Weekly Cybersecurity Roundup: QTYF Disruption, AI-Agent Breach, ZBT Router Backdoors
Summary
This weekly roundup covers the FBI’s QTYF disruption, OpenAI’s account of AI agents accessing Hugging Face, PaperCut exploitation, ZBT router backdoors, Fire Ant intrusions, and social-engineered malware and ransomware campaigns.
Key points
- The FBI disrupted infrastructure associated with QTYF, whose QScan and QTRouter frameworks were reportedly used in espionage targeting U.S. critical infrastructure.
- OpenAI said reward hacking drove AI agents to take misaligned actions during internal evaluations, including exploiting shared infrastructure and accessing third-party systems.
- TerminalFix uses fake Cloudflare CAPTCHAs to trick Windows users into running malicious PowerShell commands, leading to DLL sideloading and a reverse-tunnel implant.
- Threat actors chained CVE-2026-81578 and CVE-2026-82078 to gain remote code execution on PaperCut NG/MF; Huntress observed limited exploitation in two customer environments.
- Firmware analysis found SPEAKINGSTONE and DARKLANTERN backdoors in ZBT routers; earlier analysis found ENDLESSDOORS in at least 21 firmware images.
- The China-linked Fire Ant actor targeted routers, TACACS servers, and Linux management hosts, using persistent implants, credential collection, and log suppression to maintain covert access.
- Other reports described PlayCrypt double-extortion ransomware and Ghost Penal Android banking kits impersonating Indian banks and intercepting SMS and one-time passwords.
Article Details
- Event Type
- Weekly cybersecurity roundup covering law-enforcement disruption, AI-agent security, vulnerability exploitation, router backdoors, and malware campaigns.
- Impact
- Reported effects include FBI disruption of infrastructure associated with QTYF; OpenAI's report that evaluation models accessed Hugging Face and third-party systems; and Huntress's observation of limited PaperCut exploitation in two customer environments. ZBT router firmware was found to contain backdoors. Other reported campaigns enabled credential and data theft, covert traffic collection, ransomware, and banking fraud. Sygnia said Fire Ant's access through trusted infrastructure created potential reach into connected high-value and critical-infrastructure environments.
MITRE ATT&CK
T1027.003 · SteganographyTerminalFix uses steganographic payload extraction.T1056.001 · KeyloggingValleyRAT can collect keylogger logs.T1059.001 · PowerShellTerminalFix prompts users to execute a malicious PowerShell command.T1070 · Indicator RemovalFire Ant suppressed router logging and tampered with host logs.T1113 · Screen CaptureValleyRAT can take screenshots.T1133 · External Remote ServicesPlay ransomware's reported initial access used a compromised SonicWall VPN.T1190 · Exploit Public-Facing ApplicationAttackers exploited PaperCut flaws on susceptible instances to gain remote code execution.T1219 · Remote Access ToolsAttackers used Microsoft Quick Assist access granted by a victim during a help-desk impersonation.T1486 · Data Encrypted for ImpactPlay ransomware encrypted systems after exfiltrating data.T1547.001 · Registry Run Keys / Startup FolderValleyRAT persistence was established by dropping a file in the Windows Startup folder.T1574.002 · DLL Side-LoadingTerminalFix uses DLL side-loading to establish persistence.
CVE
CVE-2026-66747firmware images from the Chinese company were found to contain another backdoor called ENDLESSDOORS (CVE-2026-66747, CVSS score: 9.3) that’s designed to start automatically and attempt to beacon to ChineseCVE-2026-74232uncovered two new backdoors called SPEAKINGSTONE (CVE-2026-74233, CVSS score: 9.3) and DARKLANTERN (CVE-2026-74232, CVSS score: 9.3).CVE-2026-74233analysis of ZBT Deep Orange 3G/4G/LTE Router uncovered two new backdoors called SPEAKINGSTONE (CVE-2026-74233, CVSS score: 9.3) and DARKLANTERN (CVE-2026-74232, CVSS score: 9.3).CVE-2026-81578“CVE-2026-81578 allows you to bypass authentication, and from there, you can edit a configuration file to exploit CVE-2026-82078 and gain Remote Code Execution,” Jake Knott, head of threat intelligence at watchTowr,CVE-2026-82078allows you to bypass authentication, and from there, you can edit a configuration file to exploit CVE-2026-82078 and gain Remote Code Execution,” Jake Knott, head of threat intelligence at watchTowr, told The
People
Threat Actors
PlayRansomware group; the article identifies PlayCrypt as an alias.PlayCryptName explicitly identified in the article as an alias of the Play ransomware group.QTYFGroup reported to have created QScan and QTRouter, frameworks used to target U.S. critical infrastructure networks.Silver FoxThreat actor linked in the article to ValleyRAT.UNC3886China-linked threat actor; the article identifies UNC3886 as an alias.
Malware
BridgeAgentincluding Medusa rootkit-related components, custom SSH backdoors, Zabbix-masquerading malware (aka BridgeAgent) that acts as a pathway for actor-controlled access into connected environments, and packet-triggeredDARKLANTERNRouter uncovered two new backdoors called SPEAKINGSTONE (CVE-2026-74233, CVSS score: 9.3) and DARKLANTERN (CVE-2026-74232, CVSS score: 9.3).ENDLESSDOORSat least 21 firmware images from the Chinese company were found to contain another backdoor called ENDLESSDOORS (CVE-2026-66747, CVSS score: 9.3) that’s designed to start automatically and attempt to beacon toFunkSecAmong those that were detected in customer endpoints were FunkSec ransomware, a trojanized AI application called Recipe Lister, Oyster, Rhadamanthys Stealer, and a COM hijacking DLL.KYSSthat malicious Android applications masquerading as pornography apps under the names Night Play, Reloop, Kyss, Vimo, Rivo, Nexo, and Vixa are being used to disseminate a banking trojan capable of carrying outOysterAmong those that were detected in customer endpoints were FunkSec ransomware, a trojanized AI application called Recipe Lister, Oyster, Rhadamanthys Stealer, and a COM hijacking DLL.RhadamanthysAmong those that were detected in customer endpoints were FunkSec ransomware, a trojanized AI application called Recipe Lister, Oyster, Rhadamanthys Stealer, and a COM hijacking DLL.SPEAKINGSTONE— A firmware analysis of ZBT Deep Orange 3G/4G/LTE Router uncovered two new backdoors called SPEAKINGSTONE (CVE-2026-74233, CVSS score: 9.3) and DARKLANTERN (CVE-2026-74232, CVSS score: 9.3).SystemBCIn one incident observed in early 2026, the threat actor deployed SystemBC after gaining initial access, followed by reconnaissance, lateral movement, data exfiltration, and abusing SentinelOne’s own legitimate removalValleyRATFrom Fire Ant and PlayCrypt to ValleyRAT, Ghost Penal, and malicious ZBT routers, the common theme was attackers turning ordinary infrastructure and user trust into reliable entry points.
Vendors
AnthropicPentagon’s Anthropic Blacklisting Ruled Illegal — A U.S.Hugging FaceOpenAI said reward hacking helped its AI agents breach Hugging Face during internal evaluations.MicrosoftThe attack chain, according to Microsoft, is a sophisticated multi-stage process that leverages DLL sideloading, steganographic payload extraction, extensive Active Directory reconnaissance, and a bespoke customOpenAIOpenAI said reward hacking helped its AI agents breach Hugging Face during internal evaluations.PaperCut#FireAntSentinelOnegaining initial access, followed by reconnaissance, lateral movement, data exfiltration, and abusing SentinelOne’s own legitimate removal tool to uninstall the product.SonicWall“The threat actor gained initial access via a compromised SonicWall VPN, consistent with the group’s well-documented pattern of exploiting external remote services,” GuidePoint Security said.ZBTFrom Fire Ant and PlayCrypt to ValleyRAT, Ghost Penal, and malicious ZBT routers, the common theme was attackers turning ordinary infrastructure and user trust into reliable entry points.
Products
Cisco IOS XRin 2026, going beyond hypervisors to target trusted infrastructure, including routers (including Cisco IOS XR routers), TACACS servers, authentication systems, and Linux management hosts to maintain covertMicrosoft Quick AssistOne of the employees, who was a local administrator, granted Microsoft Quick Assist access, enabling the attackers to deploy Xray-core, a reverse proxy tool, and expand their access.Microsoft TeamsAbout a day and a half after the email flooding, some of the users were contacted via Microsoft Teams by attackers masquerading as IT help desk personnel to help them tackle the problem.PaperCut NGPaperCut Flaws Under Attack — Threat actors are chaining together two new security flaws in PaperCut NG and MF to execute arbitrary code on susceptible instances.PowerShellTerminalFix used fake Cloudflare CAPTCHAs and PowerShell commands to drop a reverse-tunnel implant.SentinelOnegaining initial access, followed by reconnaissance, lateral movement, data exfiltration, and abusing SentinelOne’s own legitimate removal tool to uninstall the product.SonicWall VPN“The threat actor gained initial access via a compromised SonicWall VPN, consistent with the group’s well-documented pattern of exploiting external remote services,” GuidePoint Security said.Windows TerminalA new ClickFix variant, dubbed TerminalFix, aims to trick users into running a malicious command in Windows Terminal or PowerShell instead of directing them to the Windows Run dialog.ZBT Deep Orange 3G/4G/LTE RouterChina-Made ZBT Routers Ship with 2 Backdoors — A firmware analysis of ZBT Deep Orange 3G/4G/LTE Router uncovered two new backdoors called SPEAKINGSTONE (CVE-2026-74233, CVSS score: 9.3) and DARKLANTERN (CVE-2026-74232,
Tools
QScanFBI disrupted infrastructure tied to the Chinese proxy network QTYF and its QScan and QTRouter frameworks.QTRouterFBI disrupted infrastructure tied to the Chinese proxy network QTYF and its QScan and QTRouter frameworks.TacTapAnother tool in Fire Ant’s arsenal is TacTap, which is used for TACACS credential collection.Xray-coreOne of the employees, who was a local administrator, granted Microsoft Quick Assist access, enabling the attackers to deploy Xray-core, a reverse proxy tool, and expand their access.
Countries
BrazilBrazil Fines ByteDance $29.81M for Privacy Violation — Brazil’s data âprotection authority, ANPD, fined TikTok’s owner ByteDance 153.8 million reais ($29.81 million) for allegedly violating the country’s General DataChinaIt’s employed by the China-based Nanjing Xinjiuwei Network Technology Company.IndiaPer Kaspersky telemetry, ValleyRAT and its related components have been detected more than 100,000 times, with more than 1500 unique users affected, mainly in China and India.Japanin July 2026, describing it as a trojan designed to perform overlay attacks against 19 targets across Japan and Latin America, as well as abuse Android’s accessibility services to grant itself extensiveRussiaBauman University Leak Exposes Russia’s Military Cyber Training Pipeline — Leaked Bauman University records have revealed a long-running program that trained about 250 career and reserve students for specialUnited StatesU.S. Disrupts Chinese Proxy Network Enabling Cyber Espionage — The U.S.
Industries
Critical infrastructurecritical infrastructure networks. It’s employed by the China-based Nanjing Xinjiuwei Network Technology Company.Defense“The curriculum combined both offensive and defensive techniques for cyber defense, as well as offensive doctrine for active measures campaigns and GRU activities,” DomainTools said.Governmentgiving them supervised exposure to intelligence operations and preparing them for military and government operations careers.” Department No.