Threat reportVulnerabilityTL-2026-4969
Threat Intelligence Snapshot Week 37 2026: FortiGate CVE-2025-25249 Exploitation (PivotC2), StyleSmuggler Magento/Adobe Commerce Zero-Day (CVE-2026-75650), BigBear 2.0 AiTM and Related Campaigns
Threat Intelligence Snapshot Week 37 2026 (TL-2026-4969), also tracked as StyleSmuggler, is a high-severity software vulnerability scored CVSS 7.4, first published 2026-11-01. It is attributed to UNC6671 with low confidence, affects Fortinet FortiOS, references 3 CVEs (CVE-2025-25249, CVE-2026-75650, CVE-2026-84869), maps to 21 MITRE ATT&CK techniques (T1036.005, T1053.003, T1059.005), and is covered by 9 detection rules and 30 indicators of compromise.
- CVSS
- 7.4/10High
- CVEs
- 3Referenced vulnerabilities
- Techniques
- 21MITRE ATT&CK
- Actors
- 1UNC6671
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-4969
- Threat ID
- TL-2026-4969
- Also known as
- StyleSmuggler, PivotC2, BigBear 2.0, Shai-Hulud
- Severity
- HIGH
- CVSS
- 7.4
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution
- UNC6671
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- information-technology, finance, government administration, health, energy, utilities, industrials, real-estate, communication-services, consumer-discretionary, retail-ecommerce, construction
- Target regions
- North America, Europe, india, Middle East, Global
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in Threat Intelligence Snapshot Week 37 2026
Malware and tooling: PivotC2, Shai-Hulud, evilginx2 - S9003
How Threat Intelligence Snapshot Week 37 2026 works
QuoIntelligence's week 37 2026 snapshot reports active exploitation of FortiOS CVE-2025-25249 (CAPWAP daemon heap overflow, used to deploy the PivotC2 Node.js RAT) and the StyleSmuggler unauthenticated RCE zero-day (CVE-2026-75650) against Magento and Adobe Commerce. It also covers the BigBear 2.0 Evilginx2 AiTM PhaaS against Microsoft 365, PREY-0058 help-desk vishing, the Shai-Hulud npm worm payload resurfacing, rogue ScreenConnect clients spreading a four-stage VBScript chain, and a phishing campaign using invisible Unicode tag characters.
The QuoIntelligence snapshot (coverage 3-9 September 2026, published 10 September 2026) is a weekly roundup; the public page is a headline summary and the full detail is behind a newsletter subscription. This record therefore combines the snapshot with the primary and secondary sources for each item it names.
FortiGate / CVE-2025-25249: a heap-based buffer overflow in the CAPWAP Wireless Aggregate Controller Daemon (cw_acd) of FortiOS and FortiSwitchManager lets a remote unauthenticated attacker execute arbitrary code or commands through crafted requests. Fortinet disclosed and patched it on 2026-01-13 (FG-IR-25-084). SecurityWeek and SOCRadar report exploitation since at least July 2026 to deploy PivotC2, a Node.js post-exploitation RAT for FortiGate offering an interactive shell, traffic tunneling, network scanning and configuration harvesting. Reported scale is over 30,000 targeted IP addresses and 178 confirmed infected devices, mainly US entities, with at least two data-exfiltration incidents. The suspected operator is a Russian-speaking cybercrime group and the malware may be AI-assisted. CISA added the CVE to KEV on 2026-09-09 (federal remediation deadline of 3 days under BOD 26-04 per SecurityWeek). Sources disagree on CVSS (7.4 per SecurityWeek, 9.8 per aggregators); no public IOCs were published for PivotC2.
StyleSmuggler / CVE-2026-75650: an unauthenticated RCE in Magento Open Source and Adobe Commerce (2.4.4-2.4.9 supported lines; B2B 1.3.3-1.5.3; unsupported 2.2, 2.3 and 2.4.0-2.4.3 also vulnerable), CVSS 10.0 per Sansec. PHP is injected into Magento's template system through 'styles' properties, via a generated failure report and execution through a failed-payment email or direct GraphQL requests reaching poisoned files in var/report or var/log. Sansec saw exploitation from 2026-09-04. A Rust backdoor masquerades as [kworker/u:8:0] (first variant), fc-cache (second variant, 2026-09-06) or chronyd and disguises its C2 traffic as NTP replies over UDP 123. The fc-cache variant copies itself to ~/.cache/fontconfig/fc-cache, installs a cron entry (13,43 * * * *) and writes a /tmp/.fc_<8hex>.lock PID file. Secondary tooling includes gs-netcat and WraithC2. Adobe released APSB26-146 with hotfix VULN-39341 on 2026-09-07.
BigBear 2.0 is an Evilginx2-based PhaaS ('General Boss') against Microsoft 365 using the 'offy' phishlet, with JavaScript injections that disable FIDO2/WebAuthn, block Microsoft anti-phishing telemetry and force Keep-Me-Signed-In. CloudSEK counted 5,137 records (4,148 session cookies, 1,032 plaintext passwords) across 461 organizations in 40+ countries, 42 Vultr VPS nodes, and Telegram bot exfiltration. PREY-0058 (Arctic Wolf; overlaps UNC6671) calls executives while impersonating IT help desk, directs them to passkey/MFA-themed AiTM domains, then replays stolen tokens from residential proxies (NodeMaven in all cases) to take data from Exchange Online, SharePoint and OneDrive for extortion.
The remaining items: Shai-Hulud npm worm payload resurfaced on 2026-09-07 in four packages, slipping past npm publish-time scanning; Huntress-reported rogue ScreenConnect clients (August 2026) run a worm-like 1.vbs-4.vbs chain on newly connected hosts, with payloads including a ScreenConnect backdoor, UAC-bypass tooling, tunneling utilities and XMRig (ConnectWise fixed CVE-2026-84869 in client 26.6.5); and a Microsoft-reported finance-themed phishing campaign inserting invisible Unicode Tags-block characters into keywords to defeat keyword filters (peak about 2.37 million messages per day, 148 sender domains). The QuoIntelligence snapshot itself gives no attribution, CVSS or IOCs; all values here come from the cited secondary sources and are not independently verified.
MITRE ATT&CK techniques used in TL-2026-4969
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information
Persistence
Execution
T1059.005 Visual Basic; T1059.007 JavaScript
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1195.002 Compromise Software Supply Chain; T1566.002 Spearphishing Link; T1566.004 Spearphishing Voice
Command and Control
T1090 Proxy; T1095 Non-Application Layer Protocol; T1219 Remote Access Tools
Collection
T1114.002 Remote Email Collection; T1213.002 Sharepoint
Impact
Credential Access
T1539 Steal Web Session Cookie; T1557 Adversary-in-the-Middle
Lateral Movement
Resource Development
Affected products and versions in Threat Intelligence Snapshot Week 37 2026
- Fortinet — FortiOS
Vulnerable versions: 6.4.0-6.4.16; 7.0.0-7.0.17; 7.2.0-7.2.11; 7.4.0-7.4.8; 7.6.0-7.6.3
Fixed in: 6.4.17; 7.0.18; 7.2.12; 7.4.9; 7.6.4 - Fortinet — FortiSwitchManager
Vulnerable versions: 7.0.0-7.0.5; 7.2.0-7.2.6
Fixed in: 7.0.6; 7.2.7 - Adobe — Adobe Commerce / Magento Open Source
Vulnerable versions: 2.4.4-2.4.9; B2B 1.3.3-1.5.3; 2.2, 2.3, 2.4.0-2.4.3 (unsupported)
Fixed in: Hotfix VULN-39341 (APSB26-146) - ConnectWise — ScreenConnect client
Vulnerable versions: prior to 26.6.5
Fixed in: 26.6.5 - Microsoft — Microsoft 365 / Entra ID
Vulnerable versions: Accounts using phishable MFA (non-FIDO2)
Remediation for Threat Intelligence Snapshot Week 37 2026
Patches
- Fortinet FG-IR-25-084 (FortiOS 7.6.4, 7.4.9, 7.2.12, 7.0.18, 6.4.17; FortiSwitchManager 7.2.7, 7.0.6)
- Adobe APSB26-146 hotfix VULN-39341
- ConnectWise ScreenConnect client 26.6.5 (CVE-2026-84869)
Immediate actions
- Patch FortiOS to 7.6.4/7.4.9/7.2.12/7.0.18/6.4.17+ and FortiSwitchManager to 7.2.7/7.0.6+; hunt FortiGate devices for PivotC2 (Node.js processes, unexpected shell/tunnel activity)
- Apply Adobe hotfix VULN-39341 (APSB26-146) on Magento/Adobe Commerce; hunt for kworker/fc-cache/chronyd processes, PHP files under pub/media and burst of 'Payment Transaction Failed Reminder' emails
- Rotate Magento encryption keys, admin passwords, API tokens and database credentials on suspected compromise
- Revoke Microsoft 365 sessions and refresh tokens and reset passwords for users reaching BigBear/PREY-0058 domains; block listed domains and IPs
- Disable TransferFiles/TransferFilesInSession in ScreenConnect roles; update ScreenConnect client to 26.6.5+; audit for unsanctioned ScreenConnect clients and wscript.exe running 1.vbs-4.vbs
- Audit npm lockfiles and CI for the four Shai-Hulud packages and rotate developer/CI secrets if installed
Workarounds
- FortiOS: remove fabric access or disallow access to the CAPWAP daemon where patching is not immediately possible
- Magento: run Sansec Shield / eComscan 1.9.7+ for known variants until the hotfix is applied
- Educate executives on help-desk vishing; verify any IT-initiated MFA/passkey registration call out of band
Longer-term hardening
- Deploy phishing-resistant MFA (FIDO2/WebAuthn) and Conditional Access requiring compliant devices
- Restrict sign-ins from residential proxy and hosting networks (e.g., NodeMaven) and alert on impossible-travel/token replay
- Normalize Unicode and strip Tags-block characters (U+E0000 range) before email keyword/regex/NLP inspection
- Restrict management-plane and CAPWAP/fabric access on FortiGate; enforce npm install-time controls and package cooldowns
CVEs associated with Threat Intelligence Snapshot Week 37 2026
Weaknesses (CWE) in Threat Intelligence Snapshot Week 37 2026
Timeline of Threat Intelligence Snapshot Week 37 2026
- Fortinet discloses and patches CVE-2025-25249 (FG-IR-25-084), a heap overflow in the CAPWAP daemon of FortiOS and FortiSwitchManager; not known to be exploited at the time
- CloudSEK reports first detection of BigBear 2.0 Evilginx2 PhaaS activity in June 2026 (exact day not stated)
- Exploitation of CVE-2025-25249 to deploy PivotC2 ongoing since at least July 2026 (exact day not stated); BigBear operators also begin deleting VPS nodes from late July
- Huntress observes rogue ScreenConnect clients running the 1.vbs-4.vbs loader chain on newly connected hosts during August 2026 (exact day not stated)
- Microsoft publishes research on finance-themed phishing hiding keywords with invisible Unicode Tags-block characters; the QuoIntelligence coverage week begins
- Sansec observes in-the-wild StyleSmuggler exploitation against Magento/Adobe Commerce; first Rust backdoor variant (kworker disguise) deployed
- Sansec publishes an early advisory on StyleSmuggler because stores are being compromised in real time
- Second StyleSmuggler backdoor variant (fc-cache disguise, cron persistence, NTP-masqueraded C2) appears
- Adobe releases APSB26-146 hotfix VULN-39341 for CVE-2026-75650; four npm packages carrying the Shai-Hulud payload uploaded within one hour, bypassing publish-time scanning
- Active exploitation of CVE-2025-25249 confirmed; Arctic Wolf and Help Net Security publish PREY-0058 help-desk vishing reporting
- CISA adds CVE-2025-25249 to the Known Exploited Vulnerabilities catalog (SecurityWeek reports the same week; date per aggregator reporting)
- QuoIntelligence publishes the Week 37 2026 Threat Intelligence Snapshot
Sources cited for Threat Intelligence Snapshot Week 37 2026
- QuoIntelligence - Threat Intelligence Snapshot: Week 37, 2026
- SecurityWeek - Fortinet Code Execution Flaw Exploited in PivotC2 RAT Attacks
- SOCRadar - CVE-2025-25249 PivotC2 FortiGate RAT
- Arctic Wolf - CVE-2025-25249 Security Bulletin (Fortinet FG-IR-25-084)
- Sansec - StyleSmuggler: Magento/Adobe Commerce 0-day (CVE-2026-75650)
- SecurityWeek - Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
- CloudSEK - Tracking BigBear 2.0 Evilginx2 Phishing Campaign
- Arctic Wolf - Active Cloud Data Theft and Extortion Campaign Targeting Microsoft 365 and SaaS (PREY-0058)
- Help Net Security - IT help-desk vishing tricks executives into handing over Microsoft 365 access
- The Hacker News - Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain (Huntress)
- SC Media - Shai-Hulud npm worm resurfaces, bypassing security scans
- BleepingComputer - Attackers conceal phishing lures using invisible Unicode characters
Detection coverage for TL-2026-4969
As of 2026-11-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4969 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.