ThreatsDay: Gogs and n8n RCE Flaws, Malware Campaigns and AI Exploit Advances
Summary
The weekly roundup covers driver abuse, Mabna Institute charges, malware campaigns, refrigeration-controller flaws, RCE vulnerabilities in Gogs, n8n and CircleCI, Salt Typhoon reporting, and AI security developments.
Key points
- Check Point demonstrated that Microsoft-signed BTR.sys can be repurposed for kernel operations during startup to bypass endpoint defenses without using the BYOVD method.
- The U.S. Justice Department charged 17 Mabna Institute members over an alleged campaign targeting universities, companies and government agencies; authorities allege stolen data included more than 31 TB of academic material.
- Acronis observed Grandoreiro using Duplicate Files Finder for DLL sideloading, while ErrTraffic ClickFix campaigns delivered Cruciferra, which uses a vulnerable driver to escalate privileges and terminate security processes.
- Claroty reported 23 vulnerabilities in Copeland XWEB Pro controllers, including chained flaws enabling root-level RCE; vendors also fixed vulnerabilities in Danfoss refrigeration controllers.
- Gogs CVE-2026-52813 can enable RCE through path traversal and Git hooks, and n8n CVE-2026-33696 can allow an authorized workflow editor to achieve RCE. Both issues have fixes; a separate unauthenticated RCE in the CircleCI MCP server package was also patched.
- T-Mobile said its investigation into suspected Salt Typhoon activity found unusual behavior traced to a router belonging to another telecom company; the article reports no data was siphoned from T-Mobile's network.
- Z.ai says GLM-5.3 improved on exploitation-chain benchmarks; the company also reported that its models helped identify 2,436 vulnerabilities across 269 projects.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering cyber espionage, malware campaigns, security research, and vulnerability disclosures.
- Impact
- The reported activity includes alleged theft of academic and intellectual property data and compromise of approximately 8,000 accounts in the Mabna Institute campaign; malware delivery and attempted endpoint-defense bypass; and vulnerabilities that could enable remote code execution, CI/CD pipeline takeover, or access to sensitive data. The article also reports that the T-Mobile intrusion was detected before data was siphoned.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | gigapaper[.]ir | Website the DoJ says Mabna Institute defendants used to sell stolen academic data. |
| DOMAIN | megapaper[.]ir | Website the DoJ says Mabna Institute defendants used to sell stolen academic data. |
MITRE ATT&CK
CVE
CVE-2026-33696The issue (CVE-2026-33696, CVSS score: 9.4) has been fixed in versions 2.14.1, 2.13.3, and 1.123.27.CVE-2026-43774Details have emerged about a now-patched out-of-bounds read flaw in Apple macOS Spotlight (CVE-2026-43774, CVSS score: 5.5) that could be exploited by a malicious app to access sensitive user data.CVE-2026-52810in Remote Code Execution (RCE).” The issue was addressed in version 0.14.3, alongside patches for CVE-2026-52810 (a logic bug to write on read-only repositories) and GHSA-6vxv-wg6j-5qwp (an XSS flaw in the outdatedCVE-2026-52813A maximum-severity security flaw in Gogs (CVE-2026-52813, CVSS score: 10.0) could be exploited to achieve remote code execution through Git hooks.
People
Csaba FitzlIru researcher who described the macOS Spotlight PostScript vulnerability and how a crafted file could trigger it.Jeff SimonT-Mobile chief information officer who described the company's effort to investigate suspected intruders and remove a compromised device's connection.Jiří VinopalSecurity researcher quoted on Check Point's research into repurposing the BTR.sys driver to bypass endpoint security.Shmuel GihonCheck Point Security Research Team Lead who provided analysis of the Mabna Institute case and its alleged relationship with the IRGC.Simon KoeckSecurity researcher credited with discovering the n8n vulnerability that can be chained to achieve remote code execution.
Threat Actors
Islamic Revolutionary Guard Corps (IRGC)The article says the Mabna Institute defendants carried out the intrusions on behalf of Iran's Islamic Revolutionary Guard Corps.LenAIIdentified in the article as a threat actor selling the ErrTraffic malware-as-a-service and traffic distribution framework.Mabna InstituteThe DoJ charged 17 members of the Iran-based institute, accusing them of conducting cyber intrusions and stealing academic data and intellectual property.Salt TyphoonReportedly targeted T-Mobile and other major U.S. telecommunications companies in a cyber espionage campaign; the article says T-Mobile detected the activity before data was siphoned from its network.
Malware
BabaDedaLoaderIn recent months, ErrTraffic has been used to deliver Remus Stealer, Vidar Stealer, Okobot, LegionLoader, OnionDrop-related payloads, and BabaDedaLoader, per WatchGuard.Cruciferra#BTR.sysGrandoreiroOther highlights include major action against the Mabna Institute, Grandoreiro DLL sideloading, refrigeration controller RCE issues, and AI tools increasingly used for both privacy-preserving defense and exploitationLegionLoaderIn recent months, ErrTraffic has been used to deliver Remus Stealer, Vidar Stealer, Okobot, LegionLoader, OnionDrop-related payloads, and BabaDedaLoader, per WatchGuard.OkobotIn recent months, ErrTraffic has been used to deliver Remus Stealer, Vidar Stealer, Okobot, LegionLoader, OnionDrop-related payloads, and BabaDedaLoader, per WatchGuard.OnionDropIn recent months, ErrTraffic has been used to deliver Remus Stealer, Vidar Stealer, Okobot, LegionLoader, OnionDrop-related payloads, and BabaDedaLoader, per WatchGuard.Remus StealerErrTraffic is being used to deliver ClickFix lures and payloads like Cruciferra and Remus Stealer.VidarIn recent months, ErrTraffic has been used to deliver Remus Stealer, Vidar Stealer, Okobot, LegionLoader, OnionDrop-related payloads, and BabaDedaLoader, per WatchGuard.
Vendors
AppleApple has agreed to make changes to its App Tracking Transparency (ATT) feature in Germany, after the Federal Cartel Office, or FCO, found the feature gave its own âapps more favorable consent prompts than those ofCircleCI#BTR.sysCopelandClaroty’s Team82 has discovered 23 vulnerabilities in Copeland XWEB Pro controllers, including those that can be chained to bypass security mechanisms and achieve root-level remote code execution.DanfossMultiple vulnerabilities have also been disclosed in Danfoss AK-SM 800A refrigeration controllers, including a “hidden ‘code-of-the-day’ authentication mechanism that could be abused to bypass normal authentication, aGogs#BTR.sysMicrosoftThis week’s threats show attackers abusing trusted components, exposed systems, and weak assumptions to bypass defenses, from Microsoft-signed BTR.sys and vulnerable drivers to covert backdoors and CI/CD takeover flaws.n8n#BTR.sys
Products
@circleci/mcp-server-circleciA critical security flaw has been disclosed in @circleci/mcp-server-circleci that could result in remote code execution by means of a specially crafted request.Apple macOS SpotlightDetails have emerged about a now-patched out-of-bounds read flaw in Apple macOS Spotlight (CVE-2026-43774, CVSS score: 5.5) that could be exploited by a malicious app to access sensitive user data.BTR.sysThis week’s threats show attackers abusing trusted components, exposed systems, and weak assumptions to bypass defenses, from Microsoft-signed BTR.sys and vulnerable drivers to covert backdoors and CI/CD takeover flaws.Copeland XWEB ProClaroty’s Team82 has discovered 23 vulnerabilities in Copeland XWEB Pro controllers, including those that can be chained to bypass security mechanisms and achieve root-level remote code execution.Danfoss AK-SM 800AMultiple vulnerabilities have also been disclosed in Danfoss AK-SM 800A refrigeration controllers, including a “hidden ‘code-of-the-day’ authentication mechanism that could be abused to bypass normal authentication, aDuplicate Files FinderGrandoreiro is abusing Duplicate Files Finder through DLL sideloading, mainly impacting Latin America.Gogs#BTR.sysMicrosoft Defender Antimalware PlatformIn new research, Check Point has reverse engineered Microsoft Defender’s Defender Boot-Time Removal driver (“BTR.sys”) and demonstrated that it’s possible to repurpose the signed remediation driver as a universal kerneln8n#BTR.sys
Tools
Countries
ArgentinaAccording to telemetry data from Acronis, Grandoreiro activity remains concentrated in Latin America, with Mexico, Spain, Peru, and Argentina accounting for the lion’s share of infections.Chinaplans for complete exploitation chains,” Z.ai said it has been working with several security teams in China to run its open-source models against real-world codebases, identifying 2,436 vulnerabilities across 269IranThe DoJ charged 17 Mabna Institute members for stealing academic and intellectual property data for Iran.MexicoAccording to telemetry data from Acronis, Grandoreiro activity remains concentrated in Latin America, with Mexico, Spain, Peru, and Argentina accounting for the lion’s share of infections.PeruAccording to telemetry data from Acronis, Grandoreiro activity remains concentrated in Latin America, with Mexico, Spain, Peru, and Argentina accounting for the lion’s share of infections.SpainAccording to telemetry data from Acronis, Grandoreiro activity remains concentrated in Latin America, with Mexico, Spain, Peru, and Argentina accounting for the lion’s share of infections.