NCSC CTO Weekly Summary (week ending 2026-09-13): actively exploited Cisco FMC (CVE-2026-20079/20316), PaperCut NG/MF (CVE-2026-81578/82078), MikroTik RouterOS and FortiGate (CVE-2025-25249) flaws; NetScaler SAML bypass (CVE-2026-19490); BlueMoon exploit kit

Key facts for NCSC CTO weekly roundup

Detection coverage for NCSC CTO weekly roundup

As of 2026-11-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5103 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Credential Theft: LSASS Access, SAM/SECURITY Hive Save, lsa_read.exe and DCSync (PaperCut Campaign) — Post-Exploitation

Detects the credential-harvesting chain used in the AI-orchestrated PaperCut NG/MF (CVE-2026-81578 / CVE-2026-82078) campaign that reached Domain Admin: suspicious LSASS process access, reg.exe saving the SAM/SECURITY/SYSTEM hives, the Rust LSA secret reader lsa_read.exe (MD5 528cd4e69ecfa5191adbcf6ef28667bf), and DCSync directory-replication requests from non-domain-controller accounts.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1003.001, T1003.002, T1003.006
• Data sources: sysmon, windows_security, defender_for_endpoint
• Severity: critical
• Confidence: high

Splunk SPL

(index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" ((EventCode=10 TargetImage="*lsass.exe" GrantedAccess IN ("0x1010","0x1410","0x1438","0x143a","0x1fffff") NOT SourceImage IN ("*MsMpEng.exe","*csrss.exe","*wininit.exe","*services.exe")) OR (EventCode=1 (Image="*lsa_read.exe" OR Hashes="*528cd4e69ecfa5191adbcf6ef28667bf*" OR (CommandLine="*reg*save*" (CommandLine="*hklm*sam*" OR CommandLine="*hklm*security*" OR CommandLine="*hklm*system*"))))))
 OR (index=wineventlog sourcetype="WinEventLog:Security" EventCode=4662 (Properties="*1131f6aa-9c07-11d1-f79f-00c04fc2dcd2*" OR Properties="*1131f6ad-9c07-11d1-f79f-00c04fc2dcd2*") NOT SubjectUserName="*$")
| eval technique=case(EventCode=10,"T1003.001",EventCode=4662,"T1003.006",true(),"T1003.002")
| stats count values(technique) as techniques values(CommandLine) as commands values(SourceImage) as source_images values(SubjectUserName) as accounts by host

Microsoft KQL

let lookback = 24h;
let hive_and_lsa = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where MD5 =~ "528cd4e69ecfa5191adbcf6ef28667bf" or FileName =~ "lsa_read.exe"
    or (FileName =~ "reg.exe" and ProcessCommandLine has "save" and ProcessCommandLine has_any ("hklm\\sam", "hklm\\security", "hklm\\system"))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, technique = "T1003.002";
let lsass_access = DeviceEvents
| where Timestamp > ago(lookback)
| where ActionType == "OpenProcessApiCall" and FileName =~ "lsass.exe"
| where InitiatingProcessFileName !in~ ("MsMpEng.exe", "csrss.exe", "wininit.exe", "services.exe", "MsSense.exe")
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, FileName = InitiatingProcessFileName, ProcessCommandLine = InitiatingProcessCommandLine, technique = "T1003.001";
let dcsync = SecurityEvent
| where TimeGenerated > ago(lookback)
| where EventID == 4662 and Properties has_any ("1131f6aa-9c07-11d1-f79f-00c04fc2dcd2", "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2")
| where SubjectUserName !endswith "$"
| project Timestamp = TimeGenerated, DeviceName = Computer, AccountName = SubjectUserName, FileName = "", ProcessCommandLine = "", technique = "T1003.006";
union hive_and_lsa, lsass_access, dcsync
| order by Timestamp desc

Sigma

title: Registry Hive Save and lsa_read.exe Credential Theft
id: 8a3e6d90-1b72-4c5f-a8d4-2e9f0b7c6a31
status: experimental
description: Detects reg.exe saving the SAM, SECURITY or SYSTEM hives and execution of the lsa_read.exe LSA secret reader seen in the AI-orchestrated PaperCut NG/MF campaign (TL-2026-5103). LSASS access and DCSync are covered by the companion SPL and KQL queries.
references:
  - https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
  - attack.credential-access
  - attack.t1003.001
  - attack.t1003.002
  - attack.t1003.006
  - cve.2026-81578
  - cve.2026-82078
logsource:
  category: process_creation
  product: windows
detection:
  selection_reg:
    Image|endswith: '\reg.exe'
    CommandLine|contains|all:
      - 'save'
    CommandLine|contains:
      - 'hklm\sam'
      - 'hklm\security'
      - 'hklm\system'
  selection_lsa_read:
    Image|endswith: '\lsa_read.exe'
  selection_hash:
    Hashes|contains: 'MD5=528cd4e69ecfa5191adbcf6ef28667bf'
  condition: 1 of selection_*
falsepositives:
  - Backup or forensic tooling that exports registry hives
  - Authorized penetration testing
level: high

Known false positives:

• Backup, forensic or EDR tooling that exports registry hives or opens LSASS
• Authorized penetration testing and red-team credential-access exercises
• Directory-sync service accounts performing legitimate replication (Azure AD Connect)

Tuning notes: Enable Sysmon EventCode 10 with an lsass.exe TargetImage filter and Audit Directory Service Access (4662) on domain controllers. Exclude your EDR/AV SourceImage paths and the Azure AD Connect/replication accounts. The Sigma rule covers the process-creation facets only; deploy the SPL/KQL for LSASS access and DCSync.

• 🔒 BlueMoon Exploit Kit: chrome.exe to cmd.exe/curl.exe/msgbox.exe Chain and Delivery Domains — Exploitation · unlock with TL Creds
• 🔒 Persistence and Defense Evasion: GeForceService Task, Ligolo-ng Agent Install, Defender Tampering — Post-Exploitation · unlock with TL Creds
• 🔒 Ligolo-ng Agent and Reverse-SSH Tunnel Execution — Command and Control / Pivoting · unlock with TL Creds
• 🔒 Edge Appliance Exploitation Sources and Godzilla Header in Web Logs (PaperCut, Cisco FMC, MikroTik) — Exploitation · unlock with TL Creds
• 🔒 Web Shell and Implant Files home.jsp, cmd.jar and [indicator] — Post-Exploitation · unlock with TL Creds
• 🔒 Pass-the-Hash Tooling: Invoke-TheHash and Impacket Execution — Lateral Movement · unlock with TL Creds
• 🔒 Cisco FMC package_info.pl Netcat FIFO Reverse Shell (CVE-2026-20079 / CVE-2026-20316) — Exploitation · unlock with TL Creds
• 🔒 Network Connections to TL-2026-5103 C2 Infrastructure (Cyclops Blink, Godzilla, BlueMoon, PaperCut) — C2 · unlock with TL Creds

Indicators of compromise for NCSC CTO weekly roundup

As of 2026-11-02, Threadlinqs Intelligence tracks 26 indicators of compromise for TL-2026-5103.

Sample indicators (3 of 26)

• IP address: 45.142.193[.]132
• Domain: secboxes[.]com
• File hash: 6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461

Defanged, TLP:CLEAR. Full set of 26 indicators: unlock with TL Creds.

How NCSC CTO weekly roundup works

Primary reports from Cisco Talos, GreyNoise, watchTowr, Proofpoint and CERT Polska give exploitation details and IOCs.

This record tracks the vulnerabilities and campaigns highlighted in the NCSC CTO weekly summary published 2026-09-12. Each item was verified against the primary reports where they could be fetched.

Cisco Secure Firewall Management Center: CVE-2026-20079 is a CVSS 10.0 authentication bypass that lets an unauthenticated remote attacker execute scripts and obtain root. CVE-2026-20316 is a static low-privileged credential (CVSS 5.3) that was disclosed on 2026-07-29 and was already exploited at that point. Cisco Talos describes three clusters. UAT-11823 (Sandworm-attributed) abused the flaws to modify license.tmp, run a Netcat reverse shell through package_info.pl as root, and deploy a Cyclops Blink variant. UAT-11988 (a Qilin ransomware operator) used the static credential to run package_info.pl, a SOCKS5 proxy and a reverse-SSH tunnel, then deployed impacket, Invoke-TheHash, AV killers and Qilin ransomware. UAT-12197 (unattributed) deployed the JSP web shell home.jsp and the JAR executor cmd.jar, and queried SELECT name, auth_data FROM users. CISA added CVE-2026-20079 to KEV with a due date of 2026-09-12.

PaperCut NG/MF: CVE-2026-81578 is an authentication bypass rooted in the Apache Tapestry framework. CVE-2026-82078 is an unsafe-reflection / JDBC connector RCE reached via the user-lookup database settings and H2 Groovy execution. The advisory was published 2026-08-27 and emergency patches followed on 2026-08-28. watchTowr saw exploitation from 2026-08-30, with in-memory servlet-filter implants (Godzilla C2 and the suo5 proxy). GreyNoise documented a likely Russian-speaking actor on 2026-08-31 to 2026-09-02 who used hundreds of AI agents (OpenAI Codex harness, a DeepSeek model, public offensive tools). The campaign compromised 440+ instances across 395 organizations in 48 countries, harvested credentials, and reached Domain Admin using LSASS/registry hive theft, noPac and DCSync, with Ligolo-ng tunnelling for persistence.

MikroTik RouterOS (MikroTrick): CERT Polska reports that SSH public-key verification bypass (CVE-2026-67276) and SSH username privilege escalation (CVE-2026-86060) chain to full unauthenticated device takeover, alongside bandwidth-test memory disclosure (CVE-2026-67277). Exploitation has been confirmed since at least 2026-09-02. Fixed in 7.24.3+, 7.23.6+ (long-term) and 6.49.21+. A public PoC exists at github.com/dinosn/mikrotrick-poc.

NetScaler ADC/Gateway CVE-2026-19490 is an unauthenticated SAML authentication bypass (CWE-288, CVSS 4.0 9.3) in the HTTP-Redirect binding handler at GET /cgi/samlauth. It affects 14.1 before 14.1-73.32 and 13.1 before 13.1-63.21, and some ranges also require a configured SAML action. Public exploit code exists and Citrix lists no workarounds. The sources reviewed here do not confirm in-the-wild exploitation.

FortiGate CVE-2025-25249 is a heap overflow in the cw_acd (CAPWAP) daemon of FortiOS and FortiSwitchManager. SOCRadar reports exploitation delivering PivotC2, an AI-assisted Node.js RAT (shells, file transfer, SOCKS5/HTTP proxying, port forwarding, CIDR scanning, FortiGate credential harvesting). It reports 30,000 targeted IPs and 178 confirmed victim sessions since July 2026, attributed to Russian-speaking financially motivated actors. The SOCRadar page could not be fetched directly, so details come from the NCSC summary and search snippets.

BlueMoon is an exploit kit that chains CVE-2026-85046 (V8 TurboFan type confusion), CVE-2026-87491 (V8 sandbox escape via WebAssembly metadata corruption) and CVE-2026-85880 (Windows kernel LPE via ALPC/WNF on older builds). Proofpoint first saw it on 2026-08-28 with TA412 (APT31), and then with UNK_LateNight (ShadowPad), UNK_DoubleCheck (Rust loader) and UNK_QuietRacket (.NET payload). The V8 bugs were patch-gap zero-days: the upstream fix landed 2026-08-07 and the stable Chrome fix shipped 2026-09-03.

The roundup also notes infostealers collecting AI-agent data (Cursor, Claude, Codex and others), APT28 exploiting CVE-2026-21509 (Office OLE bypass) and Kimsuky AI-generated lures. These are background items.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.001 OS Credential Dumping: LSASS Memory; T1003.002 OS Credential Dumping: Security Account Manager; T1003.006 OS Credential Dumping: DCSync

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task; T1136.001 Create Account: Local Account; T1176 Software Extensions; T1505.003 Server Software Component: Web Shell

Collection

T1056.001 Input Capture: Keylogging; T1113 Screen Capture

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.004 Command and Scripting Interpreter: Unix Shell; T1203 Exploitation for Client Execution

Command and Control

T1090 Proxy; T1572 Protocol Tunneling

Initial Access

T1190 Exploit Public-Facing Application; T1566.002 Phishing: Spearphishing Link

Lateral Movement

T1550.002 Use Alternate Authentication Material: Pass the Hash

defense-impairment

T1685 Disable or Modify Tools

Remediation for NCSC CTO weekly roundup

Patches

• Cisco Secure FMC hotfixes for CVE-2026-20079 / CVE-2026-20316 (hardening release planned for 2026-09-14 to 2026-09-16)
• PaperCut NG/MF emergency patches released 2026-08-28 (apply the latest, as the first patch was bypassable)
• RouterOS 7.24.3+, 7.23.6+, 6.49.21+ (7.24.2 and 7.23.4 contained incomplete fixes)
• NetScaler 14.1-73.32+ and 13.1-63.21+
• FortiOS / FortiSwitchManager fixed releases per Fortinet advisory for CVE-2025-25249

Immediate actions

• Apply Cisco hotfixes for CVE-2026-20079 and CVE-2026-20316 on Secure FMC; restrict FMC management interfaces from untrusted networks
• Patch PaperCut NG/MF to the latest release, restart the service, and treat unpatched internet-exposed instances as compromised; capture JVM heap dumps before restart
• Upgrade MikroTik RouterOS to 7.24.3+, 7.23.6+ (long-term) or 6.49.21+ and disable internet-facing SSH, WWW and bandwidth-test services
• Upgrade NetScaler ADC/Gateway to 14.1-73.32+ or 13.1-63.21+ (no workarounds exist)
• Update Chrome/Chromium-based browsers to builds containing the CVE-2026-85046 and CVE-2026-87491 fixes (stable releases from 2026-09-03)
• Block and hunt for the listed IOCs at perimeter and in proxy, DNS and EDR telemetry

Workarounds

• MikroTik: disable SSH, WWW/WWW-SSL and bandwidth-test externally
• FortiGate: restrict or disable CAPWAP (UDP 5246) exposure where wireless management is not needed
• PaperCut: restrict access to the admin and web interfaces; audit servlet filter registrations
• NetScaler: none available per Citrix

Longer-term hardening

• Remove management planes (FMC, PaperCut admin, RouterOS SSH) from direct internet exposure
• Run PaperCut under a least-privilege service account, never Domain Admin
• Patch Active Directory against noPac (CVE-2021-42278 / CVE-2021-42287)
• Deploy EDR and monitor LSASS access, registry hive dumps and certutil abuse
• Shorten patch latency for edge devices and browsers; track Chromium patch-gap exposure

Affected and fixed versions

• Cisco — Secure Firewall Management Center (FMC)
  Vulnerable versions: Releases prior to Cisco hotfixes for CVE-2026-20079 / CVE-2026-20316
  Fixed in: Cisco hotfixes; hardening release week of 2026-09-14
• PaperCut — PaperCut NG / MF
  Vulnerable versions: Instances prior to the 2026-08-28 emergency patches
  Fixed in: Latest emergency patch release (second patch)
• MikroTik — RouterOS
  Vulnerable versions: RouterOS 7 before 7.24.3; RouterOS 7 long-term before 7.23.6; RouterOS 6 before 6.49.21
  Fixed in: 7.24.3+; 7.23.6+; 6.49.21+
• Citrix / Cloud Software Group — NetScaler ADC and Gateway
  Vulnerable versions: 14.1 before 14.1-73.32; 13.1 before 13.1-63.21
  Fixed in: 14.1-73.32+; 13.1-63.21+
• Fortinet — FortiOS and FortiSwitchManager (cw_acd daemon)
  Vulnerable versions: Versions affected by CVE-2025-25249 per Fortinet advisory
  Fixed in: Fixed versions per Fortinet advisory
• Google / Chromium — Chrome and Chromium-based browsers (V8)
  Vulnerable versions: Stable builds before the 2026-09-03 release
  Fixed in: Stable releases from 2026-09-03
• Microsoft — Windows kernel (CVE-2026-85880)
  Vulnerable versions: Windows 10 1809-22H2; Windows Server 2019; Windows Server 2022; Windows 11 21H2
  Fixed in: Newer Windows builds not affected per Proofpoint

Timeline of NCSC CTO weekly roundup

• 2026-07-29 Cisco discloses CVE-2026-20316 (Secure FMC static low-privileged credential), already exploited in attacks
• 2026-08-07 Upstream Chromium commit fixes CVE-2026-85046, starting a roughly four-week patch gap before the stable release
• 2026-08-21 Citrix urges customers to fix the NetScaler SAML authentication bypass CVE-2026-19490 (CVSS 9.3, no workarounds)
• 2026-08-27 PaperCut publishes its security advisory for NG/MF
• 2026-08-28 PaperCut emergency patches released and CVEs assigned; Proofpoint first observes TA412 (APT31) using locked-ioc-25
• 2026-08-30 watchTowr observes first in-the-wild exploitation of PaperCut CVE-2026-81578 and CVE-2026-82078
• 2026-08-31 AI-orchestrated campaign from locked-ioc-11 begins; first RCE at 18:39 UTC; PaperCut flaws added to CISA KEV
• 2026-09-02 CERT Polska confirms active MikroTik RouterOS exploitation since at least this date; final PaperCut campaign RCE observed
• 2026-09-03 Stable Chrome release ships the CVE-2026-85046 fix, closing the patch gap
• 2026-09-10 Cisco confirms CVE-2026-20079 exploited; Talos reports three clusters (UAT-12197, UAT-11823, UAT-11988); CISA KEV due date 2026-09-12
• 2026-09-12 NCSC CTO publishes the weekly summary covering these threats

Sources cited for NCSC CTO weekly roundup

Showing 15 of 16 sources, primary sources first.

• CERT Polska: Vulnerabilities in MikroTik RouterOS actively exploited cert.pl · Advisory
• Cisco Talos: Cisco Secure FMC ongoing exploitation Cisco Talos · Vendor report
• GreyNoise: AI-orchestrated campaign against PaperCut NG/MF greynoise.io · Research
• watchTowr: PaperCut NG/MF zero-day CVE-2026-81578 / CVE-2026-82078 active exploitation watchtowr.com · Research · 2026-08-31
• SOCRadar: CVE-2025-25249 PivotC2 FortiGate RAT socradar.io · Research
• Bishop Fox: Mind the Config - Detecting and Weaponizing NetScaler CVE-2026-19490 bishopfox.com · Research
• Proofpoint: Once Upon a BlueMoon - state-aligned actors rapidly adopt novel exploit Proofpoint · Research
• Trellix SecondSight Threat Hunting Report, September 2026 (APT28 CVE-2026-21509) trellix.com · Research
• MikroTrick PoC (dinosn) GitHub · Proof of concept
• CVE-2026-19490 exploit repository (TarPeg007) GitHub · Proof of concept
• CTO at NCSC Summary: Week Ending September 13th ctoatncsc.substack.com · Blog · 2026-09-12
• Help Net Security: Cisco FMC bugs exploited by nation-state and ransomware actors Help Net Security · News · 2026-09-10
• Help Net Security: Cisco FMC static credentials exploited (CVE-2026-20316) Help Net Security · News · 2026-07-30
• BleepingComputer: AI-powered attack exploited PaperCut flaws to hack 395 organizations BleepingComputer · News
• Help Net Security: Citrix urges customers to fix critical NetScaler authentication bypass (CVE-2026-19490) Help Net Security · News · 2026-08-21

More in vulnerability

• FreeBSoD: LLM-Assisted FreeBSD Kernel Exploit Development Yields Two Jail Escape Chains (CVE-2026-3038)
• PixelSmash – FFmpeg MagicYUV Decoder Heap Out-of-Bounds Write (CVE-2026-8461)
• CVE-2026-58115: Max-severity Node-RED unauthenticated flow-deployment flaw (Siemens SIMATIC IoT2050) exploited to deliver Linux malware
• iPhone BootROM Flaws (checkm8 CVE-2019-8900, usbliter8) Could Be Used to Undermine Cryptocurrency Wallet Security
• Balancer V2 ComposableStablePool Rounding/Invariant Manipulation Exploit (Nov 2025)