# NCSC CTO Weekly Summary (week ending 2026-09-13): actively exploited Cisco FMC (CVE-2026-20079/20316), PaperCut NG/MF (CVE-2026-81578/82078), MikroTik RouterOS and FortiGate (CVE-2025-25249) flaws; NetScaler SAML bypass (CVE-2026-19490); BlueMoon exploit kit

> A weekly roundup by Ollie Whitehouse (NCSC CTO) that bundles several actively exploited edge and enterprise flaws. These are Cisco Secure FMC, PaperCut NG/MF, MikroTik RouterOS and FortiGate with PivotC2. The roundup also covers a NetScaler ADC/Gateway SAML authentication bypass (CVSS 9.3) and the China-nexus BlueMoon Chrome/Windows zero-day exploit kit. Primary reports from Cisco Talos, GreyNoise, watchTowr, Proofpoint and CERT Polska give exploitation details and IOCs.

- **Published:** 2026-11-02T22:51:57Z
- **Last reviewed:** 2026-11-02T22:51:57Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5103
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5103.png
- **ID:** TL-2026-5103
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** APT31
- **Detections:** 9 (1 shown free below) · **IOCs:** 26 (3 shown free below)
- **CVEs:** CVE-2026-20079, CVE-2026-20316, CVE-2026-81578, CVE-2026-82078, CVE-2026-19490, CVE-2025-25249, CVE-2026-21509, CVE-2026-85046, CVE-2026-87491, CVE-2026-85880, CVE-2026-67276, CVE-2026-86060, CVE-2026-67277

## Description

This record tracks the vulnerabilities and campaigns highlighted in the NCSC CTO weekly summary published 2026-09-12. Each item was verified against the primary reports where they could be fetched.

Cisco Secure Firewall Management Center: CVE-2026-20079 is a CVSS 10.0 authentication bypass that lets an unauthenticated remote attacker execute scripts and obtain root. CVE-2026-20316 is a static low-privileged credential (CVSS 5.3) that was disclosed on 2026-07-29 and was already exploited at that point. Cisco Talos describes three clusters. UAT-11823 (Sandworm-attributed) abused the flaws to modify license.tmp, run a Netcat reverse shell through package_info.pl as root, and deploy a Cyclops Blink variant. UAT-11988 (a Qilin ransomware operator) used the static credential to run package_info.pl, a SOCKS5 proxy and a reverse-SSH tunnel, then deployed impacket, Invoke-TheHash, AV killers and Qilin ransomware. UAT-12197 (unattributed) deployed the JSP web shell home.jsp and the JAR executor cmd.jar, and queried SELECT name, auth_data FROM users. CISA added CVE-2026-20079 to KEV with a due date of 2026-09-12.

PaperCut NG/MF: CVE-2026-81578 is an authentication bypass rooted in the Apache Tapestry framework. CVE-2026-82078 is an unsafe-reflection / JDBC connector RCE reached via the user-lookup database settings and H2 Groovy execution. The advisory was published 2026-08-27 and emergency patches followed on 2026-08-28. watchTowr saw exploitation from 2026-08-30, with in-memory servlet-filter implants (Godzilla C2 and the suo5 proxy). GreyNoise documented a likely Russian-speaking actor on 2026-08-31 to 2026-09-02 who used hundreds of AI agents (OpenAI Codex harness, a DeepSeek model, public offensive tools). The campaign compromised 440+ instances across 395 organizations in 48 countries, harvested credentials, and reached Domain Admin using LSASS/registry hive theft, noPac and DCSync, with Ligolo-ng tunnelling for persistence.

MikroTik RouterOS (MikroTrick): CERT Polska reports that SSH public-key verification bypass (CVE-2026-67276) and SSH username privilege escalation (CVE-2026-86060) chain to full unauthenticated device takeover, alongside bandwidth-test memory disclosure (CVE-2026-67277). Exploitation has been confirmed since at least 2026-09-02. Fixed in 7.24.3+, 7.23.6+ (long-term) and 6.49.21+. A public PoC exists at github.com/dinosn/mikrotrick-poc.

NetScaler ADC/Gateway CVE-2026-19490 is an unauthenticated SAML authentication bypass (CWE-288, CVSS 4.0 9.3) in the HTTP-Redirect binding handler at GET /cgi/samlauth. It affects 14.1 before 14.1-73.32 and 13.1 before 13.1-63.21, and some ranges also require a configured SAML action. Public exploit code exists and Citrix lists no workarounds. The sources reviewed here do not confirm in-the-wild exploitation.

FortiGate CVE-2025-25249 is a heap overflow in the cw_acd (CAPWAP) daemon of FortiOS and FortiSwitchManager. SOCRadar reports exploitation delivering PivotC2, an AI-assisted Node.js RAT (shells, file transfer, SOCKS5/HTTP proxying, port forwarding, CIDR scanning, FortiGate credential harvesting). It reports 30,000 targeted IPs and 178 confirmed victim sessions since July 2026, attributed to Russian-speaking financially motivated actors. The SOCRadar page could not be fetched directly, so details come from the NCSC summary and search snippets.

BlueMoon is an exploit kit that chains CVE-2026-85046 (V8 TurboFan type confusion), CVE-2026-87491 (V8 sandbox escape via WebAssembly metadata corruption) and CVE-2026-85880 (Windows kernel LPE via ALPC/WNF on older builds). Proofpoint first saw it on 2026-08-28 with TA412 (APT31), and then with UNK_LateNight (ShadowPad), UNK_DoubleCheck (Rust loader) and UNK_QuietRacket (.NET payload). The V8 bugs were patch-gap zero-days: the upstream fix landed 2026-08-07 and the stable Chrome fix shipped 2026-09-03.

The roundup also notes infostealers collecting AI-agent data (Cursor, Claude, Codex and others), APT28 exploiting CVE-2026-21509 (Office OLE bypass) and Kimsuky AI-generated lures. These are background items.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566.002 Phishing: Spearphishing Link
- T1203 Exploitation for Client Execution
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1505.003 Server Software Component: Web Shell
- T1136.001 Create Account: Local Account
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1176 Software Extensions
- T1685 Disable or Modify Tools
- T1003.001 OS Credential Dumping: LSASS Memory
- T1003.002 OS Credential Dumping: Security Account Manager
- T1003.006 OS Credential Dumping: DCSync
- T1550.002 Use Alternate Authentication Material: Pass the Hash
- T1056.001 Input Capture: Keylogging
- T1113 Screen Capture
- T1572 Protocol Tunneling
- T1090 Proxy

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Credential Theft: LSASS Access, SAM/SECURITY Hive Save, lsa_read.exe and DCSync (PaperCut Campaign) — Post-Exploitation** (`TL-2026-5103-SPL-002`)

Detects the credential-harvesting chain used in the AI-orchestrated PaperCut NG/MF (CVE-2026-81578 / CVE-2026-82078) campaign that reached Domain Admin: suspicious LSASS process access, reg.exe saving the SAM/SECURITY/SYSTEM hives, the Rust LSA secret reader lsa_read.exe (MD5 528cd4e69ecfa5191adbcf6ef28667bf), and DCSync directory-replication requests from non-domain-controller accounts.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1003.001, T1003.002, T1003.006
- **Data sources:** sysmon, windows_security, defender_for_endpoint
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
(index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" ((EventCode=10 TargetImage="*lsass.exe" GrantedAccess IN ("0x1010","0x1410","0x1438","0x143a","0x1fffff") NOT SourceImage IN ("*MsMpEng.exe","*csrss.exe","*wininit.exe","*services.exe")) OR (EventCode=1 (Image="*lsa_read.exe" OR Hashes="*528cd4e69ecfa5191adbcf6ef28667bf*" OR (CommandLine="*reg*save*" (CommandLine="*hklm*sam*" OR CommandLine="*hklm*security*" OR CommandLine="*hklm*system*"))))))
 OR (index=wineventlog sourcetype="WinEventLog:Security" EventCode=4662 (Properties="*1131f6aa-9c07-11d1-f79f-00c04fc2dcd2*" OR Properties="*1131f6ad-9c07-11d1-f79f-00c04fc2dcd2*") NOT SubjectUserName="*$")
| eval technique=case(EventCode=10,"T1003.001",EventCode=4662,"T1003.006",true(),"T1003.002")
| stats count values(technique) as techniques values(CommandLine) as commands values(SourceImage) as source_images values(SubjectUserName) as accounts by host
```

### Microsoft KQL

```kql
let lookback = 24h;
let hive_and_lsa = DeviceProcessEvents
| where Timestamp > ago(lookback)
| where MD5 =~ "528cd4e69ecfa5191adbcf6ef28667bf" or FileName =~ "lsa_read.exe"
    or (FileName =~ "reg.exe" and ProcessCommandLine has "save" and ProcessCommandLine has_any ("hklm\\sam", "hklm\\security", "hklm\\system"))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, technique = "T1003.002";
let lsass_access = DeviceEvents
| where Timestamp > ago(lookback)
| where ActionType == "OpenProcessApiCall" and FileName =~ "lsass.exe"
| where InitiatingProcessFileName !in~ ("MsMpEng.exe", "csrss.exe", "wininit.exe", "services.exe", "MsSense.exe")
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, FileName = InitiatingProcessFileName, ProcessCommandLine = InitiatingProcessCommandLine, technique = "T1003.001";
let dcsync = SecurityEvent
| where TimeGenerated > ago(lookback)
| where EventID == 4662 and Properties has_any ("1131f6aa-9c07-11d1-f79f-00c04fc2dcd2", "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2")
| where SubjectUserName !endswith "$"
| project Timestamp = TimeGenerated, DeviceName = Computer, AccountName = SubjectUserName, FileName = "", ProcessCommandLine = "", technique = "T1003.006";
union hive_and_lsa, lsass_access, dcsync
| order by Timestamp desc
```

### Sigma

```yaml
title: Registry Hive Save and lsa_read.exe Credential Theft
id: 8a3e6d90-1b72-4c5f-a8d4-2e9f0b7c6a31
status: experimental
description: Detects reg.exe saving the SAM, SECURITY or SYSTEM hives and execution of the lsa_read.exe LSA secret reader seen in the AI-orchestrated PaperCut NG/MF campaign (TL-2026-5103). LSASS access and DCSync are covered by the companion SPL and KQL queries.
references:
  - https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
  - attack.credential-access
  - attack.t1003.001
  - attack.t1003.002
  - attack.t1003.006
  - cve.2026-81578
  - cve.2026-82078
logsource:
  category: process_creation
  product: windows
detection:
  selection_reg:
    Image|endswith: '\reg.exe'
    CommandLine|contains|all:
      - 'save'
    CommandLine|contains:
      - 'hklm\sam'
      - 'hklm\security'
      - 'hklm\system'
  selection_lsa_read:
    Image|endswith: '\lsa_read.exe'
  selection_hash:
    Hashes|contains: 'MD5=528cd4e69ecfa5191adbcf6ef28667bf'
  condition: 1 of selection_*
falsepositives:
  - Backup or forensic tooling that exports registry hives
  - Authorized penetration testing
level: high
```

**Known false positives:**

- Backup, forensic or EDR tooling that exports registry hives or opens LSASS
- Authorized penetration testing and red-team credential-access exercises
- Directory-sync service accounts performing legitimate replication (Azure AD Connect)

**Tuning notes:** Enable Sysmon EventCode 10 with an lsass.exe TargetImage filter and Audit Directory Service Access (4662) on domain controllers. Exclude your EDR/AV SourceImage paths and the Azure AD Connect/replication accounts. The Sigma rule covers the process-creation facets only; deploy the SPL/KQL for LSASS access and DCSync.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- BlueMoon Exploit Kit: chrome.exe to cmd.exe/curl.exe/msgbox.exe Chain and Delivery Domains — Exploitation (locked: unlock with TL Creds)
- Persistence and Defense Evasion: GeForceService Task, Ligolo-ng Agent Install, Defender Tampering — Post-Exploitation (locked: unlock with TL Creds)
- Ligolo-ng Agent and Reverse-SSH Tunnel Execution — Command and Control / Pivoting (locked: unlock with TL Creds)
- Edge Appliance Exploitation Sources and Godzilla Header in Web Logs (PaperCut, Cisco FMC, MikroTik) — Exploitation (locked: unlock with TL Creds)
- Web Shell and Implant Files home.jsp, cmd.jar and [indicator] — Post-Exploitation (locked: unlock with TL Creds)
- Pass-the-Hash Tooling: Invoke-TheHash and Impacket Execution — Lateral Movement (locked: unlock with TL Creds)
- Cisco FMC package_info.pl Netcat FIFO Reverse Shell (CVE-2026-20079 / CVE-2026-20316) — Exploitation (locked: unlock with TL Creds)
- Network Connections to TL-2026-5103 C2 Infrastructure (Cyclops Blink, Godzilla, BlueMoon, PaperCut) — C2 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 26)

Defanged, TLP:CLEAR.

- IP address: `45.142.193[.]132`
- Domain: `secboxes[.]com`
- File hash: `6f98add5d1a7729192b6ad8491d85c505c64836f7881742d6b93bd8e3d2fe461`

Full set of 26 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [CTO at NCSC Summary: Week Ending September 13th](https://ctoatncsc.substack.com/p/cto-at-ncsc-summary-week-ending-september-749)
- [Cisco Talos: Cisco Secure FMC ongoing exploitation](https://blog.talosintelligence.com/fmc-ongoing-exploitation)
- [Help Net Security: Cisco FMC bugs exploited by nation-state and ransomware actors](https://helpnetsecurity.com/2026/09/10/cisco-fmc-exploited-cve-2026-20079-cve-2026-20316)
- [Help Net Security: Cisco FMC static credentials exploited (CVE-2026-20316)](https://www.helpnetsecurity.com/2026/07/30/cisco-fmc-cve-2026-20316-exploited/)
- [GreyNoise: AI-orchestrated campaign against PaperCut NG/MF](https://www.greynoise.io/blog/ai-orchestrated-campaign-against-papercut-ng-mf)
- [watchTowr: PaperCut NG/MF zero-day CVE-2026-81578 / CVE-2026-82078 active exploitation](https://watchtowr.com/resources/papercut-ng-mf-zero-day-cve-2026-81578-cve-2026-82078-active-exploitation-underway/)
- [BleepingComputer: AI-powered attack exploited PaperCut flaws to hack 395 organizations](https://bleepingcomputer.com/news/security/ai-powered-attack-exploited-papercut-flaws-to-hack-395-organizations)
- [CERT Polska: Vulnerabilities in MikroTik RouterOS actively exploited](https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/)
- [MikroTrick PoC (dinosn)](https://github.com/dinosn/mikrotrick-poc)
- [SOCRadar: CVE-2025-25249 PivotC2 FortiGate RAT](https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/)
- [Help Net Security: Citrix urges customers to fix critical NetScaler authentication bypass (CVE-2026-19490)](https://www.helpnetsecurity.com/2026/08/21/citrix-netscaler-gateway-cve-2026-19490/)
- [Bishop Fox: Mind the Config - Detecting and Weaponizing NetScaler CVE-2026-19490](https://bishopfox.com/blog/mind-the-config-detecting-and-weaponizing-netscaler-cve-2026-19490)
- [CVE-2026-19490 exploit repository (TarPeg007)](https://github.com/TarPeg007/CVE-2026-19490/)
- [Proofpoint: Once Upon a BlueMoon - state-aligned actors rapidly adopt novel exploit](https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit)
- [SecurityWeek: BlueMoon exploit kit chains recent Chrome, Windows zero-days](https://securityweek.com/bluemoon-exploit-kit-chains-recent-chrome-windows-zero-days)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5103