Cyber Threat Brief — September 20 2026
1. DPRK WaterPlum / Contagious Interview — Joint LE Advisory
TL;DR: Japan NPA/NCO + FBI/DC3 + ASD ACSC + Germany BND/BfV (2026-09-18 PDF) + BleepingComputer (2026-09-19): North Korean WaterPlum (aka Contagious Interview / Famous Chollima cluster) infected ≥30,000 devices in 100+ countries (Dec 2025–Jul 2026), stole funds/creds from ≥7,000 crypto wallets, and moved ~$10.71M to DPRK. Actors fake AI/crypto/NFT recruiter interviews, then push malicious npm packages / Bitbucket/GitHub projects / VS Code folders that drop BeaverTail, InvisibleFerret, OtterCookie, OtterCandy, or StoatWaffle. Same IP footprint overlaps DPRK IT-worker laptop farms — treat infected developer endpoints as a corporate pivot risk.
What’s New:
- First multi-nation LE package naming WaterPlum + quantifying 30k hosts / $10.71M; Japan dismantled a domestic laptop farm
- Delivery: fake interviews → clone/run coding tests →
npm installpostinstall / open+trust VS Code folder with hostile.vscode/tasks.json - Talos outbound (Famous Chollima BeaverTail+OtterCookie merge): C2 23.227.202.244:1224, 172.86.88.188:1418/1476/1478, npm package
node-nvm-ssh, Chessfi Bitbucket lure - Mitigations in advisory: sandbox unknown code; open unknown VS Code projects in Restricted Mode; hunt
curl/iwr/mshta/base64/-encin interview artifacts
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Malware families BeaverTail / InvisibleFerret / OtterCookie / OtterCandy / StoatWaffle (WaterPlum / Contagious Interview) | DPRK developer-targeting malware | T1566 / T1195.001 / T1059.007 | EDR / AV / threat intel feeds | Block/detect by family name + IOCs below; isolate developer hosts that opened interview repos since Dec 2025 |
npm package node-nvm-ssh / postinstall → node test/fixtures/eval → file15.js → eval(test.list) | Malicious npm install chain | T1195.001 / T1059.007 | npm/yarn logs / Sysmon 1 / EDR process tree | Alert npm install ancestry spawning node that evals large obfuscated JS; quarantine node_modules with that package; revoke registry tokens |
VS Code .vscode/tasks.json auto-run on folder trust (StoatWaffle / blockchain decoy projects) | Malicious workspace task | T1059 / T1204.002 | File integrity / EDR / VS Code telemetry | Open unknown projects in Restricted Mode (decline trust prompt); alert Code.exe/code spawning cmd/powershell/curl/node from tasks.json |
C2 23.227.202.244:1224 paths /uploads /pdown /client/ /payload/ /brow/ /keys; 172.86.88.188:1418 /socket.io/; :1476/:1478 /upload; 172.86.88.188/api/service/makelog | OtterCookie/BeaverTail C2 | T1071 / T1105 | Firewall / proxy / Zeek / EDR netflow | Block+hunt egress to these IP:ports; alert Node/Python → raw IP on 1224/1418/1476/1478 |
Clipboard/keylog artifacts %TEMP%\\windows-cache\\1.tmp + 2.jpeg (OtterCookie keylog/screenshot module) | Host IOC | T1056 / T1113 | EDR file events / Sysmon 11 | Hunt windows-cache\\1.tmp / 2.jpeg under Temp; correlate with Node parent |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified search for WaterPlum / BeaverTail / OtterCookie / Contagious Interview / node-nvm-ssh | NPM Supply Chain Compromise story targets Shai-Hulud postinstall patterns — adjacent npm abuse only; does not name WaterPlum C2 or families |
| Elastic | Partial — Curl or Wget Spawned via Node.js (Node→curl/wget); Partial — Elastic Defend Alert from Package Manager Install Ancestry (npm install ancestry); Partial — Script Interpreter Connection to Non-Standard Port (macOS Python/Node/Ruby → raw IP non-std port; refs InvisibleFerret) | Would catch download/C2 aspects of BeaverTail/OtterCookie, not the interview social-engineering stage or VS Code tasks.json StoatWaffle path; Windows Node→:1224 still needs custom hunt |
| Sigma | Partial — Potentially Suspicious Child Process Of VsCode (code.exe → calc/regsvr32/powershell IEX/…) | May catch some StoatWaffle task children; misses npm node-nvm-ssh postinstall and OtterCookie socket.io C2 |
Hunt hint: (1) Proxy/DNS: block/alert 23.227.202.244 and 172.86.88.188 (ports 1224/1418/1476/1478). (2) EDR: npm/node postinstall → curl/wget/obfuscated eval. (3) File: .vscode/tasks.json containing download/exec. (4) Developer laptops: AnyDesk installs + Python under %TEMP% after interview week. (5) HR/recruiting: verify applicants (VPN geo ≠ claimed home; refuse camera-off after face-swap start).
Sources: IC3 CSA 260918 PDF, NPA EN PDF, BleepingComputer, Talos BeaverTail/OtterCookie, ASD ACSC mirror
2. Discourse / libheif HEIF Upload RCE — CVE-2026-32882
TL;DR: The Hacker News (2026-09-19) + Hacktron HEIF Heist + Discourse GHSA: crafted HEIC/HEIF upload hits libheif (CVE-2026-32882, OOB read / Discourse rates RCE CVSS 8.8) via ImageMagick on self-hosted Discourse. Hacktron chained forum RCE → shared “Sign in with OpenAI” SSO to take over OpenAI staff ChatGPT/Codex sessions (bug bounty; fixed; $6,500). Upstream libheif fix ≥1.22.0 (May 2026); Debian 12 images still shipped 1.19.7 in Jul. Self-hosted Discourse patched images: 2026.7.0 / 2026.6.1 / 2026.5.2 / 2026.1.6 — ./launcher rebuild app. Hosted Discourse already patched. Broader HEIF Heist class also hit Next.js AVIF, GHE, Slack/Meta claims — treat untrusted HEIF/AVIF decode as high-risk.
What’s New:
- Public amplify of the OpenAI staff SSO blast-radius case (forum RCE → identity pivot) — pattern applies to any low-trust app sharing corporate SSO
- Discourse advisory: rebuild docker image (pulls patched libheif) + core sandboxing for image processing
- HEIF Heist guidance: prefer libheif ≥1.23.2 (site cites 1.23.4 as of early Sep); disable untrusted HEIF/AVIF or sandbox image workers
- Claude Opus 5 used to finish ASLR defeat in hours after Opus 4.8 stalled — expect faster n-day weaponization
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Self-hosted Discourse below 2026.7.0 / 2026.6.1 / 2026.5.2 / 2026.1.6 — CVE-2026-32882 | Vulnerable forum / image pipeline | T1190 / T1203 | Discourse version / docker image digest / ./launcher host | Run ./launcher rebuild app on patched train; confirm container libheif ≥ vendor patched build |
| Host/container libheif < 1.22.0 (esp. Debian 1.19.7 class) processing user HEIC/HEIF/AVIF | Vulnerable native decoder | T1203 | Package inventory (dpkg -l libheif* / SBOM) | Upgrade to distro security build or ≥1.23.2/1.23.4; rebuild dependents (ImageMagick/libvips/Sharp) |
Unauth/auth POST image upload of .heic/.heif/.avif causing ImageMagick/libheif worker crash/restart | Exploit probe / crash loop | T1190 | Discourse logs / container OOM/restart / ImageMagick logs | Alert burst HEIF uploads + worker crashes; capture sample; isolate upload path |
| Public/low-trust app sharing corporate SSO with high-trust tools (ChatGPT/Codex/GitHub/Slack pattern) | Identity blast-radius design | T1078 / T1550 | IdP app inventory / SSO policy | Split SSO trust; require step-up MFA before sensitive apps; do not reuse “Sign in with Corp” on internet forums |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None — verified search for CVE-2026-32882 / Discourse HEIF / libheif ImageMagick upload RCE | No Discourse/libheif analytic; generic ImageMagick rules do not name this CVE |
| Elastic | None — verified search for CVE-2026-32882 / Discourse HEIF / libheif overlay OOB | No matching emerging-threat rule in local tree |
| Sigma | None — verified search for CVE-2026-32882 / Discourse HEIF upload | No emerging-threat rule |
Hunt hint: (1) Inventory every self-hosted Discourse; force rebuild to patched trains above. (2) dpkg/rpm/SBOM: libheif <1.22.0. (3) Logs: HEIF/AVIF uploads followed by imagemagick/discourse worker segfault. (4) IdP: list apps with shared SSO to internet-facing forums; enforce step-up. (5) If Discourse was Internet-exposed pre-rebuild: assume possible RCE; rotate forum secrets + review SSO sessions.
Sources: The Hacker News, Discourse GHSA-vhm9-85gw-x335, HEIF Heist, NVD CVE-2026-32882, Debian tracker
Status Updates
- Linux KEV CVE-2025-39682 / CVE-2026-53266 / CVE-2025-39964: Federal due TOMORROW 2026-09-21 (forensic triage Yes) — finish distro kernel trains; remove ebtables
--snat-arpif needed as interim for CVE-2026-53266. Original brief - CVE-2026-76460 (Cisco ISE) / CVE-2026-87886 (Acronis) / CVE-2026-58704 (Pixel): KEV due was 2026-09-19 — confirm patches + forensic triage closed (
dummyuserise-kong; Acronis ≥1.9.3.1021 / ≥1.8.11.638; Pixel 2026-09-05+). Sep 17 · Sep 16 - CVE-2026-58138 (Orkes Conductor) / CVE-2026-28326 (SolarWinds ARM): No material change — keep ≥3.30.2 Conductor + ARM 2026.2.1 hunts. Original brief
- CVE-2026-42016/CVE-2026-42018 (JFrog): KEV due 2026-09-25 — continue
POST /access/api/v1/aws/token/+token:anonymoushunts. Sep 12 - Windows CVE-2026-81963 + CVE-2026-85880: KEV due 2026-09-22 — keep ALPC/Update Stack LPE hunts. Sep 9
- Chrome CVE-2026-87491: KEV due 2026-09-23 — Chromium ≥153.0.8010.36 class. Sep 10
- CVE-2026-85046 (Chrome) / CVE-2026-76461 (ESA): Post-deadline — confirm ≥152.0.7977.82 and ESA fixed AsyncOS + Snort 67109/67110. Sep 5 · Sep 15
- Brevo ClickFix / Check Point SMS CVE-2026-91843 / Unbound CVE-2026-81642 / WWLC / ParaShells / Marimo / GRAYRABBIT / Passkey / SGLang: No material change — keep prior hunts. Sep 18 · Sep 16 · Sep 14 · Sep 13
- Check Point VPN CVE-2026-85102/CVE-2026-85103: Dutch NCSC still imminent — distinct from management CVE-2026-91843. Sep 11 · Sep 18