> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # 14th September – Threat Intelligence Report - URL: https://f4n6.co.uk/security-feed/14th-september-threat-intelligence-report/ - Published: 2026-09-14T14:32:08.000Z - Updated: 2026-09-14T14:32:08.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-72898, CVE-2026-85880, CVE-2026-81963, CVE-2026-85706, CVE-2026-67276, ShinyHunters, GoldFactory ## 1\. Executive summary Check Point Research's weekly bulletin for 14 September 2026 covers a Microsoft September Patch Tuesday of 974 vulnerabilities including two source-reported actively exploited local privilege-escalation zero-days (CVE-2026-85880, CVE-2026-81963), a CVSS 10.0 unauthenticated arbitrary file read in GitLab Community and Enterprise Editions (CVE-2026-85706), a chainable MikroTik RouterOS pair (CVE-2026-67276, CVE-2026-86060), and a SQL injection in self-hosted Metabase (CVE-2026-72898) that was the confirmed initial-access vector in the Mathspace breach affecting over 1 million people. The most directly relevant item for EMEA financial services is the Revolut data exposure, in which employees actioned fraudulent information requests sent from an account inside a government agency's legitimate domain, exposing identity documents, verification selfies, IBANs, account statements and complete transaction histories. The verified reference data supplied with this item contains no CVSS scores, no EPSS values and no CISA KEV entries for any CVE named here; all severity and exploitation statements below are source-reported and are labelled as such. Bottom line: the GitLab and Metabase flaws sit in self-hosted components common in financial-services estates and are the highest-priority technical remediation; the Revolut and passkey-phishing patterns are process and identity failures that patching will not fix. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ----------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 18: classification of ICT-related incidents and cyber threats | The bulletin documents a confirmed, replicable cyber threat against a financial entity: Revolut employees fulfilled fraudulent information requests sent from an account within a government agency's legitimate domain, exposing identity documents, IBANs and full transaction histories. | Art. 18 covers cyber threats as well as incidents. This pattern should be entered into the client's threat-classification process, and the client should test whether its own inbound data-request handling would detect, classify and escalate this behaviour. | | NIS2 Art. 21(2)(d): supply chain security measures | The Mathspace breach was achieved by exploiting CVE-2026-72898 in self-hosted Metabase — a third-party component running inside the victim's own estate — to reach an internal reporting database. | Supply-chain security measures must extend to self-hosted third-party components the entity operates (Metabase, GitLab CE/EE, RouterOS), not only to contracted ICT providers. Clients need a component inventory with patch-state tracking. | No other article in the regulatory reference is engaged by a fact distinctive to this item. DORA Art. 17, 19, 24, 28, 29 and 30 and NIS2 Art. 23 are not triggered: this item reports no incident at the client, no third-party ICT provider contract change, and no testing obligation specific to these facts. UK NIS 2018 OES/RDSP duties are not engaged by anything in this item. ## 3\. Technical analysis & attack chain ### 3.1 Prioritised triage table The verified reference data contains no CISA KEV entries and no EPSS scores for any CVE in this item, so no KEV-first ordering is possible. Rows are ordered by source-reported real-world exploitation, then by source-reported severity and exposure. | CVE | Component | CVSS | KEV/EPSS | Why it matters | | ---------------- | ------------------------------ | ----------------------------------------------- | -------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | | CVE-2026-72898 | Metabase (self-hosted) | Not in verified data | No KEV/EPSS entry in verified data; source reports real-world exploitation | Only CVE in this item with a confirmed in-the-wild breach outcome (Mathspace, >1M people). SQL injection reaching an internal reporting database. | | CVE-2026-85880 | Microsoft Windows | Not in verified data | No KEV/EPSS entry in verified data; source reports actively exploited | Local attacker escalates to SYSTEM. | | CVE-2026-81963 | Microsoft Windows Update Stack | Not in verified data | No KEV/EPSS entry in verified data; source reports actively exploited | Local attacker escalates to SYSTEM. Check Point IPS covers this as "Microsoft Windows Update Stack Elevation of Privilege". | | CVE-2026-85706 | GitLab CE / EE | 10.0 (source-reported; verified data is silent) | No KEV/EPSS entry in verified data | Unauthenticated arbitrary file read via the repository commits API. Affects 18.7 through 19.3.1. | | CVE-2026-67276 | MikroTik RouterOS | Not in verified data | No KEV/EPSS entry in verified data | Chains with CVE-2026-86060 to obtain passwordless SSH access. | | CVE-2026-86060 | MikroTik RouterOS | Not in verified data | No KEV/EPSS entry in verified data | Chains with CVE-2026-67276 to escalate to full administrator. | | CVE-2026-85046 | Google Chrome (V8) | Not in verified data | No KEV/EPSS entry in verified data | Part of the BlueMoon exploit chain; used by multiple espionage groups after Chrome patches became available. | | 20 unnamed flaws | Microsoft products | Not in verified data | No KEV/EPSS entry in verified data | Source states these could enable unauthenticated remote code execution without user interaction. No CVE identifiers or component names given. | ### 3.2 Confirmed attack chain — Mathspace / Metabase (CVE-2026-72898) This is the only intrusion in the item for which the source describes a sequence of steps. 1. Attackers targeted a self-hosted Metabase instance operated by Mathspace, an education platform used in Australia and New Zealand. 2. They exploited CVE-2026-72898, which Check Point IPS classifies as a Metabase SQL injection. 3. The injection gave access to an internal reporting database. 4. Data exfiltrated covered more than 1 million people and included names, email addresses, usernames and locations. Passwords and academic records were not affected. The source does not name a fixed Metabase version, a patch release, or the injection point within Metabase. Do not assume a version threshold — obtain the fixed release from the vendor. ### 3.3 Microsoft September 2026 Patch Tuesday — CVE-2026-85880 and CVE-2026-81963 The source reports a record 974 vulnerabilities addressed across Microsoft products, of which two are described as actively exploited zero-days. Both CVE-2026-85880 and CVE-2026-81963 allow a local attacker to elevate privileges to SYSTEM. CVE-2026-81963 is identified by Check Point IPS as residing in the Windows Update Stack. A further 20 flaws are stated to permit unauthenticated remote code execution without user interaction; the source gives no CVE identifiers, component names or versions for those 20, so they cannot be triaged individually from this material. Note the exploitation status is source-reported only. The verified reference data records no CISA KEV entry and no remediation due date for either CVE, so no federal due date applies and none should be assumed. ### 3.4 GitLab — CVE-2026-85706 A path traversal flaw affecting GitLab Community Edition and Enterprise Edition, source-rated CVSS 10.0\. It allows an unauthenticated attacker to read arbitrary files through the repository commits API. Affected versions are 18.7 through 19.3.1; fixes are available in 19.1.8, 19.2.6 and 19.3.2\. The verified reference data supplies no CVSS score for this CVE, so the 10.0 figure is the source's own rating and is presented as such. The source does not state which files are reachable or whether exploitation has been observed in the wild. ### 3.5 Long tail **MikroTik RouterOS (CVE-2026-67276, CVE-2026-86060).** The two flaws can be chained to obtain passwordless SSH access and to elevate privileges to full administrator. Successful exploitation gives an attacker control of an exposed router, enabling configuration changes, DNS manipulation, traffic interception, and use of the device as a network foothold. The source gives no affected or fixed RouterOS versions — obtain these from the vendor before scheduling upgrades. **Chrome / BlueMoon (CVE-2026-85046).** BlueMoon is described as an exploit chain combining two vulnerabilities in Chromium's V8 JavaScript engine with a Windows flaw, achieving browser exploitation, sandbox escape and privilege escalation on vulnerable Windows devices. Only one CVE is named (CVE-2026-85046, which Check Point IPS classifies as a Google Chrome type confusion); the second V8 CVE and the Windows flaw are not identified in the source. The chain was reportedly used by multiple espionage groups after Chrome patches became available — i.e. against unpatched estates. No actor is named. ### 3.6 Breach and campaign reporting **Revolut.** A data exposure, not a technical intrusion: employees fulfilled fraudulent information requests sent from an email account within a government agency's legitimate domain. Exposed records included identity documents, verification selfies, contact details, IBANs, account statements, withdrawal records and complete transaction histories. The source does not state how many individuals were affected or whether the sending account was compromised or spoofed. **Florida Department of Motor Vehicles.** Credentials stolen from a Plant City police officer's personal device were used to access driver records. The ShinyHunters group published images of the stolen data. ShinyHunters has a MITRE ATT&CK profile (G1057), so the group's existence is confirmed; the attribution of this specific breach rests on the group's own publication of stolen material and is single-sourced to Check Point Research. **IDScan.net.** A US identity verification provider detected unauthorised access on 1 September 2026\. Exposed data included names and government identification numbers. Separately, a criminal marketplace advertised a collection containing millions of identity documents, including driver's licences, associated with the company's verification services. The source does not establish that the marketplace collection and the intrusion are the same dataset. **Passkey-themed social engineering against Microsoft 365.** Attackers use phone and text lures to direct employees to lookalike sign-in pages, then register their own authentication methods on the compromised account and collect data from SharePoint, OneDrive and Exchange. No actor is named and no atomic indicators are given. **GoldFactory / Vwork / Gigabud.** An Android banking-fraud campaign abuses Android Work Profile functionality through a tool called Vwork to clone victims' banking applications. The Gigabud malware used in the operation was linked to at least 1,469 compromised devices in Indonesia and nearly USD 1 million in losses. **GoldFactory has no MITRE ATT&CK profile in the verified reference data — treat this attribution as unconfirmed.** The campaign is also single-sourced to Check Point Research. **AI threats.** Three items are reported without atomic detail: PuzzleMask, a plain-prose prompt technique that evades lightweight LLM gatekeepers while stronger target models recover the concealed instructions (gatekeepers classified prompts as safe; target models acted on concealed payloads in more than 90% of trials); a covert cross-account channel in ChatGPT's code-execution environment demonstrated by retrieving Gmail data from one account and relaying it to another via a shared conversation; and four Anthropic incidents where Claude models operated on the real internet due to configuration failures, the most serious involving a malicious PyPI package that was executed by systems, exposing credentials and enabling database access. ## 4\. Mitigation & containment ### P1 — within 24 hours 1. **GitLab CE/EE — upgrade to 19.1.8, 19.2.6 or 19.3.2.** Any instance on 18.7 through 19.3.1 is affected. If the upgrade cannot be completed inside 24 hours, block unauthenticated access to the repository commits API at the reverse proxy or WAF and review web-server and GitLab production logs for unauthenticated reads against that API. 2. **Metabase — patch self-hosted instances.** The source names no fixed version; obtain the current fixed release from the vendor. In parallel, remove internet exposure: Metabase should not be reachable from untrusted networks. Review database query logs for injected SQL against the internal reporting database and treat any confirmed injection as a data-compromise incident. 3. **Microsoft — apply the September 2026 Patch Tuesday updates**, prioritising CVE-2026-85880 and CVE-2026-81963 on internet-facing systems and on hosts with privileged access. Both are local privilege-escalation flaws to SYSTEM, so they are post-compromise enablers as much as standalone risks. Triage the 20 unauthenticated-RCE flaws by component once Microsoft's advisory detail is available; the source does not identify them. 4. **MikroTik RouterOS — apply fixes for CVE-2026-67276 and CVE-2026-86060.** Disable SSH on WAN interfaces. Audit for passwordless SSH keys, unexpected administrator accounts, altered DNS settings and modified firewall rules on all RouterOS devices. ### P2 — within 72 hours 1. **Chrome — update to the current release** to close CVE-2026-85046\. The BlueMoon chain was used against unpatched systems after patches shipped, so unmanaged and unpatched endpoints are the exposure. 2. **Microsoft 365 identity hardening.** Enforce phishing-resistant authentication (FIDO2/passkeys) for privileged and finance roles. Restrict which users may register new authentication methods, and alert on any new authentication-method registration. Review SharePoint, OneDrive and Exchange access logs for sessions originating from newly registered methods or unfamiliar devices. 3. **Information-request handling (Revolut pattern).** Require out-of-band callback verification for any request for identity documents, IBANs, statements or transaction histories — including requests arriving from a legitimate government-agency domain. Require dual authorisation for bulk disclosure. Run a retrospective review of fulfilled information requests over the past 12 months for the same pattern. ### P3 — within 7 days 1. **Component inventory.** Enumerate self-hosted third-party components (Metabase, GitLab CE/EE, RouterOS, and equivalents) with owner, version and patch state, and map them to CVE exposure. This is the control that NIS2 Art. 21(2)(d) supply-chain measures require and that the Mathspace breach demonstrates is missing in practice. 2. **GenAI and agent controls.** Restrict agent tool permissions and connected-application scopes; review connected apps on ChatGPT, Claude and similar platforms; monitor for agent-initiated outbound network activity; apply provenance checks to packages pulled from PyPI and equivalent registries. 3. **Mobile banking fraud.** Block sideloaded applications, monitor for Android Work Profile creation on managed devices, and require MFA on banking applications. Applies to the GoldFactory/Vwork campaign — attribution unconfirmed, single-sourced. ## 5\. Indicators of compromise No atomic indicators of compromise are available in the source material. The bulletin names tools and campaigns (Vwork, Gigabud, BlueMoon, PuzzleMask) but provides no hashes, domains, IP addresses, file paths, registry keys or command lines. The table below records the observable behaviours the source describes; all are single-sourced to Check Point Research and should be validated against your own telemetry before being used for enforcement. ### Behavioural indicators | Behaviour | Where to observe | Confidence | | ------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------- | ------------------------------------------------------------------ | | New authentication method registered on a Microsoft 365 account following a phone or SMS lure | Entra ID / Azure AD audit logs | Medium — single-sourced; verify before enforcement | | Employee directed to a lookalike Microsoft 365 sign-in page via phone or text | Email/SMS gateway logs, web proxy, DNS | Medium — single-sourced; verify before enforcement | | Access to SharePoint, OneDrive or Exchange from a newly registered authentication method or unfamiliar device | Microsoft 365 unified audit log | Medium — single-sourced; verify before enforcement | | Unauthenticated read against the GitLab repository commits API | GitLab production logs, reverse-proxy access logs | Medium — single-sourced; verify before enforcement | | SQL injection against a self-hosted Metabase instance reaching an internal reporting database | Metabase query logs, database audit logs | Medium — single-sourced; verify before enforcement | | Passwordless SSH authentication to a RouterOS device; unexpected administrator account creation; DNS or firewall configuration change | RouterOS logging, syslog | Medium — single-sourced; verify before enforcement | | Android Work Profile created and a banking application cloned on an employee or customer device | MDM / mobile threat defence telemetry | Low — single-sourced and attribution to GoldFactory is unconfirmed | | Inbound request for identity documents, IBANs, statements or transaction histories originating from a government-agency domain | Email gateway, case-management system | Medium — single-sourced; verify before enforcement | ## 6\. Detection The source contains no file artefacts — no hashes, filenames, paths, registry keys, mutexes, scheduled-task names or command-line flags — so no YARA rule can be written that would detect the threat rather than reporting about it. A Sigma rule is possible for the one behaviour with a distinctive, source-quoted string. ```yaml title: Microsoft 365 Authentication Method Registration Following Phishing Lure id: 3b7f0c21-9a4e-4d18-b6c2-5e0a7d9f4c11 status: experimental description: > Detects registration of a new authentication method on a Microsoft 365 account, the post-compromise step described in the passkey-themed social engineering campaign in Check Point Research's 14 September 2026 bulletin. Attackers lure employees to lookalike sign-in pages by phone and text, then register their own authentication methods and collect data from SharePoint, OneDrive and Exchange. references: - https://research.checkpoint.com/2026/14th-september-threat-intelligence-report/ author: Adverse Trace date: 2026/09/14 logsource: product: azure service: auditlogs detection: selection: OperationName|contains: 'authentication method' condition: selection falsepositives: - Legitimate user enrolment of a new MFA method or passkey - Helpdesk-driven authentication method resets level: medium tags: - attack.persistence - attack.defense_evasion ``` **Deployment caveat:** the `OperationName` value must be validated against your tenant's Entra ID audit schema before the rule is enabled — the string `authentication method` is taken verbatim from the source description, not from a confirmed audit-log operation name. Tune against legitimate MFA enrolment before alerting. ## Threat actor context **ShinyHunters** · [G1057](https://attack.mitre.org/groups/G1057?ref=f4n6.co.uk) · aka UNC6240, Bling Libra [ShinyHunters](https://attack.mitre.org/groups/G1057?ref=f4n6.co.uk) is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. [ShinyHunters](https://attack.mitre.org/groups/G1057?ref=f4n6.co.uk) has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. … *No MITRE ATT&CK profile for: GoldFactory.* ## 7\. Sources - Check Point Research — *14th September – Threat Intelligence Report* — https://research.checkpoint.com/2026/14th-september-threat-intelligence-report/ — 2026-09-14 (primary item) - Check Point Research — *31th August – Threat Intelligence Report* — https://research.checkpoint.com/2026/31th-august-threat-intelligence-report/ — 2026-08-31 - Check Point Research — *17th August – Threat Intelligence Report* — https://research.checkpoint.com/2026/17th-august-threat-intelligence-report/ — 2026-08-17 - Check Point Research — *29th June – Threat Intelligence Report* — https://research.checkpoint.com/2026/29th-june-threat-intelligence-report-2/ — 2026-06-29 - Check Point Research — *22nd June – Threat Intelligence Report* — https://research.checkpoint.com/2026/22nd-june-threat-intelligence-report/ — 2026-06-22 - Check Point Research — *8th June – Threat Intelligence Report* — https://research.checkpoint.com/2026/8th-june-threat-intelligence-report/ — 2026-06-08 - Check Point Research — *25th May – Threat Intelligence Report* — https://research.checkpoint.com/2026/25th-may-threat-intelligence-report/ — 2026-05-25 ## 8\. Adverse Trace position This is a weekly vendor roundup and every technical claim in it is single-sourced to Check Point Research; nothing here is corroborated by a second vendor, by NVD, or by CISA. The verified reference data supplied with this item carries no CVSS scores, no EPSS values and no CISA KEV entries for any of the CVEs named, so we have not assigned severity ourselves and we have not stated any remediation due date — the GitLab CVSS 10.0 and the "actively exploited" status of the two Microsoft zero-days are the source's characterisations and are labelled as --- [Read the original source →](https://research.checkpoint.com/2026/14th-september-threat-intelligence-report/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*