8 min read

Cyber Threat Intelligence Report

Picture of PacketWatch Team Sixty43 PacketWatch Team Sixty43 : September 8, 2026

Threat Intel Biweekly Briefing
Cyber Threat Intelligence Report

 

This week, we briefed our clients on a new ClickFix variant, TerminalFix, that establishes a Websocket tunnel to the threat actor's C2 domain.


 KEY TAKEAWAYS 

  • New ClickFix variant “TerminalFix” establishes WebSocket proxy with Python.
  • Massive data leak of over 153 million driver’s licenses and other identification cards on the dark web.
  • Critical and high-severity vulnerabilities PaperCut, SonicWall, ServiceNow, N-able, HPE ArubaOS, and Ubiquiti, plus updates to CISA KEV, patch now!

 

New ClickFix Variant - TerminalFix

ClickFix attacks continue to be one of the most common initial access techniques used by threat actors today. This simple technique shows the unsuspecting user what appears to be a Cloudflare-style CAPTCHA listing a series of steps to "verify you are human". However, if the user follows the steps, they will execute code that facilitates the download and execution of malware, typically infostealers or loaders which ultimately lead to ransomware.

Microsoft recently published a security blog detailing a new ClickFix campaign they are calling TerminalFix. What sets this campaign apart from previous ClickFix-style campaigns is the end result: Instead of infostealers or loaders, the downloaded malware runs a Python script to establish a Websocket tunnel to the threat actor C2 domain, giving them a SOCKS-style TCP proxy into the victim's network. 

 

The Infection Chain

The infection begins when the user visits a compromised or attacker-controlled domain and is displayed the ClickFix lure:

 

2026-09-08-ClickFix-Lure

Fig. 1: ClickFix Prompt (Source: Microsoft)

 

If the user follows all of the steps listed, they wind up pasting and executing a PowerShell command into the PowerShell terminal. This command downloads a ZIP file into C:\ProgramData from an attacker domain. Once extracted, this file executes a signed, legitimate binary called LockScreenContentServer.exe which loads a malicious DLL file, dui70.dll. This DLL file executes additional PowerShell code that downloads a series of PNG files from an attacker-controlled domain. These PNG files contain fragments of another DLL file. Using steganography, the PowerShell code extracts these DLL fragments and then reassembles them.

After validating the newly created files exist, the script then creates a registry run key as well as a scheduled task to ensure the files are executed once an hour to check for additional updates from the C2 server.

Once this persistence is created, the malware then does extensive reconnaissance of the victim's environment, gathering system information from the infected host, Active Directory enumeration using net.exe, network probing using ping.exe.

The script also downloads the Python runtime environment, and executes a Python payload called client.py, which establishes the WebSocket C2 tunnel to gitnow[.]dev over port 443. This established tunnel allows the threat actor to pivot to any host that is visible from the victim's network. 

 

How to Protect Your Organization

While this specific ClickFix variant uses crafty techniques for its infection and persistence, it is very noisy to any network with good visibility. There are a variety of controls that will help with detecting and preventing these attacks:

  • User awareness training - ClickFix is here to stay. Educating employees on this technique should be a foundation part of any end-user security training. Users should know to never blindly execute code on their machines.
  • Application control - Administrators can simply remove the ability for end users to execute code on their system by restricting access to the command shell and PowerShell terminals. Administrators can also block the use of the Windows Run dialog (Win +R).
  • Deploy EDR to all endpoints - Modern EDR tools have the ability to identify and block ClickFix-style PowerShell execution on a host. They can also detect and block subsequent malicious files that are downloaded in case this first step is missed.
  • Network monitoring - Network monitoring tools such as PacketWatch WireSight can identify anomalous north-south web traffic (such as malicious downloads and C2 beaconing) as well as east-west traffic (such as ping sweeps, and one-to-many network enumeration attempts).

Resources

 

 

Massive IS ID Data Disclosure

On September 1, Brian Krebs published a blog detailing his findings of approximately 153 million drivers licenses from people living in the United States and Canada. The information was observed on the dark web at a site called Nexus, in a search tool called the Identity Document Database. In addition to the drivers licenses, the database also claimed to contain over 10 million other identification cards, over three million travel documents, and over 579,000 medical cards. It also appeared that the database was growing in real time, with over 400,000 records added in a 24-hour period, suggesting the data was being harvested in an ongoing basis.

Further research indicates that the data appears to be sourced from idscan[.]net, which provides identity verification services for a variety of brands including Hertz, Target, FedEx, Motorola Solutions, Jack Henry, and Caesars Entertainment.

The FBI has also confirmed that they are actively investigating this data breach.

As of September 1, the Nexus dark web site that was selling the data is no longer reachable. While the site is not accessible, the threat actors still have the data. Individuals can take a variety of steps to protect themselves from this sort of data disclosure:

  • If possible, freeze your credit with all 3 credit bureaus (Equifax, Experian, and TransUnion). This will help prevent unauthorized accounts from being opened in your name.
  • Harden your email account(s) - Use strong passwords and multi-factor authentication, as well as review recovery methods and active sessions. Securing your email is critical as this is the method used to reset accounts/passwords for all other services.
  • Stay vigilant - This data disclosure will almost certainly cause a rise in identity theft and other social engineering attacks. Monitor bank accounts and credit score for unusual or unauthorized activity.

 

Resources

 

 

Vulnerability Roundup

 

New PaperCut NG & MF 0-Days 

On August 27, PaperCut released an urgent security bulletin detailing two 0-day vulnerabilities in their PaperCut NG and PaperCut MF servers that are under active exploitation. The first vulnerability, CVE-2026-81578 allows for authentication bypass, which can then be followed up by exploiting the second vulnerability, CVE-2026-82078, to achieve remote code execution. PaperCut has updated the bulletin several times since the initial publication, including on September 1 when they published "Emergency Patch Release 3" which addresses bypasses and other issues from previous emergency patches.

These vulnerabilities affect all previous versions of PaperCut NG & MF. Administrators are urged to apply Emergency Patch 3 as soon as possible. Any environment with internet-facing PaperCut servers should review the extensive list of potential indicators of compromise highlighted in the bulletin here. As PaperCut vulnerabilities have been previously exploited by ransomware groups for widespread data theft, administrators should treat these vulnerabilities as urgent and remediate them as soon as possible.

 

New 0-Days in SonicWall SMA 1000

SonicWall recently disclosed a pair of 0-day vulnerabilities that can be chained together to achieve remote code execution on affected devices. The first is tracked as CVE-2026-83548, a pre-authentication server-side request forgery (SSRF) vulnerability in the SMA1000 Appliance Work Place interface, allowing for unauthorized access. The second is tracked as CVE-2026-83549, a post-authentication OS command injection vulnerability allowing a remote attacker to execute arbitrary OS commands as administrator.

 

Maximum-Severity Flaws in ServiceNow

On September 1, ServiceNow published a support advisory detailing multiple maximum-severity flaws in their platform. The first is tracked as CVE-2026-18885, a code injection flaw in the ServiceNow Ai platform which allows an unauthenticated user to execute arbitrary code on the platform. The second is tracked as CVE-2026-18886, which is an improper access control flaw in the ServiceNow AI platform allowing an unauthenticated user to create or modify instance data, resulting in privilege escalation. Last is a vulnerability tracked as CVE-2026-74820, a SQL injection flaw in the ServiceNow AI platform allowing an unauthenticated user to execute arbitrary SQL statements on the system. The fixed release versions are shown below. Administrators are urged to apply the fix as soon as possible.

 

2026-09-08-ServiceNow-Fixed-VersionsFig. 2: ServiceNow Fixed Versions (Source: ServiceNow)

 

 

Maximum-Severity Vulnerability in SAP Kernel

As part of the September 2026 security updates, SAP disclosed CVE-2026-44756 (aka OVERPASS), a maximum-severity buffer overflow flaw in the Extended Passport Protocol (EPP) processing library. Successful exploitation of this vulnerability allows an unprivileged threat actor to run arbitrary commands with administrative privileges on the SAP host. Exploitation can be achieved over the SAP Internet Communication Manager (ICM), which is the networking component that connects the SAP NetWeaver Application Server to the internet via HTTP, HTTPS, and SMTP. The security updates also included fixes for 19 other flaws across SAP products. Administrators are urged to apply these fixes as soon as possbile.



N-able N-central Unauthenticated RCE

N-able recently released "Hotfix 4" to address a new maximum-severity vulnerability in its N-central remote monitoring and management platform. Tracked as CVE-2026-86218, the vulnerability allows for pre-authenticated remote code execution. The flaw impacts all versions of on-prem N-central before version 2026.3.1.14. Administrators are urged to apply this latest hotfix as soon as possible.

 

HPE ArubaOS-CX Unauthenticated RCE

HPE recently released a support advisory detailing multiple vulnerabilities in ArubaOS-CX, including a critical unauthenticated remote code execution (RCE) flaw. Tracked as CVE-2026-73749, the vulnerability allows for an unauthenticated remote attacker to achieve RCE with "elevated privileges." The vulnerability affects the following versions:

  • AOS-CX 10.18.0001
  • AOS-CX 10.17.1021 and below
  • AOS-CX 10.16.1051 and below
  • AOS-CX 10.13.1180 and below
  • AOS-CX 10.10.1180 and below (EOM)
  • Administrators are urged to apply the update as soon as possible.

 

 

Multiple Maximum-Severity Flaws in Ubiquiti Devices

On August 26, Ubiquiti published a security advisory bulletin addressing 22 security issues across a variety of their products. The advisory includes details for 3 maximum-severity vulnerabilities. The first, tracked as CVE-2026-77537, is an Improper Input Validation vulnerability in UniFi Protect Application that allows for command injection, affecting versions through 7.2.105. Second is a vulnerability tracked as CVE-2026-77550, which is a carriage return line feed (CRLF) injection flaw allowing for authentication bypass on UniFi OS devices, affecting versions prior to 5.1.37. Last is a command injection vulnerability in UniFi Talk Application (VoIP) systems. Tracked as CVE-2026-77554, it affects UniFi Talk Application prior to 5.3.2. Administrators are urged to apply the applicable updates as soon as possible.

 

CISA KEV Additions

The following vulnerabilities were added to CISA's Known Exploited Vulnerabilities Catalog in the last 2 weeks:

  • CVE-2026-85046 - Google Chromium V8 Type Confusion Vulnerability
  • CVE-2026-83549 - SonicWall SMA1000 Appliances OS Command Injection Vulnerability
  • CVE-2026-83548 - SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
  • CVE-2026-9586 - Sangoma Switchvox SQL Injection Vulnerability
  • CVE-2026-82329 - JFrog Artifactory Improper Authentication Vulnerability
  • CVE-2026-49869 - Kestra OSS OS Command Injection Vulnerability
  • CVE-2026-48710 - Kludex Starlette HTTP Request/Response Smuggling Vulnerability
  • CVE-2026-59822 - BerriAI LiteLLM Improper Authentication Vulnerability
  • CVE-2026-81578 - PaperCut NG/MF Missing Authentication for Critical Function Vulnerability
  • CVE-2026-82078 - PaperCut NG/MF Unsafe Reflection Vulnerability
  • CVE-2026-66384 - JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory Vulnerability
  • CVE-2026-53362 - Linux Kernel Unspecified Vulnerability
  • CVE-2023-49105 - ownCloud Improper Authentication Vulnerability
  • CVE-2019-1068 - Microsoft SQL Server Remote Code Execution Vulnerability
  • CVE-2026-8452 - Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
  • CVE-2022-0995 - Linux Kernel Out-of-Bounds Write Vulnerability
  • CVE-2015-5287 - Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
  • CVE-2015-3246 - Red Hat Libuser Race Condition Vulnerability
  • CVE-2021-23758 - Ajax.NET Professional Deserialization of Untrusted Data Vulnerability
  • CVE-2026-60004 - Gitea Code Injection Vulnerability
  • CVE-2026-21962 - Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability

 

 

 

This report is provided FREE to the cybersecurity community.

Visit our Cyber Threat Intelligence Blog for additional reports.

Visit our Cyber Threat Profile Blog for detailed intelligence profiles.

Visit our Beyond the Threat Feed Blog for more articles.

 

Subscribe to be notified of future Reports:

NOTE
We have enhanced our report with data from SOCRadar. You may need to register to view their threat intelligence content.
Table of Contents
Cyber Threat Intelligence Report

8 min read

Cyber Threat Intelligence Report

September 8, 2026

This week, we briefed our clients on a new ClickFix variant, TerminalFix, that establishes a Websocket tunnel to the threat actor's C2 domain.

Read More
Cyber Threat Intelligence Report

8 min read

Cyber Threat Intelligence Report

August 24, 2026

This week, we briefed our clients on CISA's recently published TTP updates for the Medusa RaaS group, originally published in March 2025.

Read More
Cyber Threat Intelligence Report

9 min read

Cyber Threat Intelligence Report

August 10, 2026

This week, we briefed our clients on recent data extortion campaigns targeting numerous industry verticals with fake technical support vishing...

Read More
Future Team Sixty43 Reports.
Be notified when Cyber Threat Intelligence Reports, Threat Profiles, or Beyond the Threat Feed articles are published.