31th August – Threat Intelligence Report

1. Executive summary

Check Point's weekly intelligence report covers four items with direct operational relevance to EMEA financial services: emergency PaperCut fixes for two actively exploited vulnerabilities — CVE-2026-81578 (CVSS 8.8 HIGH, in CISA KEV since 2026-08-31) and CVE-2026-82078 (CVSS 9.4 CRITICAL, in CISA KEV since 2026-08-31) — which chain to unauthenticated remote code execution on PaperCut NG and MF servers; a 21-vulnerability Ubiquiti patch cycle across UniFi Protect, Network, Access, Talk and UniFi OS with several CVSS 10.0 flaws; and three CVSS 10.0 ServiceNow AI Platform flaws (CVE-2026-18885, CVE-2026-18886, CVE-2026-74820 — none yet in CISA KEV). Separately, the McKesson breach — ShinyHunters (MITRE G1057) claiming vishing into Okta followed by Salesforce and Snowflake exfiltration of ~1TB / ~284 million patient-related records — is a working template for identity-led cloud data theft against large enterprises. The UK's Manchester Airports Group disclosure (8.7 million customers) is a reminder that UK NIS-regulated CNI operators remain active targets.

2. Regulatory framing

No NIS2 or UK NIS article is directly engaged by this item for our client base; the UK NIS-relevant event (Manchester Airports Group) is a disclosure by an OES, not an obligation triggered for financial entities.

3. Technical analysis & attack chain

PaperCut NG/MF — CVE-2026-81578 + CVE-2026-82078 chain (actively exploited, both in CISA KEV, added 2026-08-31). This is the urgent item. Per the verified reference data: CVE-2026-81578 is CVSS 8.8 HIGH, CWE-305 (Authentication Bypass by Primary Weakness); CVE-2026-82078 is CVSS 9.4 CRITICAL, CWE-470 (Unsafe Reflection). The source describes the second flaw as "unsafe class loading" — consistent with CWE-470's unsafe-reflection mechanism. The two chain: an unauthenticated attacker bypasses authentication via CVE-2026-81578, then abuses unsafe class loading via CVE-2026-82078 to achieve unauthenticated remote code execution on affected PaperCut NG and MF servers. PaperCut has released emergency fixes. Both KEV entries carry EPSS 0% at time of writing — treat EPSS as lagging here, not as evidence of low risk; active exploitation is confirmed by the KEV listing itself. Note: the source text does not specify affected version ranges or the vulnerable components within PaperCut; obtain these from PaperCut's advisory before scoping.

ServiceNow AI Platform — CVE-2026-18885, CVE-2026-18886, CVE-2026-74820 (all CVSS 10.0 CRITICAL, none in CISA KEV, EPSS 0%). Per the verified reference data: CWE-94 (Code Injection), CWE-284 (Improper Access Control), and CWE-89 (SQL Injection) respectively. The source states these allow unauthenticated attackers to execute code, escalate privileges, or access and modify instance data. ServiceNow instances frequently hold HR, customer and workflow data — treat instance data exposure as a data-breach vector, not just a code-execution issue. No KEV listing and no observed exploitation in the source; urgency is driven by the 10.0 scores and unauthenticated nature, not by in-the-wild activity.

Ubiquiti — 21 critical/high vulnerabilities across UniFi Protect, Network, Access, Talk, UniFi OS and other products. Flaw classes per the source: authentication bypass, command injection, privilege escalation, with several CVSS 10.0 scores. Successful exploitation yields administrative control of affected devices. The verified reference data does not enumerate the individual CVEs, so we cannot give a per-CVE triage table; scope by product line instead. Context from prior reporting (corpus-2, 29 June): UniFi OS flaws CVE-2026-34908/34909/34910 were previously exploited in the wild with Mirai botnet activity — single-sourced to that earlier report, but it establishes that UniFi edge devices are an actively worked attack surface, raising the priority of this cycle.

McKesson breach — ShinyHunters (MITRE G1057). Claimed attack chain, per the source: (1) vishing against McKesson staff to compromise Okta accounts; (2) use of the compromised identity to access third-party applications — Salesforce and Snowflake; (3) exfiltration of approximately 1TB containing approximately 284 million patient-related records. This is the same actor that claimed the 7-Eleven Salesforce breach (corpus-1) and the NAIC Oracle PeopleSoft zero-day theft of 3.1TB (corpus-2) — a consistent pattern of SaaS/data-platform targeting via initial access rather than endpoint malware. The McKesson specifics (vishing-to-Okta, 1TB/284M records) are single-sourced to Check Point's summary of the ShinyHunters claim; the actor's claim of scope has not been independently corroborated in the provided material. Verify before treating the record count as established fact.

Other items, briefly: Vercel patched two critical Next.js flaws — CVE-2026-75604 (Windows-specific path traversal) and a libheif AVIF image-processing flaw, both unauthenticated RCE under affected configurations; fixes in Next.js 15.5.24 and 16.3.3; a public PoC exists for the AVIF issue. The ATF compromise (standalone system, disconnected post-compromise) carries a Qilin ransomware-group claim of responsibility — Qilin has no MITRE ATT&CK profile in our verified data, so treat that attribution as unconfirmed. The QTFY/QScan/QTRouter disruption and the Nimbus Manticore toolset (SSH tunnelling utility, C++ backdoor resembling TWOSTROKE) are US-government and vendor-research items respectively; both actor attributions lack MITRE profiles in the verified data and are unconfirmed. The Chinese actor exploiting known ownCloud and WordPress vulnerabilities against Philippine targets is outside EMEA financial scope.

4. Mitigation & containment

P1 — within 24 hours

• PaperCut NG/MF (KEV, actively exploited): Inventory all PaperCut NG and MF servers, including those exposed on the internet. Apply PaperCut's emergency fixes immediately. If a server cannot be patched today, block inbound access to the PaperCut application ports at the perimeter (the source does not specify port numbers — default PaperCut deployments are commonly TCP 9191/9192, but confirm against your deployment rather than assuming) and place the host under enhanced monitoring. Review PaperCut server logs for unauthenticated access anomalies and unexpected class-loading or process-spawn activity predating the patch. Any confirmed exploitation is a DORA Art. 19 reporting candidate — see §2.
• ServiceNow: Confirm whether you run the affected AI Platform components; if yes, apply ServiceNow's fixes for CVE-2026-18885, CVE-2026-18886 and CVE-2026-74820 within the same window given the unauthenticated, CVSS 10.0 nature. Check instance audit logs for unauthenticated code-execution or anomalous data-access patterns.

P2 — within 72 hours

• Ubiquiti: Identify all UniFi Protect, Network, Access, Talk and UniFi OS deployments, including branch-office and physical-security edge devices. Apply the vendor firmware updates across the estate. Given prior in-the-wild UniFi OS exploitation (Mirai, per the 29 June report), verify devices are not internet-exposed management interfaces; restrict management access to admin VPN or management VLANs.
• Okta/Salesforce/Snowflake hardening (McKesson template): Review Okta admin and privileged-role assignments; enforce phishing-resistant MFA (FIDO2/WebAuthn) for all admin and privileged accounts; enable and review Okta system logs for anomalous authentications. Verify Salesforce and Snowflake tenant logging is enabled and retained; check for recent anomalous bulk exports or API data pulls. Brief the service desk and high-risk staff on vishing pretexts targeting identity-platform credentials — the McKesson chain began with a phone call, not malware.
• Next.js: Upgrade to 15.5.24 or 16.3.3 for any Windows-hosted Next.js deployments and any image-processing pipelines using libheif/AVIF; a public PoC exists for the AVIF flaw, so treat unpatched instances as actively weaponisable.

P3 — within 7 days

• Fold the PaperCut, ServiceNow, Ubiquiti and Next.js patch states into your vulnerability-management reporting and verify closure across all sites and subsidiaries.
• Review third-party/SaaS application inventory against the McKesson pattern: for each SaaS platform holding significant data, confirm who holds privileged tenant access and how compromise of that identity would be detected.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules.

The source material provides no threat artefacts — no strings, file names, command lines, registry keys, mutexes or network signatures — for the PaperCut, ServiceNow, Ubiquiti or McKesson items. The behaviours in §5 are log-review patterns, not rule-authorable artefacts, and we will not emit rules that grep for CVE identifiers or product names, as those detect reporting about the threat rather than the threat itself.

CVE assessment

5 referenced CVEs — 2 actively exploited (CISA KEV), 4 critical (CVSS ≥ 9.0)

Could not resolve: CVE-2026-75604.

Threat actor context

ShinyHunters · G1057 · aka UNC6240, Bling Libra

ShinyHunters is a cyber criminal collective that has been active since at least 2019 operating under the ShinyCorp persona. ShinyHunters has targeted multiple industries and geographic regions gathering legitimate credentials and personally identifiable information (PII) for resale or extortion of victims. …

No MITRE ATT&CK profile for: Qilin, QTFY, Nimbus Manticore.

7. Sources

• Check Point Research — 31th August – Threat Intelligence Report — https://research.checkpoint.com/2026/31th-august-threat-intelligence-report/ — 2026-08-31
• Check Point Research — 25th May – Threat Intelligence Report — https://research.checkpoint.com/2026/25th-may-threat-intelligence-report/ — 2026-05-25 (context: prior ShinyHunters activity)
• Check Point Research — 29th June – Threat Intelligence Report — https://research.checkpoint.com/2026/29th-june-threat-intelligence-report-2/ — 2026-06-29 (context: prior ShinyHunters activity; prior UniFi OS exploitation)

8. Adverse Trace position

The PaperCut pair is the actionable core of this report: both CVEs are in CISA KEV as of 2026-08-31, both are actively exploited, and the chain yields unauthenticated RCE on a product commonly deployed with internet exposure — clients running PaperCut NG or MF should treat patching as a same-day activity, and the EPSS 0% readings should be ignored as lagging indicators. The ServiceNow trio (all CVSS 10.0, unauthenticated, no KEV) is the second priority, particularly where instances hold regulated data. The McKesson breach matters less as a McKesson event than as a repeatable template — vishing into Okta, then riding the identity into SaaS data platforms — that maps directly onto EMEA financial-sector SaaS estates; the specific figures (1TB, 284M records) are single-sourced to the actor's claim and should be treated as unverified. Attribution caveats: ShinyHunters is confirmed as MITRE G1057; Qilin, QTFY and Nimbus Manticore have no MITRE profiles in our verified data and their attributions are unconfirmed. We will monitor for PaperCut and ServiceNow exploitation detail, per-CVE Ubiquiti identifiers, and independent corroboration of the McKesson exfiltration scope, and will issue a follow-up if KEV or EPSS movement or observed-exploitation detail changes the triage.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.