Cyware Daily Threat Intelligence - September 05, 2026
Attackers are slashing through global defenses with Panzer, a ransomware-as-a-service operation that has already hit 16 organizations across 11 countries. Cyware spotlights how Panzer’s double blow—data theft and file encryption—has left technology, manufacturing, and government sectors scrambling to recover from locked systems and stolen information.
A newly disclosed Chrome zero-day is turning browser sessions into high-stakes targets. With CVE-2026-85046 already exploited in the wild, attackers can execute code inside Chrome’s renderer sandbox, forcing urgent patch cycles for millions of users as CISA adds it to the Known Exploited Vulnerabilities catalog.
Meanwhile, the Rhysida ransomware group has dumped 5.8 terabytes of Berlin government data, exposing personnel files and critical infrastructure analyses. As threat actors escalate their campaigns, cyware.com tracks the fallout and the urgent calls for stronger defenses.
Top Malware Reported in the Last 24 Hours
Panzer ransomware spreads across 11 countries
Panzer is a ransomware-as-a-service operation that combines data theft with file encryption to maximize victim impact. Panzer encrypts files across Windows, Linux, VMware ESXi, and FreeBSD systems, and its ESXi capability enables it to disrupt multiple virtual machines simultaneously. Panzer operates a semi-open affiliate program with an 80/20 revenue split, allowing affiliates to retain 80% of ransom payments. Panzer spreads through a network of affiliates and targets organizations by leveraging both data exfiltration and encryption. Technology organizations have suffered the most, with four victims, but Panzer has also struck manufacturing, government, agriculture, energy, education, and retail sectors. Panzer has claimed 16 victims across 11 countries, including Thailand, Italy, Indonesia, Serbia, Curaçao, South Korea, Spain, the Czech Republic, Germany, Nigeria, and Switzerland.
OWAReaper abuses Exchange OWA browser sessions
OWAReaper is a browser-resident implant that exploits CVE-2026-42897, a high-severity stored XSS flaw in Microsoft Exchange Server OWA. OWAReaper executes Base64-encoded JavaScript via incomplete HTML sanitization and unsafe DOM insertion, enabling credential theft through browser autofill and abuse of OAuth tokens. OWAReaper leverages legitimate Exchange APIs for persistence and self-cleaning, making it difficult to detect and remove. OWAReaper infects users when they open crafted HTML emails in OWA, establishing a long-running foothold without dropping traditional malware files. OWAReaper targets organizations using Exchange OWA, with attacker infrastructure including asecdns[.]com, acocdn[.]com, dnsrecursive[.]eu, and tdndns[.]com. Researchers at Resecurity discovered and documented the threat.
Toy Ghouls plants backdoors via WinRM
Toy Ghouls is a financially motivated threat actor that has developed two new Windows backdoors—mqtt-bird-agent 0.1.0 and matrix-bird-agent 0.1.0—for command-and-control via HiveMQ and Element Messenger. Toy Ghouls deploys these backdoors after obtaining valid administrative access, using Windows Remote Management (WinRM) tools such as Evil-WinRM and WinRM-fs. Toy Ghouls’ backdoors can run interactively or persist as Windows services, blending C2 traffic into legitimate patterns and using config:set_interval messages to control command and telemetry timing. Toy Ghouls targets Russian organizations, focusing on post-compromise persistence rather than broad phishing. The campaign was first observed in early July 2026, with backdoor filenames including cplsupport.exe and wtass.exe.
Top Vulnerabilities Reported in Last 24 hours
Chrome zero-day exploited for browser code execution
CVE-2026-85046 is a remote code execution vulnerability in Google Chromium V8 engine with a CVSS score of 8.8. Successful exploitation allows attackers to execute arbitrary code inside the browser’s renderer sandbox. CVE-2026-85046 is already being exploited in the wild, and CISA has added it to its Known Exploited Vulnerabilities catalog. Security researcher Salvatore Gulizia discovered the bug and received a $1,000 bounty. A fix is available in Chrome 152.0.7977.82/.83, and all Chromium-based browsers are affected until patched. The vulnerability was disclosed alongside other high-profile zero-days in SonicWall, Ruby on Rails, and CrowdStrike Falcon.
Hackers probe Citrix NetScaler login bypass
CVE-2026-19490 is a critical authentication-bypass vulnerability in Citrix NetScaler appliances. Exploitation allows attackers to bypass authentication and gain unauthorized access to networks using NetScaler as an AAA virtual server or Gateway. CVE-2026-19490 is actively targeted, with exploitation attempts observed from multiple geolocations. The Centre for Cybersecurity Belgium has issued warnings about ongoing attacks. A patch is available from Citrix, and prior incidents involving CVE-2026-3055 and CVE-2026-4368 highlight the persistent risk to organizations relying on NetScaler for remote access.
PaperCut bugs hit schools across US, Europe
CVE-2026-81578 and CVE-2026-82078 are authentication bypass and remote code execution vulnerabilities in PaperCut print management software. Successful exploitation enables attackers to move from printer infrastructure into broader systems, steal credentials, and expand access. Attackers are actively exploiting these vulnerabilities, with observed intrusions focused on credential harvesting and system discovery. The vulnerabilities are being used to compromise education-sector environments in the U.S. and Europe. Patches are available for both vulnerabilities, and affected schools and universities are urged to update immediately to prevent operational disruption and data exposure.
Top Threat Actors Reported in Last 24 hours
Rhysida leaks Berlin government data trove
Rhysida is a financially motivated ransomware group of suspected origin that focuses on extortion through data leaks. Rhysida has released 5.8 terabytes of Berlin state government data, including personnel files, vulnerability analyses related to Berlin’s drinking water supply, and login credentials. Rhysida uses countdown-based leak sites to pressure victims and maximize impact. Rhysida targets public agencies and residents, exposing credentials and internal assessments that could enable follow-on attacks and disrupt essential services. In this campaign, Rhysida published the data after the ransom deadline expired, and security experts Bianca Kastl and Christof Fischer have advised against ransom payments, noting that the state is legally prohibited from paying.
Toy Ghouls debuts HiveMQ, Element backdoors
Toy Ghouls is a financially motivated threat actor of suspected origin that has shifted from off-the-shelf tools to custom Windows backdoors. Toy Ghouls deploys mqtt-bird-agent 0.1.0 and matrix-bird-agent 0.1.0 to blend command-and-control traffic into legitimate HiveMQ and Element Messenger channels. Toy Ghouls uses WinRM-based tooling and implants that can run interactively or persist as Windows services under filenames such as cplsupport.exe and wtass.exe. Toy Ghouls targets Russian organizations, focusing on post-compromise persistence and encrypted configuration storage. In this campaign, the HiveMQ variant encrypts configuration data with ChaCha20-Poly1305, while the Element version stores encrypted configuration in a registry location labeled SealedConfig. Defenders are advised to monitor for suspicious WinRM activity, investigate SealedConfig and cplsupport directories, and detect unexpected MQTT or Matrix traffic.
Frequently Asked Questions
What is Panzer? Panzer is a new ransomware-as-a-service operation that pairs data theft with file encryption, giving victims a double hit: stolen information plus locked systems. It has already claimed 16 victims across 11 countries, including Thailand, Italy, Indonesia, Serbia, Curaçao, South Korea, Spain, the Czech Republic, Germany, Nigeria, and Switzerland.
What is OWAReaper? OWAReaper is a browser-resident implant exploiting CVE-2026-42897, a high-severity stored XSS flaw in Microsoft Exchange Server OWA that can turn a normal webmail session into a long-running foothold. The bug stems from incomplete HTML sanitization and unsafe DOM insertion, allowing Base64-encoded JavaScript to execute when a user opens a crafted HTML email in OWA.
What is Toy Ghouls? Toy Ghouls is a financially motivated threat actor that has built two new Windows backdoors—mqtt-bird-agent 0.1.0 and matrix-bird-agent 0.1.0—using HiveMQ and Element Messenger for command-and-control. It was first observed in early July 2026 targeting Russian organizations, and the campaign stands out because the group deploys it after gaining valid administrative access rather than relying on broad phishing.
What is CVE-2026-85046? A newly disclosed Chrome zero-day in Google Chromium’s V8 engine (CVE-2026-85046, CVSS 8.8) lets remote attackers achieve arbitrary code execution inside the browser’s renderer sandbox. In practical terms, a user who visits a malicious page could have their browsing session compromised, and the foothold may become more serious if an attacker chains it with a separate sandbox escape.
What is CVE-2026-19490? A critical authentication-bypass flaw in Citrix NetScaler appliances (CVE-2026-19490) is being actively targeted, raising the risk of unauthorized access to networks that rely on NetScaler for remote access and authentication. The attack path is straightforward in impact: when NetScaler is configured as an AAA virtual server or Gateway, attackers can attempt a remote authentication bypass to get in without legitimate credentials.
What is CVE-2026-81578? Attackers are actively exploiting PaperCut vulnerabilities (CVE-2026-81578 and CVE-2026-82078) to break into education-sector environments in the U.S. and Europe, combining an authentication bypass with a remote code execution chain. For affected schools and universities, the consequence is immediate: attackers can move from printer-management infrastructure into broader systems to steal credentials and expand access.
What is Rhysida? Rhysida, a financially motivated ransomware group, has dumped a massive cache of Berlin state government data after a countdown on their leak site expired. They released about 5.8 terabytes of material that includes personnel files, vulnerability analyses tied to Berlin’s drinking water supply, and login credentials.
What is Toy Ghouls? Toy Ghouls, a financially motivated threat actor, has rolled out two new Windows backdoors that shift their playbook from relying on off-the-shelf tools to custom malware. Researchers say they built mqtt-bird-agent 0.1.0 and matrix-bird-agent 0.1.0 to blend command-and-control into legitimate-looking traffic via HiveMQ and Element Messenger, and first observed them in early July 2026 targeting Russian organizations.