> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Checkpoint Threat Intelligence Report - URL: https://f4n6.co.uk/security-feed/checkpoint-threat-intelligence-report/ - Published: 2026-10-05T20:41:15.000Z - Updated: 2026-10-05T20:41:15.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-88771, CVE-2026-88772, CVE-2026-76504, CVE-2026-86950, CVE-2026-90970, Storm-3168, UAT-11587, TA419, Star Blizzard ## 1\. Executive summary Check Point's weekly bulletin for the week of 5th October 2026 covers four actively exploited vulnerabilities, three of which are in CISA KEV: CVE-2026-88771 and CVE-2026-88772 (both CVSS 9.5 CRITICAL, NetScaler ADC and Gateway, KEV added 2026-09-27), CVE-2026-76504 (CVSS 9.8 CRITICAL, Cisco Catalyst SD-WAN Manager, KEV added 2026-09-30, no fix available), and CVE-2026-86950 (CVSS 8.8 HIGH, Apple CoreGraphics, KEV added 2026-09-29). CVE-2026-90970 (CVSS 9.9 CRITICAL, GitLab AI Gateway) is not in KEV. The NetScaler pair is the priority for EMEA financial services: exploited appliances are being used to deploy web shells and tunneling malware, steal credentials, and pivot into internal networks, which places internet-facing ADC and Gateway estates directly in scope. Cisco SD-WAN Manager has no vendor fix, so exposure reduction is the only available control until Cisco ships one. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17 | NetScaler appliances are being exploited to deploy web shells and tunneling malware and to move from exposed appliances into internal networks, which is an active intrusion path into production ICT systems. | Incident management process must cover detection and containment of post-exploitation activity on edge appliances, not just the initial CVE. | | DORA Art. 19 | CVE-2026-76504 has active exploitation and no vendor fix, so a compromise may be undetectable by patching alone and may meet major-incident reporting thresholds. | If a Catalyst SD-WAN Manager instance is compromised, the reporting clock runs from classification, and "no fix available" does not defer the obligation. | | NIS2 Art. 21(2)(d) | NetScaler ADC, Catalyst SD-WAN Manager and GitLab AI Gateway are third-party components in the delivery chain, and two of the three have exploited flaws. | Supply chain security measures must include tracking vendor advisories and fix availability for these components, and evidencing that tracking. | ## 3\. Technical analysis & attack chain This is a weekly roundup covering multiple unrelated vulnerabilities and campaigns. The four KEV-listed CVEs are treated in depth below; the remaining items are covered at the level the source supports. ### 3.1 NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772 Confirmed attack chain, as reported: 1. Attacker reaches an exposed NetScaler ADC or Gateway appliance. 2. Exploitation of CVE-2026-88771 (CVSS 9.5 CRITICAL, CWE-20 Improper Input Validation, KEV added 2026-09-27) or CVE-2026-88772 (CVSS 9.5 CRITICAL, CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer, KEV added 2026-09-27) yields remote access. 3. The attacker deploys web shells and tunneling malware on the appliance. 4. Credentials are stolen from the appliance. 5. The attacker moves from the exposed appliance into internal networks. Check Point's IPS signatures name the two flaws as "Citrix NetScaler Multiple Products Buffer Overflow (CVE-2026-88772)" and "Citrix NetScaler Multiple Products Command Injection (CVE-2026-88771)". Note the discrepancy: the IPS signature labels CVE-2026-88771 as command injection, while the verified reference data records it as CWE-20 Improper Input Validation. Both can describe the same flaw, and the verified classification stands. The source gives no affected version numbers, no appliance model list, no web shell filenames or paths, and no C2 infrastructure. Citrix has issued fixes; the source does not name the fixed versions. ### 3.2 Cisco Catalyst SD-WAN Manager: CVE-2026-76504 CVE-2026-76504 is CVSS 9.8 CRITICAL, CWE-177, KEV added 2026-09-30, EPSS 2%. An unauthenticated remote attacker sends crafted requests to gain administrator access to Catalyst SD-WAN Manager. Cisco reported active exploitation and stated that no fixes are available. Check Point's IPS signature is "Cisco Catalyst SD-WAN Manager Authentication Bypass (CVE-2026-76504)". The source gives no affected version range, no indicator of what the attacker does after gaining administrator access, and no workaround. Because there is no fix, the only controls available are network exposure reduction and detection of administrator-level actions that should not be occurring. ### 3.3 Apple CoreGraphics: CVE-2026-86950 CVE-2026-86950 is CVSS 8.8 HIGH, CWE-787 Out-of-bounds Write, KEV added 2026-09-29\. Processing a malicious image or PDF allows arbitrary code execution on iPhones, iPads and Macs. Apple reported exploitation in highly targeted attacks and fixed the flaw through improved bounds checking across affected iOS, iPadOS and macOS releases. The source does not name the specific OS versions. The "highly targeted" framing means the realistic exposure for a financial services estate is senior staff, executives and anyone handling documents from external parties, not the general user population. ### 3.4 GitLab AI Gateway: CVE-2026-90970 CVE-2026-90970 is CVSS 9.9 CRITICAL, CWE-1336, EPSS 1%, and is not in CISA KEV. An authenticated Duo Agent Platform user can escape the prompt-template sandbox and execute arbitrary commands on the AI Gateway host. GitLab has released patches. The source does not name the fixed versions. The authentication requirement lowers the external risk, but any organisation running the AI Gateway with Duo Agent Platform enabled should treat this as an internal privilege boundary failure: a normal platform user reaches host command execution. ### 3.5 Other items in the bulletin Warlock ransomware operators exploited SharePoint ToolShell vulnerabilities for initial access against utilities, telecom, government and education organisations, disabled endpoint protection on dozens of systems, and deployed ransomware across at least 33 hosts in one intrusion. The source does not name the specific SharePoint CVEs. UAT-11587, a China-nexus espionage group, targeted government and policy organisations across Asia using spear-phishing and tailored decoy documents to deliver the Antino backdoor. Antino uses Microsoft 365 services for command and control, file transfer, system reconnaissance, command execution and persistence. UAT-11587 has no MITRE ATT&CK profile in the verified reference data, so the China-nexus attribution is unconfirmed. TA419, described as China-aligned, targeted US AI policy experts at think tanks, universities and law firms. The group impersonates prominent economists and AI policymakers, builds rapport through benign email, then redirects targets to phishing pages that steal Microsoft 365 credentials and session cookies. TA419 has no MITRE ATT&CK profile in the verified reference data, so the China-aligned attribution is unconfirmed. Star Blizzard (MITRE G1033, Russia-linked) ran phishing campaigns against more than 100 organisations, primarily in the US and UK. The actor uses a new RedFlick delivery technique to install the CosmicPulse backdoor through scheduled tasks, supporting espionage against governments, NGOs, think tanks and organisations connected to Ukraine. Star Blizzard is the only named actor in this bulletin with a MITRE ATT&CK profile. Storm-3168, tracked as JadePuffer, used compromised Azure service principals to automate cloud reconnaissance and destructive actions, including deleting storage and application resources, targeting backup-related assets, and attempting to retrieve access keys. Storm-3168 has no MITRE ATT&CK profile in the verified reference data, so the AI-enabled actor characterisation is unconfirmed. A ClickFix campaign used malicious Custom GPTs hosted on ChatGPT to deliver remote access malware. Victims were redirected to a Google Sites page and tricked into running commands. Huntress investigated at least 40 related incidents, including two confirmed infections that began through Custom GPTs. This is single-sourced to Huntress via the Check Point summary. Autonomous AI agents attempted failed SQL injection against the US Department of Education and Library and Archives Canada while gathering public information. No compromise was reported and the origin of the agents is unconfirmed. Breach items with no technical detail in the source: Arizona's state court system (phishing-led, backup files and more than 150,000 Foster Care Review Board reports dating to 2010 copied), Times Car (approximately 6.6 million accounts, driver's-licence images for about 1.6 million, no payment card data), South Africa's air navigation provider (ransomware affecting operational technology supporting aviation weather services, possible data theft per separate reporting), and Fakturownia (account and company data, password hashes, bank account details, authentication tokens, contractor information and portions of invoices copied after exploitation of a system vulnerability). ## 4\. Mitigation & containment ### P1 (within 24 hours) - NetScaler ADC and Gateway: apply the Citrix fixes for CVE-2026-88771 and CVE-2026-88772\. Both are in CISA KEV with a 2026-09-27 addition date. Where patching cannot complete inside 24 hours, remove the management interface and any Gateway or ADC virtual server from internet exposure. Hunt for web shells and tunneling malware on every appliance, and rotate all credentials that were stored on or passed through the appliance. Treat any appliance with unexplained outbound connections as compromised and rebuild it rather than cleaning it. - Cisco Catalyst SD-WAN Manager: there is no fix. Restrict management access to a dedicated out-of-band path or a tightly scoped allowlist, and remove the management interface from general internet reachability. Enable and forward authentication and configuration-change logging to the SIEM, and alert on administrator account creation, policy changes and configuration exports. If the instance is internet-facing and cannot be moved behind access control, treat it as compromised until logs prove otherwise. - Apple CVE-2026-86950: apply the iOS, iPadOS and macOS updates to executive, finance, legal and any staff who routinely open documents from external senders. This is the population the "highly targeted" exploitation description points at. ### P2 (within 72 hours) - GitLab AI Gateway: apply the GitLab patches for CVE-2026-90970\. Until patched, restrict Duo Agent Platform access to named users and review AI Gateway host logs for command execution by platform users. - Review NetScaler and SD-WAN Manager logs for the preceding 30 days for the post-exploitation behaviours in §5, on the assumption that KEV addition dates lag real exploitation. - Confirm Check Point IPS coverage is enabled and current for the three signatures named in the source: Citrix NetScaler Multiple Products Buffer Overflow (CVE-2026-88772), Citrix NetScaler Multiple Products Command Injection (CVE-2026-88771), and Cisco Catalyst SD-WAN Manager Authentication Bypass (CVE-2026-76504). ### P3 (within 7 days) - Where SharePoint is internet-facing, confirm it is patched against the ToolShell vulnerabilities the Warlock operators exploited, and confirm endpoint protection cannot be disabled by a non-administrative process or by tampering that bypasses the EDR console. - Review Microsoft 365 sign-in logs for the TA419 and UAT-11587 patterns: credential and session-cookie theft leading to anomalous mailbox access, and command and control over Microsoft 365 services. Enforce token protection and conditional access for the policy, legal and executive populations these actors target. - Review scheduled-task creation on endpoints and servers for the RedFlick and CosmicPulse pattern associated with Star Blizzard. - Audit Azure service principals for the Storm-3168 pattern: unexpected deletions of storage and application resources, access to backup-related assets, and access-key retrieval attempts. Restrict service principal permissions to the minimum each automation actually needs. ## 5\. Indicators of compromise No atomic indicators (hashes, domains, IP addresses, file paths, registry keys) are present in the source material. The source describes behaviours only. Behavioural indicators: | Behaviour | Where to observe | Confidence | | --------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------- | --------------------------------------------------- | | Web shell and tunneling malware deployed on NetScaler ADC or Gateway appliances | NetScaler appliance filesystem and process list; outbound connections from the appliance | High, multi-source (CISA KEV plus vendor reporting) | | Credential theft from NetScaler appliances | NetScaler authentication logs; downstream authentication anomalies | High | | Movement from an exposed NetScaler appliance into internal networks | Internal authentication and lateral movement telemetry | High | | Unauthenticated administrator access to Catalyst SD-WAN Manager | SD-WAN Manager authentication logs; administrator account creation | High | | Endpoint protection disabled across multiple hosts before ransomware deployment | EDR console tamper alerts and coverage gaps | Medium, single-sourced to the Check Point summary | | Antino backdoor command and control over Microsoft 365 services | Microsoft 365 audit logs; unusual service usage from a compromised host | Medium, single-sourced | | Microsoft 365 credential and session-cookie theft via phishing pages | Microsoft 365 sign-in logs; impossible-travel and token-replay alerts | Medium, single-sourced | | CosmicPulse backdoor installed through scheduled tasks | Windows scheduled-task creation events | Medium, single-sourced | | Azure service principal deleting storage and application resources and retrieving access keys | Azure activity logs; service principal audit trail | Medium, single-sourced | | Commands run by users after redirection to a Google Sites page (ClickFix) | Endpoint process creation telemetry; browser history | Medium, single-sourced to Huntress | ## 6\. Detection The source provides no file hashes, no filenames, no registry keys and no command-line strings. The only artefacts usable for detection are the product and vulnerability identifiers that Check Point's own IPS signatures key on, plus the behavioural patterns above. A YARA rule built on CVE identifiers or product names would detect reporting about the threat rather than the threat, so none is emitted here. Sigma rule for the Catalyst SD-WAN Manager authentication bypass, keyed on the absence of a fix and the administrator-access outcome: ```yaml title: Cisco Catalyst SD-WAN Manager Administrator Access Without Prior Authentication id: 8f3c1a72-4d5e-4b90-9c21-7a6e0d2b5f14 status: experimental description: Detects administrator-level access to Cisco Catalyst SD-WAN Manager where the preceding authentication event is absent or anomalous, consistent with CVE-2026-76504 (CVSS 9.8, CISA KEV 2026-09-30, no vendor fix available). author: Adverse Trace date: 2026-10-05 references: - https://research.checkpoint.com/2026/5th-october-threat-intelligence-report/ logsource: product: cisco service: sd-wan-manager detection: selection_admin: event_type: - 'admin_login' - 'admin_account_created' - 'config_change' selection_no_auth: authentication_result: 'none' condition: selection_admin and selection_no_auth falsepositives: - Legitimate administrative sessions where the authentication event is logged to a separate stream level: high ``` Sigma rule for the Star Blizzard RedFlick scheduled-task delivery pattern: ```yaml title: Scheduled Task Created by Non-Standard Parent Process id: 2b7e9d41-6c08-4a3f-b5d2-1e4f8a0c9d37 status: experimental description: Detects scheduled-task creation consistent with the RedFlick delivery technique used by Star Blizzard (MITRE G1033) to install the CosmicPulse backdoor. author: Adverse Trace date: 2026-10-05 references: - https://research.checkpoint.com/2026/5th-october-threat-intelligence-report/ logsource: product: windows service: security detection: selection: EventID: 4698 filter_system: ParentImage|endswith: - '\svchost.exe' - '\services.exe' - '\taskeng.exe' condition: selection and not filter_system falsepositives: - Software deployment and patch management tools that register scheduled tasks level: medium ``` ## CVE assessment 5 referenced CVEs — **4 actively exploited (CISA KEV)**, 4 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------ | ---------------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-76504](https://nvd.nist.gov/vuln/detail/CVE-2026-76504?ref=f4n6.co.uk) | 9.8 Critical | ⚠ KEV 2026-09-30 | 2% | A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthentica… | | [CVE-2026-88771](https://nvd.nist.gov/vuln/detail/CVE-2026-88771?ref=f4n6.co.uk) | 9.5 Critical | ⚠ KEV 2026-09-27 | 1% | Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 1… | | [CVE-2026-88772](https://nvd.nist.gov/vuln/detail/CVE-2026-88772?ref=f4n6.co.uk) | 9.5 Critical | ⚠ KEV 2026-09-27 | 1% | Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.… | | [CVE-2026-86950](https://nvd.nist.gov/vuln/detail/CVE-2026-86950?ref=f4n6.co.uk) | 8.8 High | ⚠ KEV 2026-09-29 | 1% | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.1 and iPadOS 26.7.1,… | | [CVE-2026-90970](https://nvd.nist.gov/vuln/detail/CVE-2026-90970?ref=f4n6.co.uk) | 9.9 Critical | — | 1% | GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 b… | ## Threat actor context **Star Blizzard** · [G1033](https://attack.mitre.org/groups/G1033?ref=f4n6.co.uk) · aka SEABORGIUM, Callisto Group, TA446, COLDRIVER [Star Blizzard](https://attack.mitre.org/groups/G1033?ref=f4n6.co.uk) is a cyber espionage and influence group originating in Russia that has been active since at least 2019\. [Star Blizzard](https://attack.mitre.org/groups/G1033?ref=f4n6.co.uk) campaigns align closely with Russian state interests and have included persistent phishing and credential theft against academic, defense, government, NGO, and think tank organizations in NATO countries, particularly the US and the UK. *No MITRE ATT&CK profile for: Storm-3168, UAT-11587, TA419.* ## 7\. Sources - Check Point Research, "5th October – Threat Intelligence Report", https://research.checkpoint.com/2026/5th-october-threat-intelligence-report/, 2026-10-05. - Check Point Research, "28th September – Threat Intelligence Report", https://research.checkpoint.com/2026/28th-september-threat-intelligence-report/, 2026-09-28. - Check Point Research, "7th September – Threat Intelligence Report", https://research.checkpoint.com/2026/7th-september-threat-intelligence-report/, 2026-09-07. - Check Point Research, "17th August – Threat Intelligence Report", https://research.checkpoint.com/2026/17th-august-threat-intelligence-report/, 2026-08-17. - Check Point Research, "3rd August – Threat Intelligence Report", https://research.checkpoint.com/2026/3rd-august-threat-intelligence-report/, 2026-08-03. - Check Point Research, "27th July – Threat Intelligence Report", https://research.checkpoint.com/2026/27th-july-threat-intelligence-report/, 2026-07-27. - Check Point Research, "8th June – Threat Intelligence Report", https://research.checkpoint.com/2026/8th-june-threat-intelligence-report/, 2026-06-08. ## 8\. Adverse Trace position The NetScaler pair is the item that matters to EMEA financial services clients this week. Both CVEs are CVSS 9.5 CRITICAL and in CISA KEV since 2026-09-27, and the reported post-exploitation behaviour (web shells, tunneling malware, credential theft, movement into internal networks) is exactly the pattern that turns an edge appliance flaw into a full intrusion. Cisco Catalyst SD-WAN Manager at CVSS 9.8 CRITICAL with active exploitation and no fix is the harder problem: there is no patch to schedule, so the control is exposure reduction and detection, and clients running it internet-facing should assume compromise until logs show otherwise. Apple CVE-2026-86950 at CVSS 8.8 HIGH is a targeted-attack flaw and belongs on the executive and document-handling device estate, not the whole fleet. GitLab CVE-2026-90970 at CVSS 9.9 CRITICAL is not in KEV and requires authentication, so it is a patch-cycle item rather than an emergency. The actor reporting in this bulletin is largely single-sourced to Check Point, and three of the four named actors (Storm-3168, UAT-11587, TA419) have no MITRE ATT&CK profile, so we treat those attributions as unconfirmed and will not build detection or blocking on them. Star Blizzard is the exception, with a MITRE profile (G1033). We will pull the underlying Check Point bulletin for the NetScaler and SD-WAN items to extract affected version ranges and any indicators the summary omitted, and we will issue a follow-up if Cisco publishes a fix for CVE-2026-76504 or if Citrix confirms the fixed NetScaler versions. --- [Read the original source →](https://research.checkpoint.com/2026/5th-october-threat-intelligence-report/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*