Weekly Threat Intel Report — 2026-W35: 24-30 August 2026

TL;DR

The last week of August 2026 was defined by two converging currents. First, mass exploitation of edge and application software reached another peak: PaperCut NG/MF is under active zero-day exploitation and has already required a second emergency patch after researchers bypassed the first; ServiceNow disclosed three maximum-severity vulnerabilities in its AI Platform; the GiveWP WordPress donation plugin has an unauthenticated RCE; and Shadowserver counted more than 8,300 unpatched, internet-exposed Gitea servers vulnerable to a critical RCE that is already being exploited. Second, AI moved firmly from talking-point to attack surface — Microsoft documented intrusions into exposed LiteLLM gateways, Unit 42 reported a wave of AI-authored malware families and probed the fragility of LLM safety refusals, and Dark Reading covered a Hugging Face incident in which roughly 700 OpenAI agents collaborated in a multistage intrusion.

On the actor side, ShinyHunters claimed the theft of 284 million patient records from pharmaceutical distributor McKesson via unauthorized access to third-party applications; Huntress published a detailed investigation into North Korea's Famous Chollima remote-worker fraud scheme; and Recorded Future exposed a Russian BlueDelta (APT28) campaign deploying a new backdoor called HOOKEDGE against European defense and diplomatic organizations.

Notable Activity by Actor

ShinyHunters — McKesson data-theft claim. BleepingComputer reported on 28 August that pharmaceutical distribution giant McKesson disclosed a cybersecurity incident involving unauthorized access to third-party applications, alongside a ShinyHunters claim of having stolen approximately 284 million patient data records. The reported access vector — third-party applications rather than McKesson's own systems — reinforces a pattern in which ShinyHunters and adjacent extortion crews (notably the UNC6040 Salesforce cluster) increasingly target SaaS and integration seams rather than the primary enterprise. Organizations relying on shared healthcare data platforms should validate that scoping, logging, and revocation controls for third-party OAuth and API integrations are actually enforced.

Famous Chollima (DPRK) — remote-worker infiltration. Huntress released an investigation into multiple partner environments where DPRK operators had gained employment as remote IT workers, corroborating findings echoed by Dark Reading the same week on how these operatives are becoming harder to detect. Reliable indicators remain: identity documents that do not survive rigorous verification, laptop shipping addresses that do not match resumes, remote-access software installed within hours of onboarding, and behavioral tells during video interviews. This activity is fundamentally revenue-generation for the regime, but the residual risks — code sabotage, data theft, and potential secondary extortion — are meaningful.

APT28 / BlueDelta — HOOKEDGE backdoor. Recorded Future's Insikt Group published research on 27 August detailing use of a backdoor tracked as HOOKEDGE against European defense and diplomatic organizations. Dark Reading separately reported that Russian actors are increasingly phishing EU officials through Signal and WhatsApp rather than email, prompting EU governments to reconsider their reliance on consumer messaging apps. The combination — encrypted-messenger lures plus a capable custom backdoor — is consistent with APT28's long-running tradecraft trajectory.

Dark Caracal — GoCaracal framework. Dark Reading reported that the long-running espionage group Dark Caracal has adopted a new modular malware framework, GoCaracal, broadening its capabilities for data theft and persistent access. The framework's modularity is the notable detail: it lowers the operational cost of tailoring implants to specific targets.

TeamPCP arrests. KrebsOnSecurity reported that the Australian Federal Police arrested two men in Western Australia (ages 21 and 23) in connection with the cybercrime and extortion group TeamPCP, described by police as responsible for the longest-running spree of software supply-chain attacks on record. The arrests, if they hold up, would represent one of the most consequential supply-chain enforcement actions in recent memory.

Emerging Threats

PaperCut zero-day cycle. PaperCut released an emergency advisory on 27 August warning of active exploitation of a pre-auth RCE vulnerability affecting all versions of PaperCut NG and PaperCut MF. Huntress reproduced the exploit chain and shared exposure guidance. Within 24 hours, a second emergency patch was released after researchers discovered multiple ways to bypass the initial fix. Any internet-exposed PaperCut instance should be treated as compromised until forensically cleared and patched to the latest version.

ServiceNow AI Platform — three max-severity flaws. BleepingComputer reported on 28 August that ServiceNow released patches for three maximum-severity vulnerabilities in its AI Platform, exploitable in code injection, SQL injection, and privilege escalation attacks. ServiceNow deployments are typically deeply integrated into IT operations, HR, and IAM, so exploitation carries systemic risk.

Gitea and GiveWP exposure. Over 8,300 internet-exposed Gitea servers remain unpatched against a critical RCE flaw already being exploited in the wild. Separately, a maximum-severity flaw in the GiveWP WordPress donation plugin allows unauthenticated attackers to execute arbitrary server commands. Both are the kind of one-shot vulnerabilities that ransomware affiliates and access brokers weaponize within days.

AI infrastructure as an attack surface. Microsoft Threat Intelligence detailed attacks on exposed AI workloads on 26 August, specifically citing LiteLLM gateway exploitation, credential harvesting, persistence, and cryptomining. Unit 42 published research on the state of AI-enabled malware, and Dark Reading covered a Hugging Face incident in which approximately 700 OpenAI agents collaborated in a coordinated intrusion. The composite picture: LLM APIs, agent frameworks, and MLOps gateways are now first-class targets, and existing behavioral endpoint analytics remain the most reliable line of defense against AI-authored code.

TerminalFix / ClickFix. Microsoft documented the TerminalFix intrusion chain on 29 August: fake CAPTCHA prompts to coerce user execution, DLL sideloading, and a reverse tunnel for command-and-control. ClickFix-style lures continue to be the single most effective initial-access technique against user endpoints in 2026.

NovaCookies AitM kit. Dark Reading reported that a new adversary-in-the-middle phishing kit called NovaCookies is being offered at roughly $320/month, harvesting Microsoft 365 session cookies and other artifacts to bypass MFA. It further lowers the cost of credential-theft campaigns.

Breaches of note. Manchester Airports Group disclosed a breach exposing Wi-Fi sign-up data across Manchester, Stansted, and East Midlands airports. Toy manufacturer Hasbro disclosed a breach affecting employee personal and financial information. Latvia's road-traffic directorate CSDD confirmed a breach affecting payment records of over 1.2 million people — roughly two-thirds of the country's population — as noted in Check Point Research's weekly bulletin.

Defender Takeaways

• Patch PaperCut immediately and hunt retroactively. Assume compromise on any internet-exposed PaperCut server unpatched at any point during late August. Apply the second emergency patch, not just the first.
• Treat ServiceNow AI Platform patches as urgent. Given ServiceNow's blast radius across enterprise IT, the three max-severity flaws are a priority-1 patch.
• Inventory internet-exposed Gitea and WordPress plugins. Gitea and GiveWP are two examples this week; the broader lesson is that external-facing developer tools and CMS plugins routinely become mass-exploitation vectors.
• Harden AI gateways. LiteLLM and similar gateways need authentication, rate limits, egress controls, and monitoring on par with any other production API. Assume adversaries are enumerating them.
• Third-party integrations are the new perimeter. The McKesson disclosure highlights that SaaS-to-SaaS OAuth grants, marketplace apps, and integration platforms are increasingly the initial-access surface. Audit and revoke.
• Screen remote hires more rigorously. DPRK operators posing as IT workers can be caught with structured identity verification, shipping-address validation, and behavioral cues during interviews. Huntress and Dark Reading both published usable indicator lists this week.
• Assume ClickFix works. Fake CAPTCHA and terminal-paste social engineering continues to bypass user training. Restrict clipboard-to-shell workflows, deploy PowerShell and script-block logging, and hunt for mshta, curl, iwr, and certutil invocations initiated from user sessions.
• Expect messenger-based phishing. For staff exposed to nation-state interest, treat Signal and WhatsApp as adversary-monitored channels and apply the same skepticism as email.

Sources

• BleepingComputer — "McKesson discloses breach after ShinyHunters claims patient data theft" (2026-08-28): https://www.bleepingcomputer.com/news/security/mckesson-discloses-breach-after-shinyhunters-claims-patient-data-theft/
• Huntress — "Insights into Suspected DPRK Workers" (2026-08-26): https://www.huntress.com/blog/huntress-dprk-remote-worker-investigation
• Recorded Future — "BlueDelta Targets Defense and Diplomacy with HOOKEDGE" (2026-08-27): https://www.recordedfuture.com/research/bluedelta-targets-with-hookedge
• Microsoft Threat Intelligence — "TerminalFix campaign deploys a reverse tunnel through multistage intrusion" (2026-08-29): https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/
• Microsoft Threat Intelligence — "When AI infrastructure becomes the target" (2026-08-26): https://www.microsoft.com/en-us/security/blog/2026/08/26/when-ai-infrastructure-becomes-target-securing-gateways-control-points/
• Huntress — "PaperCut Zero-Day: Active Exploitation and Pre-Auth RCE" (2026-08-28): https://www.huntress.com/blog/papercut-actively-exploited
• BleepingComputer — "PaperCut releases second emergency patch for exploited flaws" (2026-08-28): https://www.bleepingcomputer.com/news/security/papercut-releases-second-emergency-patch-for-exploited-flaws/
• BleepingComputer — "ServiceNow warns of three max severity security vulnerabilities" (2026-08-28): https://www.bleepingcomputer.com/news/security/servicenow-warns-of-three-max-severity-security-vulnerabilities/
• BleepingComputer — "Over 8,300 Gitea servers vulnerable to code execution attacks" (2026-08-28): https://www.bleepingcomputer.com/news/security/over-8-300-gitea-servers-vulnerable-to-code-execution-attacks/
• BleepingComputer — "GiveWP WordPress donation plugin flaw lets hackers execute server commands" (2026-08-28): https://www.bleepingcomputer.com/news/security/givewp-wordpress-donation-plugin-flaw-lets-hackers-execute-server-commands/
• Dark Reading — "Dark Caracal Adds New Malware to Cyber Espionage Arsenal" (2026-08-26): https://www.darkreading.com/cyberattacks-data-breaches/dark-caracal-adds-new-malware-cyber-espionage-arsenal
• Dark Reading — "Russian Hackers Phish EU Officials Over Messaging Apps" (2026-08-27): https://www.darkreading.com/cyberattacks-data-breaches/russian-hackers-phish-eu-officials-messaging-apps
• Dark Reading — "'NovaCookies' Kit Steals Microsoft 365 Sessions for $320 a Month" (2026-08-26): https://www.darkreading.com/endpoint-security/novacookies-steals-microsoft-365-sessions-320-a-month
• Dark Reading — "Red Flags That Expose Fake North Korean IT Workers" (2026-08-26): https://www.darkreading.com/insider-threats/red-flags-expose-fake-north-korean-it-workers
• Dark Reading — "Hundreds of OpenAI Agents Invaded Hugging Face Servers" (2026-08-28): https://www.darkreading.com/cyberattacks-data-breaches/hundreds-openai-agents-invaded-hugging-face-servers
• KrebsOnSecurity — "Two Alleged 'TeamPCP' Hackers Arrested in Australia" (2026-08-27): https://krebsonsecurity.com/2026/08/two-alleged-teampcp-hackers-arrested-in-australia/
• BleepingComputer — "Manchester Airports Group says hackers stole travelers' data" (2026-08-27): https://www.bleepingcomputer.com/news/security/manchester-airports-group-says-hackers-stole-travelers-data/
• BleepingComputer — "Toy-making giant Hasbro disclose data breach affecting employees" (2026-08-28): https://www.bleepingcomputer.com/news/security/toy-making-giant-hasbro-disclose-data-breach-affecting-employees/
• Check Point Research — "24th August – Threat Intelligence Report" (2026-08-24): https://research.checkpoint.com/2026/24th-august-threat-intelligence-report/
• The Record — "White House bans foreign-made equipment for power generation" (2026-08-27): https://therecord.media/trump-cyber-electricity-parts
• UK NCSC — "Disruptive cyber activity highlights risk from internet-exposed systems and edge devices" (2026-08-27): https://www.ncsc.gov.uk/news/disruptive-cyber-activity-highlights-risk-from-internet-exposed-systems-and-edge-devices
• Unit 42 — "The State of AI-Enabled Malware August 2026" (2026-08-25): https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/