Cybersecurity Weekly Briefing, 19-25 September

An orphaned COM registry entry leaves the Windows Dark Elevator privilege escalation vulnerability not fully patched

Google Project Zero, in collaboration with 14 other researchers, has turned the incomplete patch that Microsoft released in July for Dark Elevator (CVE-2026-50343, CVSSv3 7.8 according to Microsoft) into a new exploit, resulting in CVE-2026-66804 (CVSSv3 7.8 according to Microsoft).

The original patch closed the exploit vector via InstallService, but left the orphaned COM registry entry for the CrossDevice class intact; this points to a path that any user can create: a fake IMarshal object allows that orphaned CLSID to be loaded into a COM service with SYSTEM privileges, achieving execution as NT AUTHORITY\SYSTEM via a scheduled task accessible to any user. The vulnerability affects Windows 10 22H2 and Windows 11 24H2, 25H2 and 26H1, and has been patched since August’s Patch Tuesday; there have been no confirmed active exploits or entries in CISA’s KEV catalogue to date.

It is recommended that the patched builds be applied as soon as possible.

More info

Check Point: 0-day exploited in Security Management Server and attacks against Spark firewall VPNs

Check Point has confirmed that CVE-2026-93616 (CVSSv3 9.8 according to Check Point), a path traversal vulnerability in the Security Management Server’s web service, was exploited as a 0-day in a small number of targeted attacks on 23 July. The vulnerability allows scripts to be uploaded and executed without authentication on the server that manages gateway policies.

The fix was released on 22 September. Versions R80 to R82.20 with Jumbo Hotfix takes below the thresholds indicated in sk1000171 are affected. LivePatch Takes 28/29 from 16 September do not address this vulnerability. Furthermore, since 12 September, there have been attempts to exploit CVE-2026-85102 (CVSSv3 9.8 according to Check Point), a flaw in VPN certificate validation that allows unauthenticated code execution on the Security Gateway and Spark firewalls for SMEs. These attempts originate from VPNs and anonymisation proxies and use certificates with subject names such as CN=vpn,OU=users,O=global.

Check Point has not stated whether any of these attempts were successful. It is recommended that you apply the sk1000171 and sk1000117 patches immediately and follow the hunting guidelines to investigate any compromises that may have occurred prior to patching. This includes reviewing Mobile Access logins using certificates and conducting a subsequent internal scan.

More info

ClosedQuorum, a Windows implant that decides its actions by a vote amongst several AI models

Cisco Talos has published a report on ClosedQuorum, an autonomous Windows malware that uses Gemini, DeepSeek, Qwen and Mistral to decide, by a vote, what to do following a compromise. In the event of a tie, the option chosen by DeepSeek takes precedence.

ClosedQuorum can crash LSASS, steal browser and wallet passwords, inject code via process hollowing or Early Bird APC, persist and move laterally, and sends the stolen data to a Discord webhook. The artefacts point to developers linked to carding forums.

However, Cisco Talos warns that this may be more of an experiment than a tool that has been deployed.

More info

RemControl, a new Android banking Trojan-as-a-service targeting users in Spain, Europe and the Middle East

Group-IB has uncovered RemControl, a new malware-as-a-service platform for Android targeting users in Italy, France, Spain, Poland, Portugal, Canada and the Middle East. RemControl is distributed via malvertising campaigns using fake Google Play pages that impersonate the IPTV app TVTap. Its dropper sets up a VPN service that blocks traffic from Google Play Services to bypass Play Protect checks, a technique previously seen in ToxicPanda.

Using Accessibility permissions, it displays over 30 phishing overlays on banking apps, streams screenshots and the UI tree in real time, records keystrokes, performs remote gestures, captures unlock patterns from various manufacturers and prevents uninstallation; it retrieves encrypted C2 configurations via Telegram channels. Group-IB attributes the operation to an actor it calls UNKK, with indications of Russian-speaking activity and a possible link to the Medusa banking Trojan.

It is recommended to avoid APKs from outside Google Play and to deny Accessibility permissions to apps that do not require them.

More info

AI agents automate attacks on online retailers and enable the theft of more than 600,000 cards

A campaign active since July has been using AI agents to automate attacks against hundreds of e-commerce sites, with at least 27 organisations compromised in five days and over 600,000 card records stolen. According to Gambit’s investigation, the operator used Strix for reconnaissance and vulnerability discovery, Cairn for autonomous exploitation, and Hermes to coordinate post-exploitation using language models.

The attackers deployed skimmers by modifying legitimate JavaScript, payment pages, S3 and CDN content, databases, Kubernetes deployments and cron jobs, targeting at least 119 sites and large organisations. A particularly significant aspect is the cost: researchers estimate an average of around $25 per target, considerably lowering the financial barrier to large-scale exploitation campaigns.

Automation also led to data loss when the agent executed instructions designed to delete records that had already been exfiltrated from the Magento databases.

More info

◾ This newsletter is one of the deliverables of our Operational and Strategic Intelligence service. If you are interested in knowing the rest of the Operational and Strategic Intelligence contents included in the service, please contact us →