 | Firewall, proxy, DNS | Block |
| 209.99.184[.]223 | C2 IP (v2.1F) | T1071.001 | Firewall, proxy, DNS | Block |
fodhelper.exe spawning unexpected children | UAC bypass | T1548.002 | Sysmon EID 1, EDR | Detect — fodhelper.exe parent-child anomaly |
fontconfigs directory under %TEMP% | Browser data staging | T1074.001 | Sysmon EID 11 (file create) | Hunt — unusual temp directory creation |
windows_update_cache.json in %TEMP% | Keylogger output | T1056.001 | Sysmon EID 11 | Hunt — JSON file in temp matching this name |
ICMLuaUtil COM object invocation | UAC bypass | T1548.002 | Sysmon EID 10/11, COM logs | Detect — non-standard ICMLuaUtil callers |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Windows UAC Bypass via ICMLuaUtil (partial) | No Abyssos-specific detection; need fontconfigs staging and HVNC session rules |
| Elastic | UAC Bypass via Fodhelper (partial) | No Abyssos C2 protocol detection; need hidden VNC browser clone detection |
| Sigma | proc_creation_win_uac_bypass_fodhelper.yml | No detection for AES-GCM custom TCP C2 or CRC32 API resolution pattern |
Sources: Zscaler ThreatLabz, GBHackers, CyberPress
Status Updates
- CVE-2026-8037 (Progress Kemp LoadMaster): Federal CISA KEV deadline passed August 10. 792 exploitation attempts from 65 IPs across 18 countries. Patch to GA 7.2.63.2 or LTSF 7.2.54.18. Brief: Aug 10.
- CVE-2026-6875 (ServiceNow): Active exploitation entering 4th week. Two sandbox-escape gadget chains confirmed. Fortune 500 and critical infrastructure victims. Still NOT on CISA KEV. Brief: Jul 21.
- CVE-2026-15409/15410 (SonicWall SMA1000): INC ransomware exploitation continues via UTA0533. Federal deadline passed July 17. Brief: Jul 15.
- Metabase Zero-Day: Framework, n8n, Tally, and Kilo Code confirmed breached. Exploitation ongoing since Aug 3. No CVE assigned. Brief: Aug 9.