Cyber Threat Brief — August 12 2026
⚠️ This report is AI-generated. Always validate findings.
1. Lazarus AFD.sys Zero-Day Deploys FudModule v3.1 Rootkit — CVE-2026-68820
TL;DR: Lazarus exploited a Windows AFD.sys use-after-free zero-day (CVSS 7.8) since early June to deploy FudModule v3.1, a kernel rootkit that blinds 90+ ETW providers and disables EDR telemetry. Patched August 11 Patch Tuesday; CISA KEV same day.
What’s New:
- Check Point disclosed Operation Dream Job campaign targeting defense/aerospace via fake job offers delivering SecurityPDF trojanized viewer or DLL sideloading chain
- FudModule v3.1 strips telemetry callbacks, kills NT Kernel Logger, disables minifilters, and tampers with Smart App Control reputable-policy state
- New Troy backdoor (17 commands: file theft, RCE, in-memory DLL injection) and RelayShell PHP web shell using file-based C2 through compromised Roundcube/WordPress/PrestaShop sites
- C2 infrastructure uses hijacked Roundcube instances (many vulnerable to CVE-2025-49113) and VPN egress via ExpressVPN
- CISA KEV addition August 11 with federal remediation deadline
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
3b6378df8442e63a6ed7317075913e4720847a510d95022d4a8347b2637c245d | SHA-256 (FudModule) | T1014 | EDR file hash | Block |
743172aab606974b054a64561534ae66baa3a840657f79d7c6fa18350e8d45d1 | SHA-256 (SecurityPDF.exe) | T1204.002 | EDR file hash | Block |
590fb6ae19480d694e08ee85859cad8066f2f87e7e5abba2960c6d115e1615d6 | SHA-256 (Troy backdoor) | T1059.001 | EDR file hash | Block |
envell[.]xyz, enveil[.]online, uxtramine[.]org | C2 domains | T1071.001 | DNS, proxy | Block |
135.181.67[.]203, 135.181.185[.]158 | C2 IPs | T1071.001 | Firewall, proxy | Block |
| WerFault/afd.sys race condition → SYSTEM child process | TTP | T1068 | Sysmon EID 1 (parent/child) | Hunt — afd.sys-triggered SYSTEM processes with shell children |
| ETW provider mass-disable (90+ providers silenced) | TTP | T1562.006 | ETW telemetry gaps, Sysmon | Detect — alert on ETW provider stop events at scale |
| libmupdf.dll sideloading via legitimate PDF viewer | TTP | T1574.002 | Sysmon EID 7 (DLL load) | Hunt — unsigned libmupdf.dll in non-standard paths |
| MISTPEN → Microsoft Graph API → OneDrive module pull | TTP | T1102.002 | Proxy, O365 audit | Hunt — anomalous Graph API calls from non-browser processes |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None specific | Gap — need FudModule ETW-blinding detection + afd.sys LPE parent-child rule |
| Elastic | Potential Masquerading as VLC DLL (adjacent) | Gap — need libmupdf.dll sideloading + SecurityPDF process rule |
| Sigma | Potential Mpclient.DLL Sideloading Via Defender Binaries (adjacent) | Gap — need SecurityPDF/Troy/RelayShell process + network rules |
Sources: Check Point Research, CyberSecurityNews, CISA KEV
2. Metabase SQLi Gets CVE Assignment and CISA KEV Listing — CVE-2026-72898
TL;DR: The Metabase zero-day SQLi previously tracked without a CVE is now CVE-2026-72898 (CVSS 10.0) and was added to CISA KEV August 11. Unauthenticated attackers inject SQL via password-reset endpoint to gain admin access and steal all stored database credentials. Framework, Tally, n8n, and Kilo Code confirmed breached.
What’s New:
- CVE-2026-72898 officially assigned; CISA KEV addition August 11
- Attack pattern:
POST /api/session/reset_password→ 400 response (injection), thenGET /api/user/current→ 200 (admin verification) - Post-exploitation: admin access → decrypt stored warehouse credentials (Snowflake, Redshift, BigQuery, Postgres, MySQL) → bulk data export via
/api/dataset/and/api/download/endpoints - Framework breach: names, emails, phone numbers, physical addresses, login IPs exfiltrated
- Sigma, KQL, and VQL detection rules published by Security Arsenal
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
POST /api/session/reset_password with SQLi payload | Exploit pattern | T1190 | WAF, reverse proxy, web access logs | Detect — SQLi patterns against Metabase API endpoints |
GET /api/user/current post-injection validation | Recon pattern | T1087 | Web access logs | Hunt — correlate reset_password 400s followed by user/current 200s |
Bulk GET /api/dataset/, /api/download/, /api/card/ | Exfil pattern | T1530 | Web access logs, proxy | Detect — high-volume export API calls from non-standard IPs |
| Metabase JVM spawning bash/sh/python/curl | Post-exploit | T1059 | Sysmon, auditd | Detect — Java process (metabase.jar) spawning shell children |
/api/admin/, /api/setting/, /api/database/ modification | Persistence | T1098 | Metabase audit log, web access | Hunt — unauthorized admin API changes |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | Gap — need Metabase-specific SQLi and JVM child-process rules |
| Elastic | None | Gap — need Metabase API injection detection |
| Sigma | Security Arsenal published 3 experimental rules (see sources) | Partial — community rules available, not yet in official repos |
Sources: CISA KEV, Security Arsenal Detection Guide, Wiz Blog, BleepingComputer
3. Cisco ASA/FTD VPN DoS Under Active Exploitation — CVE-2026-20349
TL;DR: Cisco disclosed CVE-2026-20349 (CVSS 8.6), an unauthenticated heap inspection flaw in ASA/FTD Remote Access VPN that causes device reload via crafted HTTP request. CISA KEV added August 11; federal deadline August 14.
What’s New:
- Insufficient error checking in HTTP request processing against Remote Access SSL VPN service
- Exploitable without authentication when SSL listen sockets are enabled
- Successful exploitation causes device reload (DoS) — potential for repeated crashes disrupting VPN availability
- CISA KEV addition August 11 with 3-day fuse (federal deadline August 14)
- Found via Cisco internal testing and independent researcher Valerio Brussani
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Crafted HTTP to Remote Access SSL VPN endpoint | Exploit vector | T1499.004 | ASA syslog (EID %ASA-1-199010, %ASA-6-199002) | Detect — monitor for unexpected ASA/FTD reloads |
| ASA/FTD device crash/reload events | Exploitation indicator | T1499.004 | ASA syslog, SNMP traps | Detect — alert on repeated reload events on VPN-enabled devices |
| SSL listen socket on UDP/TCP 443 (RAVPN) | Attack surface | T1190 | Firewall config audit | Patch — verify all ASA/FTD with RAVPN enabled are patched |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None specific | Gap — need ASA unexpected reload correlation rule |
| Elastic | None | Gap — no ASA-specific crash detection |
| Sigma | None | Gap — need Cisco syslog reload event detection |
Sources: CISA KEV, BleepingComputer, Cisco Advisory
4. VMware vCenter Pre-Exploitation Scanning Detected — CVE-2026-59309
TL;DR: Defused Cyber reported August 11 a spike in honeypot scanning targeting VMware vCenter CVE-2026-59309 (CVSS 9.8 auth bypass in vmdir). No confirmed exploitation yet, but reconnaissance patterns indicate imminent weaponization attempts.
What’s New:
- Honeypots logging version fingerprinting via
POST /sdk/(RetrieveServiceContent) and walks of/webssoSAML SSO flow - CVE-2026-59309 allows unauthenticated auth bypass → full vCenter admin → VM create/delete/modify/exfil
- Companion CVE-2026-59310 (RCE, CVSS 9.1) also unpatched in same advisory VMSA-2026-0006
- No workarounds available — software upgrade is only remediation
- Broadcom patched July 29 in vCenter 8.0 U3k and vSphere/Cloud Foundation 9.x
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
POST /sdk/ (RetrieveServiceContent) from external IPs | Recon | T1595.002 | vCenter web access log, reverse proxy | Hunt — external /sdk/ probes against vCenter |
/websso SAML SSO flow enumeration | Recon | T1595.002 | vCenter web access log | Hunt — external /websso access patterns |
| Unexpected admin sessions via vmdir bypass | Exploitation | T1078.001 | vpxd.log, vmdir audit | Detect — vCenter admin logons from unexpected sources |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | Gap — need vCenter /sdk/ and /websso probe detection |
| Elastic | None | Gap — no vCenter-specific auth bypass detection |
| Sigma | None | Gap — need vmdir/websso scanning detection rules |
Sources: Defused Cyber (X/Twitter), Rapid7 ETR, Broadcom Advisory
Status Updates
- CVE-2026-72898 / Metabase-SQLi-0day-2026 (Metabase): CVE assigned, CISA KEV added August 11. Promoted to full brief section above. Original coverage: August 9.
- CVE-2026-6875 (undisclosed product): Active exploitation entering seventh week. Two sandbox-escape gadget chains confirmed. Fortune 500 and critical infrastructure victims. Still not on CISA KEV.
- CVE-2026-15409 / CVE-2026-15410 (SonicWall SMA 1000): INC ransomware exploitation continues via UTA0533. 885+ victims per Resecurity. Federal deadline passed July 17.
- CVE-2026-18577 / CVE-2026-18556 (N-able N-central): Federal deadline passed August 6. Hotfix 2 released August 6. Attackers evolving techniques against initial fix.
- CVE-2026-20316 (undisclosed product): Federal CISA KEV deadline passed August 1. Zero-day exploitation via hardcoded credential ongoing.