InfoSec Briefing - October 01, 2026

🎧 Audio Briefing

Playback Speed:

BlueTeamSec briefing for Thursday the 1st of October 2026, with six stories from the infosec.pub community.

CISA have added a critical authentication bypass in Cisco SD-WAN Manager to the known exploited vulnerabilities catalogue. The flaw allows unauthenticated remote attackers to gain admin-level API access by sending crafted requests with URI-encoded characters, and it's actively exploited in the wild. No workarounds exist, so patching is the only option — worth flagging if you're running SD-WAN infrastructure.

Microsoft have written up a new technique from Star Blizzard, the Russian group attributed to FSB Centre 18. They've shifted from targeted spear-phishing to large-scale campaigns using a method called RedFlick — representing an evolution in their phishing and malware delivery tradecraft since January.

Dutch police have arrested a twenty-four-year-old Amsterdam man suspected of playing a significant role in ShinyHunters — the group linked to major breaches at Odido, Pornhub, and TicketMaster. The suspect faces charges related to participation in a criminal organisation, and there's evidence suggesting he solicited murders abroad. Brian Krebs has more detail: the arrest was of Pepijn van der Stap, also known as Umbreon, and it's triggered a leadership shift within the group to a Jordanian teenager. ShinyHunters are actively exploiting a vulnerability in Oracle PeopleSoft using URL-encoding to bypass web application firewalls — they've compromised FBI systems, defaced infrastructure, and stolen data on over five thousand officials.

ANSSI have published an incident report on cyberattacks against France's Directorate General of Public Finance over the summer. Two waves of data exfiltration occurred between May and August, exploiting weak identity management, poor network segmentation that allowed lateral movement from Ministry of National Education systems, and insufficient detection capabilities. One for those working on segmentation or identity hygiene in large government networks.

And finally, Ntop have released the nDPI TCP Fingerprint, a patent-free method for passive TCP stack identification. It's integrated into the nDPI library and enables correlation of OS-level TCP fingerprints with application-layer signals to detect anomalies and identify network scanners. Worth noting it should only be used as a supplementary detection signal, not for authentication — it relies on SYN packet fields that are easily manipulated.

That's all for today. Attribution goes to the original authors — the analysis here was automated.

📰 Articles Covered

CVE-2026-76504 - CISA KEV

As of October 1, 2026, the following threat intelligence is available regarding **CVE-2026-76504**.

### Overview
CVE-2026-76504 is a critical, actively exploited authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Manager . It has been assigned a CVSS score of 9.8 .

| Attribute | Details |
| :--- | :--- |
| **Vendor** | Cisco |
| **Affected Product** | Cisco Catalyst SD-WAN Manager |
| **Vulnerability Type** | Authentication Bypass (API session-based) |
| **Status** | Actively exploited in the wild; added to CISA's Known Exploited Vulnerabilities (KEV) catalog |

### Technical Details & Exploitation
The vulnerability stems from improper handling of URI encoding within the API’s session-based authentication management .

* **Mechanism:** Attackers can bypass authentication by sending a crafted HTTP request to the affected endpoint. Specifically, by using URI-encoded characters (such as encoding the letter "j" within the `j_security_check` login-handler path), the authentication rule guarding the endpoint fails to match, allowing the unauthenticated request to proceed .
* **Impact:** Successful exploitation grants an unauthenticated, remote attacker **admin-level API access** to the system .

### Exploitation Context (MITRE ATT&CK T1190)
This vulnerability is being actively exploited against internet-facing applications (MITRE ATT&CK T1190). Because Cisco Catalyst SD-WAN edge devices are frequently exposed to the internet by design, they are highly attractive targets for threat actors . Defenders should note that this is a distinct vulnerability and is not addressed by patches for previous, related Cisco SD-WAN flaws (such as those fixed in May or June 2026) .

### Recommendations for Defenders
* **Patch Immediately:** There are no known workarounds for this vulnerability. Applying the vendor-supplied security update is the only effective remediation .
* **Monitor Logs:** Organizations should review logs for suspicious API requests, particularly those involving unusual URI encoding or unauthorized access attempts directed at the `j_security_check` path .
* **Restrict Access:** Where possible, restrict access to the SD-WAN Manager’s management interface to trusted internal networks or VPNs to reduce exposure to the public internet while patching is underway.
Star Blizzard refines phishing and malware delivery with the RedFlick technique - Microsoft

The information provided in your summary covers the key aspects of the **Star Blizzard** threat actor and their use of the **RedFlick** technique as detailed in the recent Microsoft security blog post.

Below is the structured precis based on the source material:

### **Overview: The RedFlick Technique**
Since January 2026, the Russian-attributed threat actor **Star Blizzard** (subordinate to the FSB Centre 18) has pivoted from highly targeted spear-phishing to large-scale, high-volume phishing campaigns. A central component of this evolution is **"RedFlick,"** a streamlined malware delivery technique designed to reduce user-interaction requirements and enhance detection evasion compared to previous methods like "ClickFix."

### **Affected Targets**
The campaign has impacted over 100 organizations across the globe, specifically focusing on:
* **Governmental & Institutional:** Ukrainian institutions, international governments, and policy-focused think tanks.
* **NGOs:** Organizations involved in international humanitarian and policy work.
* **Private Sector:** Financial institutions supporting Ukraine and technology-sector organizations based in the US and Europe.

### **Security Implications**
* **Increased Scope:** The shift toward large-scale, automated phishing campaigns significantly expands the actor's attack surface and potential for compromise.
* **Efficiency:** By refining the infection chain to require only a single user interaction, the actor creates a more reliable path to exploitation.
* **Advanced Evasion:** The actor has improved its ability to bypass layered security controls through sophisticated payload concealment and the use of legitimate-appearing persistence mechanisms.

### **Technical Details**
* **Initial Access:** Emails are sent from compromised sites (CPanel/WordPress), often impersonating trusted contacts.
* **RedFlick Execution Chain:**
* Targets are induced to open password-protected archives (RAR/ZIP).
* Malicious VHDX files or PDFs containing Base64-encoded PowerShell payloads are used to launch an MSI installer.
* This installer establishes persistence via scheduled tasks that masquerade as benign system processes (e.g., "System Health Monitor").
* **Payload & Persistence:** The ultimate payload is the **CosmicPulse** backdoor (also tracked as NOROBOT/BAITSWITCH), a custom Python-based tool compiled as a Control Panel applet (CPL) for masquerading. The actor also utilizes WebDAV for remote payload execution, circumventing standard SMB-based network restrictions.

### **Guidance for Defenders**
To mitigate the risk posed by Star Blizzard and the RedFlick technique, organizations should prioritize the following:

| Category | Recommended Defensive Actions |
| :--- | :--- |
| **Identity** | Enforce phishing-resistant multi-factor authentication (MFA) and strict Conditional Access policies. |
| **Email Security** | Utilize advanced security solutions (e.g., Microsoft Defender for Office 365) to leverage "Safe Links," "Safe Attachments," and Zero-hour auto purge (ZAP). |
| **Endpoint Security** | Deploy EDR in block mode; enable real-time cloud-delivered protection; implement Attack Surface Reduction (ASR) rules, specifically blocking obfuscated scripts and unsigned executables. |
| **Network Security** | Strictly limit outbound SSH connections to those required for legitimate business operations. |
| **User Vigilance** | Train staff to recognize phishing indicators, including bulk-sent communications, unusual sender domains, and requests to open password-protected archives. |

【1】
Verdachte aangehouden in onderzoek naar hackersgroep ShinyHunters - Suspect arrested in investigation into hacker group ShinyHunters - www.politie.nl

Following the investigation into the criminal hacker and extortion group **ShinyHunters**, Dutch authorities have arrested a 24-year-old Amsterdam man suspected of playing a significant role within the organization 【1】.

### What Happened
The suspect was arrested on September 15, 2026, by the National Investigation and Intervention Unit (Eenheid Landelijke Opsporing en Interventies) under the authority of the National Public Prosecutor's Office 【1】. In addition to charges related to participation in a criminal organization, authorities discovered information on his devices suggesting he solicited two murders to be carried out abroad—a separate criminal matter from the hacking investigation 【1】. As of late September, a Rotterdam court extended his pre-trial detention by 90 days 【1】.

### Who is Affected
ShinyHunters is a well-known cybercriminal group linked to major data breaches affecting organizations including **Odido, Pornhub, and TicketMaster** 【1】. While this arrest is a significant step, the investigation is ongoing, and police are still seeking further information regarding specific incidents, such as the breach at Odido 【1】.

### Security Implications
The primary implication is the ongoing risk posed by the bulk theft of data. Stolen information is frequently exploited on a massive scale by other cybercriminals, fueling further identity fraud and secondary attacks. Authorities anticipate that such high-impact cyberattacks will continue to occur with greater frequency 【1】.

### Technical Details
* **Seizures:** Law enforcement has seized various data carriers from the suspect, which are currently undergoing forensic examination 【1】.
* **Investigative Focus:** The case is being handled by the specialized Team High Tech Crime, which continues to probe the inner workings of the group 【1】.

### What Defenders Should Know
Given the persistent threat posed by groups like ShinyHunters, both businesses and individuals are urged to prioritize digital security:
* **For Businesses:** Organizations are strongly encouraged to implement robust [preventive measures](https://ondernemersplein.overheid.nl/bedrijfsvoering/veiligheid-en-fraude/bescherm-uw-bedrijf-tegen-cybercrime/) to protect their infrastructure against cybercrime 【1】.
* **For Individuals:** The public is asked to remain vigilant and take necessary steps to secure their online presence, as outlined by [Veiliginternetten.nl](https://veiliginternetten.nl/) 【1】.
Introducing the nDPI TCP Fingerprint: A Stable, Patent-Free Way to Fingerprint TCP Stacks – ntop - ntop

The article introduces the **nDPI TCP Fingerprint (NTF)**, a new, patent-free, and stable method for passive TCP stack identification integrated into the nDPI library 【1】.

### What Happened
Ntop has released NTF, which replaces previous fingerprinting approaches in the nDPI library. It is designed to be a standardized, open-source, and stable format that addresses the "drift" often seen in other fingerprinting methods—where the same TCP stack produces different fingerprints based on path-dependent variables. Note that this change involves a new way of serializing TCP options, meaning existing custom fingerprint databases must be updated 【1】.

### Who is Affected
* **Security Professionals and Developers:** Those using nDPI for network monitoring, traffic analysis, or device identification.
* **System Administrators:** Organizations relying on custom databases for identifying OS or network stacks will need to regenerate their fingerprints to ensure compatibility with the updated nDPI library.

### Security Implications
* **Correlation Power:** NTF allows defenders to correlate the TCP stack fingerprint (at the OS level) with application-layer signals (such as TLS fingerprints). Identifying a mismatch—e.g., an application claiming to be a desktop mail client but using an Android-like TCP stack—is a powerful indicator of suspicious activity.
* **Scanner Identification:** The process is capable of automatically detecting common network scanners (like `masscan` or `zmap`) by identifying characteristic SYN packet patterns, such as the absence of specific options or restricted option sets.
* **Constraint on Use:** Because NTF is based on fields that a malicious actor can easily manipulate in a crafted SYN packet, it **must not be used for authentication**. It should only be used as a supplementary signal within a wider threat detection or traffic classification pipeline.

### Technical Details
NTF is generated from the initial SYN packet of a flow. Its structure is a stable, fixed-layout string: `<tcp_flags>_<ttl_bucket>_<tcp_window>_<options_hash>` 【1】.
* **Stability Focus:** It deliberately ignores transient, path-dependent fields such as Maximum Segment Size (MSS), TCP timestamps, or TCP Fast Open (TFO) cookies to ensure that the fingerprint remains consistent across different networks.
* **Distinguishing Features:** Unlike competing formats, it incorporates ECN negotiation into its flags and uses bucketed TTL values rather than absolute ones to maintain stability across varying hops.

### What Defenders Should Know
* **Tool Compatibility:** NTF is now the default TCP fingerprint mechanism in nDPI and is accessible via the C API, JSON/TLV exports, and Wireshark.
* **Distinction from Other Formats:** Defenders should recognize the difference between NTF and formats like JA4T. NTF is intended specifically for **OS identification** (where stability is key), whereas formats containing MSS are better suited for **network path analysis**.
* **Resources:** Developers and analysts can find the full specification, test vectors, and a Python reference implementation in the [nDPI GitHub repository](https://github.com/ntop/nDPI/blob/dev/fingerprint/README.ndpi_tcp_fingerprint.md) 【1】.
L’ANSSI publie le rapport d’incident sur les cyberattaques ayant touché la DGFiP - ANSSI publishes the incident report on the cyberattacks that affected the DGFiP - ANSSI

Following an incident in the summer of 2026, the French National Cybersecurity Agency (ANSSI) conducted an investigation into cyberattacks affecting the Directorate General of Public Finance (DGFiP). The resulting report details two distinct waves of data exfiltration and identifies structural vulnerabilities that allowed the incidents to go undetected 【1】.

### Incident Overview
* **What Happened**: Attackers successfully compromised DGFiP systems, leading to two separate data exfiltration events in August 2026. The first, claimed on August 12, targeted the `impots.gouv.fr` platform; the second, claimed on August 13, targeted cadastral (land registry) data held by the DGFiP.
* **Timeline**: The malicious activity occurred between May 2026 and August 2026.
* **Who is Affected**: The DGFiP’s information systems were directly compromised. Additionally, the report notes that the interconnected nature of government networks allowed for lateral movement from the systems of other entities, specifically the Ministry of National Education.

### Security Implications and Technical Vulnerabilities
The investigation concluded that the compromise was enabled by weaknesses in three critical areas:

| Area | Vulnerability Details |
| :--- | :--- |
| **Identity Management** | Attackers stole and used legitimate user credentials. This was facilitated by employees using work credentials on personal devices and the absence of multi-factor authentication (MFA) on portals providing access to sensitive resources. |
| **Architecture** | Sensitive applications were exposed directly to the internet or the Interministerial State Network (RIE) without proper compartmentalization. This lack of segmentation allowed attackers to move laterally into the DGFiP environment from third-party organizations. |
| **Detection** | Neither the DGFiP nor ANSSI detected the exfiltrations in real-time. DGFiP systems lacked application-level supervision for critical portals, and ANSSI’s own network-level detection failed due to poorly placed probes, a lack of relevant network indicators of compromise (IoCs), and the absence of detection rules tailored to this specific threat. |

### Lessons for Defenders
The report emphasizes several key areas for improvement, which have formed the basis of an action plan developed between the DGFiP and ANSSI:

* **Enforce Strong Authentication**: The incident highlights the critical need for multi-factor authentication, particularly for all portals providing access to sensitive information.
* **Architectural Segmentation**: Security must be bolstered by properly compartmentalizing sensitive applications. Interconnected networks (like the RIE) must not allow for uncontrolled lateral movement between government entities.
* **Enhanced Supervision**: Organizations must ensure comprehensive application-level monitoring. Blind spots, such as unmonitored portals, are prime targets for attackers.
* **Coordinated Detection**: Effective defense requires the correlation of suspicious signals. Defenders must move beyond generic network monitoring by implementing specific detection rules and maintaining updated, actionable indicators of compromise.
* **Interministerial Coordination**: Improving the ability to share threat intelligence and coordinate response efforts across different government branches is essential to prevent lateral movement and detect threats faster 【1】.
Dutch Police Arrest ‘Reformed’ Hacker in Shiny Hunters Investigation - Brian Krebs

The arrest of a prominent Dutch cybercriminal has triggered a chaotic and aggressive shift in the operations of the prolific hacker group **ShinyHunters**. Below is a detailed precis of the situation based on the report.

### What Happened
On or around September 16, 2026, Dutch authorities arrested **Pepijn van der Stap**, a 24-year-old software engineer and previously convicted hacker from the Netherlands 【1】. Following his arrest, the ShinyHunters group underwent a leadership change, shifting toward more reckless and high-profile attacks under a new leader identified as "**Rey**," a teenage cybercriminal based in Jordan 【1】.

The group appears to be engaged in internal conflict. Rey, reportedly having a long-standing feud with Van der Stap over control of the group's "brand," utilized imagery associated with Van der Stap's former hacker alias, "**Umbreon**," during recent attacks to frame the Dutchman for operations he likely did not commit 【1】.

### Who Is Affected
* **The FBI:** The group defaced the FBI’s job application site and stole sensitive data pertaining to over 5,000 officials, including Social Security numbers and psychiatric/medical files 【1】.
* **Cl0p Ransomware Group:** In an unusual move, the group also targeted the Russian ransomware collective Cl0p for extortion 【1】.
* **Broad Industry Impact:** Exploiting Oracle PeopleSoft vulnerabilities, the group has successfully breached numerous organizations across the healthcare, higher education, agriculture, technology, transportation, and government sectors 【1】.

### Security Implications & Technical Details
The group has been exploiting **CVE-2026-35273**, a critical vulnerability in Oracle’s **PeopleSoft** platform. While Oracle released a patch for the flaw, ShinyHunters successfully bypassed temporary Web Application Firewall (WAF) mitigation rules provided by security researchers (specifically those from Mandiant) by employing a **URL-encoding trick** 【1】.

### What Defenders Should Know
* **Aggressive Extortion:** ShinyHunters remains highly active and dangerous, currently on track to generate nearly $100 million in illicit gains during 2026 【1】.
* **Misdirection Tactics:** Defenders should be aware that the group uses "false flag" tactics. The appearance of "Umbreon" imagery in defacements or ransom notes is being used intentionally by current leadership to sow confusion and misattribute attacks 【1】.
* **Limitations of WAF Rules:** Relying exclusively on vendor-provided or third-party WAF rules as a substitute for permanent patching is risky. Sophisticated threat actors are actively testing and bypassing these signatures using standard obfuscation techniques like URL encoding. Organizations must prioritize applying official security updates over relying on temporary firewall mitigations 【1】.