# Daily Intelligence Briefing — Thursday, September 3, 2026

> On 2026-09-03, Threadlinqs published 15 new threat reports and updated 2, 4 rated critical and 12 high, spanning 188 MITRE ATT&CK techniques and 6 named threat actors. Coverage that day added 153 new detection rules and 447 extracted indicators.

- **Edition:** 2026-09-03 (Thursday)
- **Canonical:** https://intel.threadlinqs.com/debrief/2026-09-03
- **Last updated:** 2026-09-09
- **New threats:** 15 (2 updated)
- **Critical / high:** 4 critical, 12 high, 1 medium, 0 low
- **ATT&CK techniques:** 188
- **Threat actors:** 6
- **Indicators (count only):** 447
- **New detection rules (count only):** 153

## Summary & highlights

DOJ/FBI Seize $560,000 in Hamas-Linked Cryptocurrency Fundraising Network. Node.js Living-off-the-Land: Multiple Threat Actors Abuse Signed node.exe as a Script Interpreter, Feeding Ransomware Access Brokers. Ousaban Banking Trojan Targets Iberian Peninsula via Steganographic Delivery Chain.

- [TL-2026-2304](https://intel.threadlinqs.com/threat/TL-2026-2304) — Node.js Living-off-the-Land: Multiple Threat Actors Abuse Signed node.exe as a Script Interpreter, Feeding Ransomware Access Brokers
- [TL-2026-2305](https://intel.threadlinqs.com/threat/TL-2026-2305) — Ousaban Banking Trojan Targets Iberian Peninsula via Steganographic Delivery Chain
- [TL-2026-2308](https://intel.threadlinqs.com/threat/TL-2026-2308) — US-First RMM Phishing Campaign Spans 46 Countries via Disposable Vercel/Netlify Infrastructure and Password-Protected VBS-to-PowerShell Delivery
- [TL-2026-2310](https://intel.threadlinqs.com/threat/TL-2026-2310) — Recorded Future H1 2026 Report: Actively Exploited CVEs Up 34%, Ransomware Adopts BYOVD and Post-Quantum Crypto
- [TL-2026-2311](https://intel.threadlinqs.com/threat/TL-2026-2311) — Malware on the Blockchain: EtherHiding/Amatera ClickFix Campaign Adds a Covert WebRTC C2 Channel

## Theme of the day

Unattributed actors dominated today's activity with multiple new threats, while critical exploits targeting Sangoma Switchvox and JFrog Artifactory fueled active RCE and takeover campaigns.

credential-theft, infostealer, social-engineering, unauthenticated-rce, blockchain-c2

## Threats published

- [TL-2026-2307](https://intel.threadlinqs.com/threat/TL-2026-2307) — CRITICAL — SonicWall SMA1000 Chained Vulnerabilities (CVE-2026-83548, CVE-2026-83549) Exploited in the Wild
- [TL-2026-2314](https://intel.threadlinqs.com/threat/TL-2026-2314) — CRITICAL — HPE Patches Critical ArubaOS-CX Buffer Overflow (CVE-2026-73749) Enabling Unauthenticated Remote Code Execution
- [TL-2026-2319](https://intel.threadlinqs.com/threat/TL-2026-2319) — CRITICAL — CVE-2026-20212: Critical Unauthenticated RCE in Cisco Nexus 9000 Series Switches (Silicon One ASIC)
- [TL-2026-1102](https://intel.threadlinqs.com/threat/TL-2026-1102) — CRITICAL — JADEPUFFER Agentic Ransomware: Autonomous LLM Agent Exploits Langflow (CVE-2025-3248) and Nacos (CVE-2021-29441) for End-to-End Database Extortion (update)
- [TL-2026-2304](https://intel.threadlinqs.com/threat/TL-2026-2304) — HIGH — Node.js Living-off-the-Land: Multiple Threat Actors Abuse Signed node.exe as a Script Interpreter, Feeding Ransomware Access Brokers
- [TL-2026-2305](https://intel.threadlinqs.com/threat/TL-2026-2305) — HIGH — Ousaban Banking Trojan Targets Iberian Peninsula via Steganographic Delivery Chain
- [TL-2026-2308](https://intel.threadlinqs.com/threat/TL-2026-2308) — HIGH — US-First RMM Phishing Campaign Spans 46 Countries via Disposable Vercel/Netlify Infrastructure and Password-Protected VBS-to-PowerShell Delivery
- [TL-2026-2310](https://intel.threadlinqs.com/threat/TL-2026-2310) — HIGH — Recorded Future H1 2026 Report: Actively Exploited CVEs Up 34%, Ransomware Adopts BYOVD and Post-Quantum Crypto
- [TL-2026-2311](https://intel.threadlinqs.com/threat/TL-2026-2311) — HIGH — Malware on the Blockchain: EtherHiding/Amatera ClickFix Campaign Adds a Covert WebRTC C2 Channel
- [TL-2026-2312](https://intel.threadlinqs.com/threat/TL-2026-2312) — HIGH — StreamRat Android Banking Trojan Spreads via Fake Streaming-Service Ads on Meta and TikTok
- [TL-2026-2315](https://intel.threadlinqs.com/threat/TL-2026-2315) — HIGH — BlueKit Phishing-as-a-Service Adds ZeroBot Bot-Screening and ScreenConnect Delivery to Target Financial-Sector CEOs via Browser-in-the-Middle
- [TL-2026-2316](https://intel.threadlinqs.com/threat/TL-2026-2316) — HIGH — Serbian Authorities Deploy Pegasus and NoviSpy Spyware Against Journalists, Opposition Politicians, and Student Protesters
- [TL-2026-2317](https://intel.threadlinqs.com/threat/TL-2026-2317) — HIGH — ORB Networks and Nation-State CNI Targeting: Destructive Wiper Attack on Polish Energy Infrastructure via Exposed FortiGate Devices
- [TL-2026-2322](https://intel.threadlinqs.com/threat/TL-2026-2322) — HIGH — "Phantom Deal": Fake M&A Business Email/WhatsApp Compromise Scam Targets Large Enterprises with Forged NDAs
- [TL-2026-2323](https://intel.threadlinqs.com/threat/TL-2026-2323) — HIGH — Attacks in Korea Deploy Radmin and UltraVNC for Remote Control, Followed by Proxy/VPN Tools for Infrastructure Abuse
- [TL-2026-1080](https://intel.threadlinqs.com/threat/TL-2026-1080) — HIGH — Remus Stealer: 64-bit Lumma-Derived Infostealer-as-a-Service with EtherHiding Blockchain C2 and Application-Bound Encryption Bypass (update)
- [TL-2026-2309](https://intel.threadlinqs.com/threat/TL-2026-2309) — MEDIUM — DOJ/FBI Seize $560,000 in Hamas-Linked Cryptocurrency Fundraising Network

## Techniques observed

T0819, [T1003.001](https://intel.threadlinqs.com/technique/T1003.001), [T1005](https://intel.threadlinqs.com/technique/T1005), [T1012](https://intel.threadlinqs.com/technique/T1012), [T1016](https://intel.threadlinqs.com/technique/T1016), [T1021](https://intel.threadlinqs.com/technique/T1021), [T1027](https://intel.threadlinqs.com/technique/T1027), [T1027.002](https://intel.threadlinqs.com/technique/T1027.002), [T1027.003](https://intel.threadlinqs.com/technique/T1027.003), [T1027.010](https://intel.threadlinqs.com/technique/T1027.010), [T1036](https://intel.threadlinqs.com/technique/T1036), [T1036.005](https://intel.threadlinqs.com/technique/T1036.005), [T1040](https://intel.threadlinqs.com/technique/T1040), [T1041](https://intel.threadlinqs.com/technique/T1041), [T1046](https://intel.threadlinqs.com/technique/T1046), [T1053](https://intel.threadlinqs.com/technique/T1053), [T1053.003](https://intel.threadlinqs.com/technique/T1053.003), [T1053.005](https://intel.threadlinqs.com/technique/T1053.005), [T1055](https://intel.threadlinqs.com/technique/T1055), [T1056](https://intel.threadlinqs.com/technique/T1056), [T1056.001](https://intel.threadlinqs.com/technique/T1056.001), [T1057](https://intel.threadlinqs.com/technique/T1057), [T1059](https://intel.threadlinqs.com/technique/T1059), [T1059.001](https://intel.threadlinqs.com/technique/T1059.001), [T1059.003](https://intel.threadlinqs.com/technique/T1059.003), [T1059.004](https://intel.threadlinqs.com/technique/T1059.004), [T1059.005](https://intel.threadlinqs.com/technique/T1059.005), [T1059.006](https://intel.threadlinqs.com/technique/T1059.006), [T1068](https://intel.threadlinqs.com/technique/T1068), [T1070.004](https://intel.threadlinqs.com/technique/T1070.004), [T1071](https://intel.threadlinqs.com/technique/T1071), [T1071.001](https://intel.threadlinqs.com/technique/T1071.001), [T1071.004](https://intel.threadlinqs.com/technique/T1071.004), [T1078](https://intel.threadlinqs.com/technique/T1078), [T1078.001](https://intel.threadlinqs.com/technique/T1078.001), [T1082](https://intel.threadlinqs.com/technique/T1082), [T1087](https://intel.threadlinqs.com/technique/T1087), [T1090](https://intel.threadlinqs.com/technique/T1090), [T1090.002](https://intel.threadlinqs.com/technique/T1090.002), [T1095](https://intel.threadlinqs.com/technique/T1095), [T1102](https://intel.threadlinqs.com/technique/T1102), [T1102.001](https://intel.threadlinqs.com/technique/T1102.001), [T1102.002](https://intel.threadlinqs.com/technique/T1102.002), [T1105](https://intel.threadlinqs.com/technique/T1105), [T1106](https://intel.threadlinqs.com/technique/T1106), [T1111](https://intel.threadlinqs.com/technique/T1111), [T1112](https://intel.threadlinqs.com/technique/T1112), [T1113](https://intel.threadlinqs.com/technique/T1113), [T1114.002](https://intel.threadlinqs.com/technique/T1114.002), [T1115](https://intel.threadlinqs.com/technique/T1115), [T1127](https://intel.threadlinqs.com/technique/T1127), [T1132.001](https://intel.threadlinqs.com/technique/T1132.001), [T1134.001](https://intel.threadlinqs.com/technique/T1134.001), [T1136](https://intel.threadlinqs.com/technique/T1136), [T1136.001](https://intel.threadlinqs.com/technique/T1136.001), [T1140](https://intel.threadlinqs.com/technique/T1140), [T1185](https://intel.threadlinqs.com/technique/T1185), [T1189](https://intel.threadlinqs.com/technique/T1189), [T1190](https://intel.threadlinqs.com/technique/T1190), [T1204](https://intel.threadlinqs.com/technique/T1204), [T1204.001](https://intel.threadlinqs.com/technique/T1204.001), [T1204.002](https://intel.threadlinqs.com/technique/T1204.002), [T1204.004](https://intel.threadlinqs.com/technique/T1204.004), [T1210](https://intel.threadlinqs.com/technique/T1210), [T1213](https://intel.threadlinqs.com/technique/T1213), [T1218](https://intel.threadlinqs.com/technique/T1218), [T1218.005](https://intel.threadlinqs.com/technique/T1218.005), [T1218.007](https://intel.threadlinqs.com/technique/T1218.007), [T1219](https://intel.threadlinqs.com/technique/T1219), T1398, [T1404](https://intel.threadlinqs.com/technique/T1404), [T1407](https://intel.threadlinqs.com/technique/T1407), [T1409](https://intel.threadlinqs.com/technique/T1409), [T1417](https://intel.threadlinqs.com/technique/T1417), [T1417.001](https://intel.threadlinqs.com/technique/T1417.001), [T1417.002](https://intel.threadlinqs.com/technique/T1417.002), [T1418](https://intel.threadlinqs.com/technique/T1418), [T1420](https://intel.threadlinqs.com/technique/T1420), T1421, [T1422](https://intel.threadlinqs.com/technique/T1422), T1424, [T1426](https://intel.threadlinqs.com/technique/T1426), [T1429](https://intel.threadlinqs.com/technique/T1429), [T1430](https://intel.threadlinqs.com/technique/T1430), [T1437](https://intel.threadlinqs.com/technique/T1437), T1437.001, [T1453](https://intel.threadlinqs.com/technique/T1453), [T1456](https://intel.threadlinqs.com/technique/T1456), T1461, [T1481](https://intel.threadlinqs.com/technique/T1481), [T1482](https://intel.threadlinqs.com/technique/T1482), [T1484.001](https://intel.threadlinqs.com/technique/T1484.001), [T1485](https://intel.threadlinqs.com/technique/T1485), [T1486](https://intel.threadlinqs.com/technique/T1486), [T1490](https://intel.threadlinqs.com/technique/T1490), [T1497](https://intel.threadlinqs.com/technique/T1497), [T1497.001](https://intel.threadlinqs.com/technique/T1497.001), [T1499](https://intel.threadlinqs.com/technique/T1499), [T1499.004](https://intel.threadlinqs.com/technique/T1499.004), [T1505.003](https://intel.threadlinqs.com/technique/T1505.003), [T1512](https://intel.threadlinqs.com/technique/T1512), [T1513](https://intel.threadlinqs.com/technique/T1513), [T1516](https://intel.threadlinqs.com/technique/T1516), [T1518](https://intel.threadlinqs.com/technique/T1518), [T1518.001](https://intel.threadlinqs.com/technique/T1518.001), [T1526](https://intel.threadlinqs.com/technique/T1526), [T1528](https://intel.threadlinqs.com/technique/T1528), [T1529](https://intel.threadlinqs.com/technique/T1529), [T1530](https://intel.threadlinqs.com/technique/T1530), [T1539](https://intel.threadlinqs.com/technique/T1539), [T1541](https://intel.threadlinqs.com/technique/T1541), [T1543.003](https://intel.threadlinqs.com/technique/T1543.003), T1544, [T1547](https://intel.threadlinqs.com/technique/T1547), [T1547.001](https://intel.threadlinqs.com/technique/T1547.001), [T1550.001](https://intel.threadlinqs.com/technique/T1550.001), [T1552](https://intel.threadlinqs.com/technique/T1552), [T1552.001](https://intel.threadlinqs.com/technique/T1552.001), [T1555](https://intel.threadlinqs.com/technique/T1555), [T1555.003](https://intel.threadlinqs.com/technique/T1555.003), [T1555.005](https://intel.threadlinqs.com/technique/T1555.005), [T1556](https://intel.threadlinqs.com/technique/T1556), [T1557](https://intel.threadlinqs.com/technique/T1557), [T1558](https://intel.threadlinqs.com/technique/T1558), [T1561.001](https://intel.threadlinqs.com/technique/T1561.001), T1562, [T1564.003](https://intel.threadlinqs.com/technique/T1564.003), [T1566](https://intel.threadlinqs.com/technique/T1566), [T1566.001](https://intel.threadlinqs.com/technique/T1566.001), [T1566.002](https://intel.threadlinqs.com/technique/T1566.002), [T1566.003](https://intel.threadlinqs.com/technique/T1566.003), [T1568.002](https://intel.threadlinqs.com/technique/T1568.002), [T1571](https://intel.threadlinqs.com/technique/T1571), [T1573](https://intel.threadlinqs.com/technique/T1573), [T1573.001](https://intel.threadlinqs.com/technique/T1573.001), [T1574](https://intel.threadlinqs.com/technique/T1574), [T1583](https://intel.threadlinqs.com/technique/T1583), [T1583.001](https://intel.threadlinqs.com/technique/T1583.001), [T1583.003](https://intel.threadlinqs.com/technique/T1583.003), [T1583.004](https://intel.threadlinqs.com/technique/T1583.004), [T1583.006](https://intel.threadlinqs.com/technique/T1583.006), [T1584](https://intel.threadlinqs.com/technique/T1584), T1584.003, [T1584.006](https://intel.threadlinqs.com/technique/T1584.006), [T1584.008](https://intel.threadlinqs.com/technique/T1584.008), [T1585](https://intel.threadlinqs.com/technique/T1585), [T1585.001](https://intel.threadlinqs.com/technique/T1585.001), [T1585.002](https://intel.threadlinqs.com/technique/T1585.002), [T1588](https://intel.threadlinqs.com/technique/T1588), [T1588.002](https://intel.threadlinqs.com/technique/T1588.002), [T1588.006](https://intel.threadlinqs.com/technique/T1588.006), [T1589.002](https://intel.threadlinqs.com/technique/T1589.002), [T1589.003](https://intel.threadlinqs.com/technique/T1589.003), T1591.002, [T1591.004](https://intel.threadlinqs.com/technique/T1591.004), [T1592](https://intel.threadlinqs.com/technique/T1592), [T1592.002](https://intel.threadlinqs.com/technique/T1592.002), [T1593.001](https://intel.threadlinqs.com/technique/T1593.001), [T1595](https://intel.threadlinqs.com/technique/T1595), [T1595.001](https://intel.threadlinqs.com/technique/T1595.001), [T1595.002](https://intel.threadlinqs.com/technique/T1595.002), T1598.001, [T1601.001](https://intel.threadlinqs.com/technique/T1601.001), [T1608](https://intel.threadlinqs.com/technique/T1608), [T1611](https://intel.threadlinqs.com/technique/T1611), [T1619](https://intel.threadlinqs.com/technique/T1619), [T1620](https://intel.threadlinqs.com/technique/T1620), [T1622](https://intel.threadlinqs.com/technique/T1622), [T1624.001](https://intel.threadlinqs.com/technique/T1624.001), [T1626](https://intel.threadlinqs.com/technique/T1626), T1626.001, [T1628](https://intel.threadlinqs.com/technique/T1628), [T1629](https://intel.threadlinqs.com/technique/T1629), T1629.001, [T1630](https://intel.threadlinqs.com/technique/T1630), T1636.002, [T1636.003](https://intel.threadlinqs.com/technique/T1636.003), [T1636.004](https://intel.threadlinqs.com/technique/T1636.004), T1644, T1645, [T1646](https://intel.threadlinqs.com/technique/T1646), [T1655](https://intel.threadlinqs.com/technique/T1655), [T1657](https://intel.threadlinqs.com/technique/T1657), T1658, [T1660](https://intel.threadlinqs.com/technique/T1660), T1664, [T1684.001](https://intel.threadlinqs.com/technique/T1684.001), [T1685](https://intel.threadlinqs.com/technique/T1685)

## Threat actors

[Hamas](https://intel.threadlinqs.com/actor/Hamas), [Woodgnat](https://intel.threadlinqs.com/actor/Woodgnat), [Serbia Security Information Agency](https://intel.threadlinqs.com/actor/Serbia%20Security%20Information%20Agency), [Static Tundra](https://intel.threadlinqs.com/actor/Static%20Tundra), [REMUS MaaS operator](https://intel.threadlinqs.com/actor/REMUS%20MaaS%20operator), [JADEPUFFER](https://intel.threadlinqs.com/actor/JADEPUFFER)

Nation-state attribution: Brazil, CN, Serbia, Russia

Threat categories: THREAT_INTEL, MALWARE, PHISHING, APT, ICS_SCADA, VULNERABILITY, RANSOMWARE

## Severity breakdown

- critical: 4
- high: 12
- medium: 1
- low: 0

## Indicator & detection coverage

Counts only; indicator values require Red and above, detection rule text requires Blue and above.

- Indicators of compromise: 447 (network 147, file 108, infrastructure 55, entity 40, behavioral 29, tool 27, malware 20, package 15, technique 6)
- New detection rules: 153 (100% of the day’s threats covered)

## More editions

- Previous: [2026-09-02](https://intel.threadlinqs.com/debrief/2026-09-02)
- Next: [2026-09-08](https://intel.threadlinqs.com/debrief/2026-09-08)
- [Archive of daily debriefs](https://intel.threadlinqs.com/debrief/archive)
- [Latest debrief](https://intel.threadlinqs.com/debrief)

Canonical: https://intel.threadlinqs.com/debrief/2026-09-03