Malware Activity
Trusted Software Abuse and Social Engineering Drive New Enterprise Malware Threats
Cybersecurity researchers have identified two (2) dangerous malware campaigns that rely on deception rather than traditional malware delivery methods. The first is linked to the Silver Fox threat group. They disguise the ValleyRAT backdoor as a legitimate, digitally signed Chinese adware application called QN Wallpaper. This tricks users into trusting and even excluding it from antivirus protection. Once installed, ValleyRAT can steal keystrokes, screenshots, and clipboard data, disable Windows Defender, download additional malware, and provide attackers with full remote access. In a separate campaign, Microsoft uncovered TerminalFix. TerminalFix represents the next generation of the ClickFix social engineering technique. It uses spoofed Cloudflare CAPTCHA prompts to persuade users to run malicious PowerShell commands within Windows Terminal, ultimately enabling system compromise. By leveraging DLL sideloading and malicious payloads hidden in image files, the attack is designed to bypass security controls, establish persistence, and deploy a reverse-tunnel backdoor that enables unauthorized remote access and lateral movement. Together, these campaigns demonstrate how threat actors are increasingly exploiting trusted applications, signed software, and user interaction to bypass security controls, steal sensitive data, and potentially deploy ransomware. Organizations should strengthen PowerShell monitoring, watch for DLL sideloading activity, avoid untrusted software, and educate users about fake verification prompts and risky security exclusions. CTIX analysts will continue to report on the latest malware strains and attack methodologies.
- TheHackerNews: ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions article
- TheHackerNews: TerminalFix Uses Fake Cloudflare CAPTCHAs to Deploy Reverse-Tunnel Backdoor article
Threat Actor Activity
Aurora Ransomware Gang Uses Cursor AI Coding Assistants in Cyber Attacks
Aurora (aka Aur0ra) ransomware operators, a Russian-speaking group, are using SpaceX’s Cursor AI assistant (running Claude Sonnet) to plan and execute intrusions, excluding CIS targets. Leaked infrastructure exposed months of activity against over twenty (20) organizations and revealed Windows and Linux/ESXi encryptors written in Zig, capable of killing VMs, deleting shadow copies, and disabling System Restore and Defender. Aurora uses phishing, phone-based social engineering, and lateral movement across common Windows protocols, then exfiltrates data and encrypts systems. Current structures found through research show that affiliates receive 54–79% of ransoms. Separately, another threat actor built the Gryxa toolkit with AI to turn legitimate RMM tools into covert access, persist via scheduled tasks, steal browser credentials and crypto wallets, disable security tools, and log defenders’ remediation efforts. CTIX Analysts will continue to report on the most recent threat actor activities and emerging campaigns.
Vulnerabilities
Actively Exploited PaperCut Flaws Enable Pre-Auth RCE, Prompt Second Emergency Patch and CISA KEV Listing
PaperCut has released a second emergency security update for two (2) actively exploited vulnerabilities in its NG and MF print management platforms after researchers discovered multiple ways to bypass the company’s initial fixes. The flaws, CVE-2026-81578 (CVSS 8.8) and CVE-2026-82078 (CVSS 9.4), can be chained to achieve unauthenticated remote code execution (RCE). CVE-2026-81578 allows attackers to bypass authentication and modify critical server configuration settings, while CVE-2026-82078 abuses unsafe Java class loading/reflection to execute arbitrary bytecode under the security context of the PaperCut server process. Huntress and watchTowr reproduced the full pre-authentication RCE chain and identified several bypasses for the original emergency patch, leading PaperCut to issue Emergency Patch Release 2 with additional hardening. Huntress also observed exploitation in two (2) customer environments, where attackers used hex-encoded Java class files to execute operating-system commands and conduct reconnaissance, although malware deployment or persistence has not yet been observed. On August 31, 2026, The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, requiring federal civilian agencies to remediate them by September 14, 2026, while ransomware involvement remains unknown. PaperCut is urging all customers (including those that already installed the first emergency patch) to deploy Release 2, available for versions 24 through 26, while users of version 23 or earlier should upgrade. Organizations should also restrict PaperCut management interfaces to trusted networks and review server logs, configuration changes, and unusual Java or PaperCut process activity for evidence of compromise. CTIX recommend any affected organizations ensure they follow the PaperCut and CISA guidance to prevent exploitation
- Bleeping Computer: PaperCut Vulnerability Chain Article
- Cyber Security News: PaperCut Vulnerability Chain Article
📧 Never Miss a Briefing
Stay informed and secure. Subscribe to Ankura’s Cyber Flash Update, a bi-weekly briefing curated by our top cybersecurity experts. Receive timely insights on emerging threats, vulnerabilities and malicious actors to keep your systems secure.
Join the Cyber Flash Update community today.
© Copyright 2026. The views expressed herein are those of the author(s) and not necessarily the views of Ankura Consulting Group, LLC., its management, its subsidiaries, its affiliates, or its other professionals. Ankura is not a law firm and cannot provide legal advice.
