New ITW-exploited vulnerabilities, breaches and international law enforcement activity, new global APT operations
Vulnerabilities: 0-days and ITW flaws
On August 28, 2026, PaperCut released a second emergency patch (Emergency Patch Release 2) for versions 24, 25 and 26 in relation to the 0-day vulnerability affecting PaperCut NG and PaperCut MF, disclosed on August 27, clarifying that it is not a single flaw but two distinct and chained vulnerabilities, now tracked as CVE-2026-81578 (Missing Authentication for Critical Function) and CVE-2026-82078 (Unsafe Reflection). The exploit chain allows unauthenticated remote arbitrary code execution. On August 31, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the two flaws to its KEV catalog, requiring U.S. Federal Civilian Executive Branch (FCEB) agencies to remediate them by September 14, 2026. On September 2, CISA also added the following 7 other ITW-exploited vulnerabilities to the KEV catalog: CVE-2026-9586 in Sangoma Switchvox; CVE-2026-48710 in Kludex Starlette; CVE-2026-49869 in Kestra OSS; CVE-2026-59822 in BerriAI LiteLLM; CVE-2026-82329 in JFrog Artifactory; and CVE-2026-83548 and CVE-2026-83549 in SonicWall SMA1000. The latter two, respectively a Server-Side Request Forgery (SSRF) and an OS Command Injection, had already been reported as ITW-exploited 0-days by SonicWall PSIRT at the time of disclosure. Finally, Google released new Chrome Desktop versions, specifically 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux, addressing several vulnerabilities, including a 0-day for which it only stated that it was aware of an exploit existing in the wild. Tracked as CVE-2026-85046, it is a Type Confusion vulnerability in V8 affecting Google Chrome versions prior to 152.0.7977.82 and allowing a remote attacker to execute arbitrary code inside the sandbox via a specially crafted HTML page. The vulnerability was discovered and reported on August 4, 2026, by security researcher Salvatore Gulizia (aka Serotav). In a separate technical analysis, Gulizia described the flaw as a bug in the V8 compilers that allows an array containing PACKED_ELEMENTS to receive the PACKED_SMI_ELEMENTS map; this condition can be exploited to obtain arbitrary read and write capabilities in the JavaScript heap.
Cybercrime: data breaches, ransomware claims and law enforcement operations
On August 25, 2026, McKesson Corporation, a U.S. company operating in the healthcare sector and pharmaceutical distribution, disclosed that it had suffered unauthorized access to third-party applications resulting in data exfiltration, which caused intermittent disruption to some services without, however, interrupting the company’s operations. The cybercriminal group ShinyHunters claimed responsibility for the attack, stating that it had stolen approximately 1 TB of data between August 21 and 25, including around 284 million patient-related records. On August 27, 2026, Manchester Airports Group (MAG), a UK airport operator and owner of Manchester, London Stansted and East Midlands airports, disclosed that an unauthorized third party had gained access to customer data. The incident caused no operational disruption and had no impact on passenger or aviation safety. On August 30, the cybercriminal group FulcrumSec claimed responsibility for the attack, stating that it had stolen approximately 86 GB of data. On September 1, 2026, Dropbox confirmed the compromise of approximately 5,000 accounts. An issue in the integration with Lenovo ID and the related email address verification process allowed unauthorized individuals to register Lenovo IDs using victims’ email addresses and access the associated Dropbox accounts without knowing their passwords, where Dropbox two-factor authentication was not enabled. In fewer than one third of the cases, the attackers viewed or downloaded files stored in the compromised accounts. On September 2, 2026, a cybersecurity incident affecting C-Track was disclosed. C-Track is a platform for managing court documents and case files developed by Canadian information and technology services multinational Thomson Reuters and used by several judicial systems in the United States and Canada. Turning to ransomware, on August 28, 2026, Rhysida Team claimed an attack against the Berlin state government’s IT network, publishing the victim on its leak site; the Berlin administration subsequently confirmed data theft as part of the cyber incident. The Gentlemen claimed on its leak site the compromise of Exacta Labcenter S.p.A. and General S.r.l.; INC RANSOM Team claimed Policlinico Triestino S.p.A.; SETTRA claimed DiaSorin S.p.A.; Space Bears claimed Studio Oculistico Ciraci; and Aur0ra claimed EDIF S.p.A. On the law enforcement front, on August 26, 2026, under authorization from the U.S. District Court for the Southern District of California, the U.S. Department of Justice (DOJ) and the FBI seized three domains supporting two complementary platforms, QScan and QTRouter, which were used together as infrastructure for espionage and intrusion operations. In addition, on August 31, 2026, U.S. and European authorities, in cooperation with private-sector partners, carried out an international operation against Sality, a peer-to-peer (P2P) botnet active for more than two decades and used to distribute malicious payloads to compromised systems worldwide.
APT: state-sponsored activity and cyberspionage operations
Within the state-sponsored landscape, four distinct activities linked to China, Iran and Russia came to light this week. During 2026, an evolution was observed in the operations of Fire Ant, a China-linked adversary tracked since at least early 2025 and characterized by strong overlaps with UNC3886. Following previous activity focused on VMware ESXi and vCenter environments and network devices, the campaign expanded its scope to privileged infrastructure components, including Cisco IOS XR routers, TACACS servers and Linux management systems. Moving to Iran, Tortoiseshell conducted a cyberspionage campaign aimed at deploying two RATs named NodeRabbit and PollCat against the aviation and fintech sectors in the Middle East and Africa. Turning to Russia, the Russia-aligned adversary UAC-0099, with a history of cyberspionage activity against Ukrainian organizations, was observed using a new anti-analysis technique named GuardBreaker against a victim in Ukraine. The technique is designed to interfere with workflows that use Large Language Models (LLMs) to support automated malware analysis, causing their safety mechanisms to halt processing of the malicious code. Finally, between late September 2025 and early April 2026, the Russian actor Sofacy conducted campaigns against government and diplomatic organizations, as well as entities in the defense manufacturing sector, in Romania, Spain and Türkiye, using Microsoft Word documents with macros to distribute HOOKEDGE, a Windows backdoor based on batch scripts. Alongside these state-sponsored activities were other cyberspionage operations not attributed to any government and related to Serbia, China and Latin America. An investigation by the University of Toronto’s Citizen Lab, conducted in collaboration with SHARE Foundation, documented the infection of the iPhone of a member of Serbia’s pro-democracy student movement with the spyware Pegasus from Israeli company NSO Group. The compromise, dating to the period between December 2025 and January 2026, reportedly occurred through a zero-click exploit delivered via iMessage, which is no longer effective as of iOS 18.4.1. The investigation also confirmed two separate infections on Android devices involving a new variant of NoviSpy. A campaign orchestrated by the Chinese actor Void Arachne distributed the ValleyRAT backdoor disguised as adware. Lastly, a recent analysis examined a campaign associated with the South American APT APT-C-36, reconstructing part of the infrastructure and operational workflow linked to a loader previously identified on GitHub. The investigation starts from the account cabeto850128, created in November 2024 and reactivated in May 2026 with the repository comicsam. The activity continued at least through August 2026 with the creation of an additional repository.
Weekly Threats Report is Telsy’s weekly update featuring the main developments on cyber attacks and threat actors worldwide, produced by our Threat Intelligence & Response team.
The team is composed of analysts and security researchers with technical and investigative skills and internationally recognized experience.
Through continuous monitoring of cyber threats and geopolitical events, it produces and provides organizations with useful information to anticipate attacks and understand their scope, with the support of a trusted partner in the event of a cyber incident.
Learn more about our Cyber Threat Intelligence solution.