TL;DR
Cisco Secure Email Gateway zero-day actively exploited; Nextcloud servers backdoored via Collabora flaw; Microsoft disrupts three phishing platforms behind 1B+ messages. U.S. dismantles North Korean IT worker fraud ring (14 charged, 187 computers seized).
Executive Summary
- Cisco Secure Email Gateway flaw enabling unauthenticated remote code execution is under active attack; patches available.
- Nextcloud administrators report web shell backdoors planted via Collabora Online vulnerability; first attack logged September 10.
- Microsoft, working with international partners, seized domains powering three Chinese-language phishing platforms (CoGUI/NX/FA, Haozi/Phoenix, Iron Man) linked to over 1 billion scam messages.
- U.S. Department of Justice charged 14 individuals and seized ~187 computers dismantling Famous Chollima's North Korean remote IT worker fraud operation.
- U.K. imposed economic sanctions on Cryptomus cryptocurrency platform for facilitating ransomware payments and cybercrime money laundering for Russia.
Top Threats Today
1. Cisco Secure Email Gateway RCE Under Active Exploitation
Severity: HIGH Affected: Technology
Cisco has patched a critical vulnerability in its Secure Email Gateway that permits remote, unauthenticated attackers to execute commands with root privileges [1][2]. The flaw allows an attacker to send an email with a crafted attachment through the gateway, enabling file writes to the appliance's operating system [1]. Active exploitation has been confirmed in the wild [1][2]. The vulnerability is tracked with multiple CVE identifiers: CVE-2026-76519, CVE-2024-20401, CVE-2025-20393, and CVE-2026-76461 [2].
Sources:[1] The Hacker News[2] BleepingComputer
Recommended Action
- Immediately apply Cisco security patches for Secure Email Gateway
- Review email gateway logs for signs of file manipulation or unauthorized access
- Monitor for lateral movement from compromised appliances to internal systems
- Ensure backup and recovery procedures are tested and isolated from production infrastructure
2. Nextcloud Servers Backdoored via Collabora CODE Flaw
Severity: HIGH Affected: Technology
Attackers have exploited a critical vulnerability in Collabora Online – Built-in CODE Server (an optional Nextcloud app) to implant web shells on Nextcloud instances [1]. Three administrators reported the issue on GitHub, with the first documented attack occurring on September 10 [1]. Web shells enable attackers to execute arbitrary commands on compromised servers [1].
Sources:[1] The Hacker News
Recommended Action
- Audit Nextcloud installations for presence of the Collabora Online CODE app and disable or update immediately
- Search server filesystems for suspicious .php, .jsp, or shell files in web-accessible directories
- Review authentication logs for unauthorized access during and after September 10
- Consider isolating affected Nextcloud instances until forensics are complete
3. Microsoft Disrupts Three Phishing Platforms Behind 1+ Billion Messages
Severity: HIGH Affected: Technology
Microsoft, Health-ISAC, Japan's Cybercrime Control Center (JC3), and private sector partners including Resecurity, Cloudflare, Oracle, Proofpoint, and TRM Labs announced ⚠ the disruption of three phishing platforms: CoGUI (also known as NX or FA), Haozi (also known as Phoenix), and Iron Man System [1][2][3]. Operating under the “YAM Store” umbrella, these platforms provided cloud infrastructure and phishing kits enabling over 1 billion scam messages globally [1][2][3]. Backed by a federal court order, Microsoft seized and redirected associated domains [2][3].
Sources:[1] The Hacker News[2] The Record[3] SecurityWeek
Recommended Action
- Review email gateway logs for messages originating from or routing through seized CoGUI, Haozi, or Iron Man domains
- Update email filtering rules to block known phishing kit indicators and infrastructure
- Educate users about phishing tactics employed by these platforms (credential harvesting, fake login pages)
- Monitor for employee reports of suspicious emails; phishing kit operators may pivot to alternate infrastructure
4. U.S. Dismantles North Korean Remote IT Worker Fraud Ring
Severity: HIGH Affected: Government
The U.S. Department of Justice charged 14 individuals and seized approximately 187 computers in a disruption of the Famous Chollima threat group's North Korean remote IT worker (ITW) scheme [1][2]. The indictment includes U.S. citizens and Chinese nationals ⚠ involved in the fraudulent operation [1]. Over 40 laptop farms were targeted in the action [1].
Sources:[1] The Hacker News[2] BleepingComputer
Recommended Action
- Review hiring and contractor vetting processes for remote IT positions to identify suspicious profiles
- Audit remote access logs for unusual geographic anomalies, off-hours activity, or high data exfiltration
- Implement geofencing controls for VPN and remote desktop services
- Verify identity of all active remote IT workers; escalate for additional background checks if needed
5. U.K. Sanctions Cryptomus for Russia-Linked Cybercrime Money Laundering
Severity: MEDIUM Affected: Finance
The United Kingdom has issued economic sanctions against Cryptomus, a cryptocurrency platform experts describe as a major conduit for ransomware payments, narcotics transactions, darknet market proceeds, fraud, and cybercrime services enabling Russia to circumvent existing financial restrictions [1].
Sources:[1] Krebs on Security
Recommended Action
- Update cryptocurrency transaction monitoring to flag Cryptomus wallet addresses and associated blockchain activity
- Review incident response procedures for ransomware; ransom negotiators should be aware of Cryptomus sanctions and legal liability
- Brief finance and compliance teams on U.K. sanctions implications for any organizational holdings or transactions
Today’s Action Checklist
- ☐ URGENT: Deploy Cisco Secure Email Gateway patches (CVE-2026-76519, CVE-2024-20401, CVE-2025-20393, CVE-2026-76461); review logs for exploitation
- ☐ URGENT: Audit Nextcloud deployments for Collabora Online CODE app; disable or update if present
- ☐ Review email filters for known phishing kit infrastructure linked to CoGUI, Haozi, Iron Man
- ☐ Verify identity and vetting procedures for remote IT contractors; audit remote access logs for anomalies
- ☐ Notify finance/legal of U.K. Cryptomus sanctions; review ransomware response procedures