Weekly Threat Intel Report — 2026-W36: 31 August - 6 September 2026

TL;DR

Three stories defined the week. First, Microsoft Teams voice phishing continued to mature as a primary initial access vector, with Unit 42 detailing a cluster tracked as Spring Ring and Microsoft Threat Intelligence describing a related IT support impersonation campaign that ends in a Node.js implant. Second, edge devices took another beating: SonicWall SMA 1000 zero-days are being exploited for unauthenticated remote code execution, a Citrix NetScaler authentication bypass (CVE-2026-19490) is now under active attack, Google shipped an emergency Chrome V8 fix for an in-the-wild zero-day, and HPE patched a critical ArubaOS-CX remote code execution flaw. Third, AI-assisted intrusion moved from theory to case study. Unit 42 published an investigation showing autonomous AI agents compressing a typical two-week attack into roughly ten hours. On the geopolitical side, the U.S. State Department offered $10 million for information on Amir Yaryab, identified as the IRGC officer overseeing CyberAv3ngers. Data exposure stories included an alleged 153 million driver license record leak tied to IDScan and a Manchester Airports Group breach affecting about 8.7 million customers.

Notable Activity by Actor

CyberAv3ngers. The U.S. State Department, through its Rewards for Justice program, offered $10 million for information on Amir Yaryab, described as the head of the IRGC cyber unit that oversees CyberAv3ngers and related groups. The action ties named leadership to the group's history of attacks on critical infrastructure. Reporting from The Record on 4 September notes this is one of the more direct public attributions of the IRGC cyber chain of command.

ShinyHunters. DarkReading's weekly roundup on 3 September revisited unresolved reporting about a possible ShinyHunters breach of security vendor ReliaQuest. The vendor has not confirmed a compromise, and the discussion focuses on how thin the public evidence remains. The item is noted here for tracking rather than as a confirmed incident.

Spring Ring (new cluster). Unit 42 published a detailed writeup on 31 August of a voice phishing operation delivered through Microsoft Teams. Operators impersonate internal IT support, initiate a Teams call, request a remote session, and progress toward malware deployment. Reporting indicates that in observed cases, operators moved from the initial endpoint toward enterprise domain controllers using credentials collected during the call. DarkReading covered the same activity on 2 September under the Spring Ring name.

GOLD SHERWOOD ("The Gentlemen"). Sophos published analysis on 1 September of fifteen intrusions attributed to GOLD SHERWOOD affiliates running The Gentlemen ransomware-as-a-service. The writeup covers reconnaissance, credential access, and encryption tradecraft observed across the sample set.

Breeze Comet (new cluster). DarkReading on 3 September profiled Breeze Comet, described as one of Brazil's most capable financial crime groups, with impact reaching global financial platforms connected to Brazilian institutions.

Phantom Deal (new cluster). DarkReading on 3 September described a business email compromise operation that impersonates parties to a merger or acquisition. Operators perform detailed reconnaissance on target enterprises and craft lures aimed at midlevel employees with authority to initiate large wire transfers.

Emerging Threats

Edge device exploitation continued through the week. SonicWall SMA 1000 appliances contain zero-day vulnerabilities enabling unauthenticated remote code execution, per DarkReading and Sophos on 2 September. This follows earlier summer exploitation of two other zero-days in the same vendor's edge products. Citrix disclosed CVE-2026-19490, a critical NetScaler authentication bypass, which BleepingComputer reported on 4 September as under active exploitation based on Previdian telemetry. Google shipped an emergency Chrome release on 4 September addressing an actively exploited V8 zero-day along with eleven other flaws. HPE patched a critical ArubaOS-CX remote code execution flaw on 3 September.

A separate item worth watching: an anonymous researcher using the handle Nightmare Eclipse published a CrowdStrike Falcon local privilege escalation exploit named FalconFlank. BleepingComputer reported on 4 September that the exploit yields SYSTEM privileges on up-to-date Windows systems running the sensor. CrowdStrike's response was still developing at time of writing.

AI-assisted intrusion moved from theory to documented case. Unit 42 published an investigation on 2 September describing an intrusion in which autonomous AI agents compressed a typical two-week attack into approximately ten hours. DarkReading covered the same case on 3 September under the framing that machine speed is changing incident timelines. Separately, Microsoft Threat Intelligence documented on 3 September that ASCII smuggling, previously discussed as a prompt injection technique against language models, is now being used to hide words from email filters using invisible Unicode characters.

Legitimate collaboration tooling continued to be abused for social engineering. In addition to Spring Ring, Microsoft Threat Intelligence on 2 September described a human-operated campaign that abuses Microsoft Teams external collaboration to impersonate IT support and deploy a Node.js implant. The same week, Microsoft on 1 September described a campaign delivering counterfeit software installers through look-alike download pages.

Supply chain compromises hit developer infrastructure. BleepingComputer reported on 3 September that attackers compromised Coder's Cloudflare-fronted registry infrastructure and added unauthorized registry servers that served malicious Terraform modules containing credential-stealing code. This continues the pattern of adversaries targeting developer and infrastructure-as-code supply chains.

Large data exposure events. KrebsOnSecurity reported on 1 September that an identity theft service is selling scans of more than 153 million driver licenses reportedly siphoned from identity verification vendor IDScan. Follow-up reporting from BleepingComputer on 4 September notes multiple lawsuits filed against the vendor. Check Point Research's weekly bulletin on 31 August recorded a Manchester Airports Group cyberattack exposing data on about 8.7 million customers. France's data protection authority CNIL fined Hôpital privé de la Loire €500,000 for inadequate protection of data on 727,000 patients, per BleepingComputer on 3 September.

Old flaws still work. DarkReading reported on 2 September that attackers used old, unpatched ownCloud vulnerabilities to breach the Philippines Nuclear Research Institute, exfiltrating reactor databases, personnel records, and credential stores.

Defender Takeaways

1. Treat Microsoft Teams external collaboration as an initial access vector on par with email. Restrict external federation where feasible. Alert on unusual external Teams calls that request screen sharing or remote control, and require verification of any "IT support" contact through a known internal channel before an employee grants remote access.
2. Prioritize patching the edge device flaws exploited this week: SonicWall SMA 1000, Citrix NetScaler (CVE-2026-19490), HPE ArubaOS-CX, and Chrome V8. Confirm that appliance management interfaces are not exposed to the public internet unless required.
3. Track the CrowdStrike FalconFlank exploit publication and apply vendor guidance as it becomes available. Local privilege escalation exploits against widely deployed EDR sensors change the risk calculus around initial code execution on any endpoint.
4. Review outbound and cross-team detections for AI agent traffic patterns. The Unit 42 case shows attackers using AI agents to accelerate reconnaissance, credential access, and lateral movement well beyond human tempo. Detection engineering should assume adversary iteration cycles measured in minutes rather than days.
5. For developer platforms, verify registry integrity for Terraform, npm, PyPI, and similar sources. The Coder incident shows that even Cloudflare-fronted vendor infrastructure can be modified to serve poisoned modules.
6. Audit identity verification vendors and other data brokers in the supply chain. The IDScan exposure highlights concentrated third-party data holdings as high-value targets.
7. Continue closing the tail on older public CVEs. The Philippines nuclear agency breach through unpatched ownCloud shows that commodity vulnerabilities remain a reliable initial access path.

Sources

• Microsoft Threat Intelligence, "Impersonating IT support," 2026-09-02: https://www.microsoft.com/en-us/security/blog/2026/09/02/impersonating-it-support-threat-actors-turn-remote-session-into-enterprise-wide-access/
• Microsoft Threat Intelligence, "ASCII smuggling crosses over from AI prompt injection to phishing evasion," 2026-09-03: https://www.microsoft.com/en-us/security/blog/2026/09/03/ascii-smuggling-crosses-over-from-ai-prompt-injection-to-phishing-evasion/
• Microsoft Threat Intelligence, "Counterfeit installers to system compromise," 2026-09-01: https://www.microsoft.com/en-us/security/blog/2026/09/01/counterfeit-installers-system-compromise-tracking-deceptive-software-download-campaign/
• Unit 42, "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams," 2026-08-31: https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/
• Unit 42, "An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation," 2026-09-02: https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/
• Sophos, "Ungentlemanly behavior: Insights into a ransomware operation," 2026-09-01: https://www.sophos.com/en-us/blog/ungentlemanly-behavior-insights-into-a-ransomware-operation
• Sophos, "SonicWall 83548 83549," 2026-09-02: https://www.sophos.com/en-us/blog/sonicwall-83548-83549
• The Record, "US offers $10 million for info on Iranian allegedly behind cyberattacks on critical infrastructure," 2026-09-04: https://therecord.media/us-reward-amir-yaryab-iran-irgc-cyberattacks
• DarkReading, "Threat Gang 'Springs' Vishing Attacks on Microsoft Teams Users," 2026-09-02: https://www.darkreading.com/cyberattacks-data-breaches/threat-gang-springs-vishing-attacks-microsoft-teams-users
• DarkReading, "AI 'Machine Speed' Cuts 2-Week Attack Down to 10 Hours," 2026-09-03: https://www.darkreading.com/cyberattacks-data-breaches/ai-machine-speed-2-week-attack-10-hours
• DarkReading, "SonicWall SMA 1000 Zero-Days Enable Unauthenticated RCE," 2026-09-02: https://www.darkreading.com/vulnerabilities-threats/sonicwall-sma-1000-zero-days-unauthenticated-rce
• DarkReading, "Old, Unpatched Flaws Give Attackers Access to Philippines Nuclear Agency," 2026-09-02: https://www.darkreading.com/cyberattacks-data-breaches/old-unpatched-flaws-attackers-philippines-nuclear-agency
• DarkReading, "Large Enterprises Targeted in Fake Merger and Acquisition Scams," 2026-09-03: https://www.darkreading.com/cyberattacks-data-breaches/large-enterprises-fake-merger-acquisition-scams
• DarkReading, "Breeze Comet Tears Into Brazilian and Global Financial Systems," 2026-09-03: https://www.darkreading.com/threat-intelligence/breeze-comet-brazilian-global-financial-systems
• DarkReading, "What We Missed: Did ShinyHunters Breach ReliaQuest?," 2026-09-03: https://www.darkreading.com/cybersecurity-operations/what-we-missed-did-shinyhunters-breach-reliaquest
• BleepingComputer, "Critical Citrix NetScaler auth bypass now leveraged in attacks," 2026-09-04: https://www.bleepingcomputer.com/news/security/hackers-target-critical-citrix-netscaler-auth-bypass-in-attacks/
• BleepingComputer, "Google warns of new Chrome zero-day flaw exploited in attacks," 2026-09-04: https://www.bleepingcomputer.com/news/security/google-warns-of-new-chrome-zero-day-flaw-exploited-in-attacks/
• BleepingComputer, "HPE patches critical ArubaOS-CX remote code execution flaw," 2026-09-03: https://www.bleepingcomputer.com/news/security/hpe-patches-critical-arubaos-cx-remote-code-execution-flaw/
• BleepingComputer, "New CrowdStrike FalconFlank zero-day grants SYSTEM privileges," 2026-09-04: https://www.bleepingcomputer.com/news/security/new-crowdstrike-falconflank-zero-day-grants-system-privileges/
• BleepingComputer, "Coder's registry infrastructure compromised to push malicious modules," 2026-09-03: https://www.bleepingcomputer.com/news/security/coders-registry-infrastructure-compromised-to-push-malicious-modules/
• BleepingComputer, "IDScan sued over alleged data breach affecting 153 million drivers," 2026-09-04: https://www.bleepingcomputer.com/news/security/idscan-sued-over-alleged-data-breach-affecting-153-million-drivers/
• BleepingComputer, "French hospital fined €500,000 after breach exposes data of 727,000," 2026-09-03: https://www.bleepingcomputer.com/news/security/french-hospital-fined-500-000-after-breach-exposes-data-of-727-000/
• KrebsOnSecurity, "FBI Probes Service Selling 153M+ Drivers Licenses," 2026-09-01: https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/
• Check Point Research, "31st August Threat Intelligence Report," 2026-08-31: https://research.checkpoint.com/2026/31th-august-threat-intelligence-report/