Cyware Daily Threat Intelligence - September 19, 2026
A single poisoned open-source update can now ripple through thousands of organizations, as attackers like TeamPCP have weaponized trusted developer tools to hijack credentials and plant malware in places teams least expect. Cyware spotlights how routine downloads from platforms such as Github, Mercor, and OpenAI have become entry points for account takeover and poisoned builds, with Google’s Threat Intelligence Group reporting direct infiltration and arrests.
North Korean-linked groups are slashing through IT and crypto sectors with job-lure campaigns and macOS backdoors. Over 30,000 devices across more than 100 countries have been infected, and nearly $11 million in cryptocurrency has been siphoned from over 7,000 wallets. The latest campaigns use fake infrastructure projects and weaponized Terraform files to breach IT service providers and developer endpoints.
Critical vulnerabilities are surfacing in core infrastructure, with attackers already exploiting CVE-2026-53266 in the Linux Kernel and new privilege escalation risks in Azure AI Foundry. SolarWinds Access Rights Manager faces unauthenticated remote code execution exposure, underscoring the urgency for patching and vigilant dependency management.
Top Malware Reported in the Last 24 Hours
TeamPCP worm turns open-source into weapon
TeamPCP is a supply-chain malware campaign leveraging booby-trapped open-source software and a self-spreading worm to compromise thousands of downstream companies. TeamPCP hijacks developer credentials and plants malicious code in tools such as Trivy, LiteLLM, Checkmarx, TanStack, and Mistral AI. TeamPCP deploys an AI-created zero-day exploit targeting widely used login software, bypassing two-factor authentication by exploiting previously unknown vulnerabilities. TeamPCP spreads through routine downloads and updates, turning trusted open-source dependencies into attack vectors. TeamPCP targets developer environments and organizations relying on open-source, including Github, Mercor, OpenAI, and the European Commission. Google’s Threat Intelligence Group infiltrated TeamPCP, leading to disruption and arrests.
TraderTraitor backdoors hit macOS IT firms
TraderTraitor is a DPRK state-sponsored malware campaign deploying macOS backdoors FLATROOF and ROOFDECK to target IT services firms. TraderTraitor uses social engineering, impersonating infrastructure projects and weaponizing Terraform projects with lock files referencing attacker-controlled infrastructure such as registry.hashicorp-aws[.]com. TraderTraitor’s FLATROOF supports commands like help, id, shell, and upload, exfiltrating data via Telegram, while ROOFDECK communicates using a Nostr public key and persists via a plist file. TraderTraitor infects developer and infrastructure access points, expanding beyond cryptocurrency to IT service providers. SentinelOne Labs reported TraderTraitor’s updated ROOFDECK build on April 20, which attempts to evade detection by stripping symbols.
Rapuncel infostealer rides fake GitHub repos
Rapuncel is an infostealer campaign using fake GitHub repositories, impersonating brands such as LastPass, to lure victims into downloading malware via search-driven lures. Rapuncel installs a payload that steals browser credentials, cryptocurrency wallet data, and session tokens from Discord, Steam, and Telegram, while collecting keyword-matching documents and screenshots. Rapuncel leverages a Microsoft-signed kernel driver, Alinubx.sys, to disable security software and enable file and registry hiding, DLL injection, and traffic manipulation. Rapuncel spreads through ZIP downloads and sideloads a malicious DLL to deploy the infostealer and driver. Rapuncel targets users seeking software on GitHub, resulting in silent account takeover and credential theft. BleepingComputer reported Rapuncel as a BoryptGrab variant using the Cruciferra PUROSANGUE crypter.
Top Vulnerabilities Reported in Last 24 hours
CVE-2026-53266: Linux Kernel ebtables SNAT out-of-bounds write (KEV)
CVE-2026-53266 is an out-of-bounds write vulnerability in the Linux Kernel ebtables SNAT target. CVE-2026-53266 allows attackers to tamper with memory, potentially causing system instability or full system compromise. CVE-2026-53266 is actively exploited in the wild, as confirmed by its inclusion in CISA’s Known Exploited Vulnerabilities (KEV) catalog. CISA highlights the KEV catalog’s availability in CSV and JSON formats and encourages the community to nominate new vulnerabilities. CVE-2026-53266 poses the highest risk to organizations running end-of-life or end-of-service systems that may not receive patches.
CVE-2026-85889: Azure AI Foundry privilege escalation (CVSS 10.0)
CVE-2026-85889 is a privilege escalation vulnerability in Azure AI Foundry (CVSS 10.0) that could allow unauthorized users to gain elevated permissions. CVE-2026-85889 results from missing authentication for a critical function, enabling attackers to access privileged operations. No active exploitation has been observed for CVE-2026-85889, and Microsoft states that mitigations require no customer action. Security researcher Rémy Marot discovered CVE-2026-85889, and Microsoft also patched CVE-2026-85885 (CVSS 9.9), CVE-2026-85878 (CVSS 9.9), and CVE-2026-87701 (CVSS 9.6). Affected products include Azure AI Foundry, Microsoft 365 Copilot, Azure Database for PostgreSQL, Azure Cosmos DB, Windows User-Mode Power Service, and Windows Secure Kernel Mode.
CVE-2026-28326: SolarWinds Access Rights Manager RCE risk
CVE-2026-28326 is a remote code execution vulnerability in SolarWinds Access Rights Manager that allows unauthenticated attackers to run arbitrary code on vulnerable servers. CVE-2026-28326 enables attackers to achieve full system compromise, steal data, or move laterally within a network. No active exploitation is described in the advisory for CVE-2026-28326, but the risk is significant due to the lack of credential requirements. CVE-2026-28326 affects SolarWinds Access Rights Manager versions prior to 2026.2, as noted by the Cyber Centre. A fix for CVE-2026-28326 is available in version 2026.2.
Top Threat Actors Reported in Last 24 hours
TraderTraitor weaponises Terraform to hit IT
TraderTraitor (DPRK state-sponsored) is a suspected North Korean threat actor focused on financial gain. TraderTraitor uses macOS backdoors FLATROOF and ROOFDECK, deploying them via weaponized Terraform projects and poisoned lock files that fetch attacker-controlled modules. TraderTraitor leverages social engineering, impersonating infrastructure projects and luring job seekers, and deploys FLATROOF (SystemUpdate) to exfiltrate data via Telegram and ROOFDECK (iSync) for C2 using a Nostr public key. TraderTraitor targets IT services firms and engineering teams, using compromised developer workstations as a bridge to broader corporate access. SentinelOne reported a new ROOFDECK build on April 20 that attempts to evade detection by stripping symbols.
WaterPlum tricks job seekers worldwide
WaterPlum (North Korea-linked) is a suspected North Korean hacking group motivated by financial theft. WaterPlum operates large-scale job-lure campaigns, posing as legitimate AI, crypto, and NFT companies to steal sensitive information and cryptocurrency. WaterPlum uses recruiting services and overlaps infrastructure with North Korean IT workers, including shared IPs tied to laptop farms and crypto exchange job applications. WaterPlum targets IT professionals globally, exposing personal devices, employer credentials, and wallets. The FBI and Department of Defense’s Cyber Crime Center report over 30,000 devices infected in more than 100 countries, and nearly $11 million moved from over 7,000 crypto wallets to North Korea.
TeamPCP turns open-source into a trap
TeamPCP is a hacking group suspected of orchestrating a sweeping supply-chain campaign for financial gain. TeamPCP compromises trusted open-source software, including Trivy, LiteLLM, Checkmarx, TanStack, and Mistral AI, to distribute malware through routine installs and updates. TeamPCP leverages hijacked developer credentials and poisoned dependencies to breach production pipelines. TeamPCP targets organizations dependent on open-source, including Github, Mercor, OpenAI, and the European Commission. Wired and Google’s Threat Intelligence Group report that TeamPCP’s operations were disrupted and key members arrested after infiltration.
Frequently Asked Questions
What is TeamPCP? TeamPCP pulled off a supply-chain campaign that used booby-trapped open-source software and a self-spreading worm to reach thousands of downstream companies. The group compromised tools including Trivy, LiteLLM, Checkmarx, TanStack, and Mistral AI, using that access to hijack developer credentials and plant malicious code where teams least expect it.
What is TraderTraitor? TraderTraitor, described as a DPRK state-sponsored threat actor, has resurfaced with macOS backdoors FLATROOF and ROOFDECK and expanded beyond cryptocurrency targets into the IT services sector. It lures victims through social engineering, including impersonating infrastructure projects, and uses weaponized Terraform projects where lock files point to attacker-controlled infrastructure such as registry.hashicorp-aws[.]com.
What is Rapuncel? Rapuncel is an infostealer campaign that uses fake GitHub repositories—impersonating brands like LastPass—to trick people into downloading malware via search-driven lures. It arrives in ZIP downloads that install a payload capable of stealing browser credentials, cryptocurrency wallet data, and session tokens from apps including Discord, Steam, and Telegram, while also collecting keyword-matching documents and taking screenshots.
What is CVE-2026-53266? An out-of-bounds write flaw in the Linux Kernel’s ebtables SNAT target (CVE-2026-53266) can let attackers tamper with memory in ways that may cause system instability or a broader system compromise. In plain terms, the bug can be triggered through network traffic handling so the system writes data where it shouldn’t, creating an opening to interfere with how the kernel operates.
What is CVE-2026-85889? Microsoft says it has fully mitigated a critical Azure AI Foundry privilege-escalation issue (CVE-2026-85889, CVSS 10.0) that could have allowed unauthorized users to gain elevated permissions. The underlying problem was described as missing authentication for a critical function, which could translate into attackers gaining levels of access they should never have had.
What is CVE-2026-28326? A vulnerability in SolarWinds Access Rights Manager (CVE-2026-28326) can allow unauthenticated remote code execution, meaning an outside attacker could run arbitrary code on a vulnerable server without logging in. That kind of access can quickly translate into full system compromise, including the ability to steal data or use the system to move deeper into a network.
What is TraderTraitor? TraderTraitor, a DPRK state-sponsored threat actor, is resurfacing with macOS backdoors aimed beyond crypto—using fake infrastructure projects to pull in IT and developer victims. They lure job seekers by impersonating real-world projects (including infrastructure tooling themes) and then slip malicious code into weaponized Terraform projects via poisoned Terraform lock files that fetch attacker-controlled modules.
What is WaterPlum? WaterPlum, a North Korea-linked hacking group, has built a large-scale job-lure operation that turns hiring conversations into a pipeline for data theft and cryptocurrency loss. They pose as legitimate AI, crypto, and NFT companies—often using recruiting services—to persuade targets to engage, then use that access to steal sensitive information and funds.
What is TeamPCP? TeamPCP, a hacking group behind a sweeping supply-chain campaign, is accused of turning trusted open-source software into a distribution channel that can quietly compromise thousands of downstream users. According to Wired, Google’s Threat Intelligence Group infiltrated the group, gathering intelligence that helped disrupt their operations and led to arrests of key members.