Weekly ALL-SOURCE Cyber Warfare Intelligence Brief September 8, 2026

Reporting period: August 31–September 7, 2026 Focus: State and state-aligned cyber operations, APT activity, technical campaign intelligence, critical-infrastructure espionage, and campaign evolution.

Four developments dominate this reporting period.

China-linked operators continue shifting espionage toward infrastructure that defenders implicitly trust. Sygnia’s Fire Ant investigation shows Cisco IOS XR routers, TACACS authentication infrastructure, and Linux management systems being turned into collection platforms. The actor can hide configurations, suppress telemetry, capture traffic, and steal administrator credentials. This is consistent with the broader Chinese emphasis on edge, virtualization, telecommunications, and management-plane compromise. ( Sygnia )

A separate Chinese-speaking operation provides unusually direct evidence of AI agents integrated into actual offensive workflows. Hunt.io recovered exposed SecFlow workspaces coordinating Claude, Qwen, and DeepSeek workers for reconnaissance, exploitation, credential collection, post-exploitation, and reporting. Unlike speculative reporting “AI hackers,” this case contains retained operational workspaces and evidence of confirmed compromises. The same evidence also shows a critical limitation: AI workers repeatedly pursued a false-positive exploitation result. ( Hunt )

Iran-linked Mirage Kitten has moved developer targeting further into cross-platform software-development workflows. Kaspersky documented previously unknown NodeRabbit and PollCat RATs delivered as trojanized coding assessments through recruiter personas. The shift to Node.js and JavaScript gives the actor a common malware base across Windows, Linux, and macOS while placing malicious execution inside an activity developers routinely perform. ( Securelist )

DPRK-linked operators are showing a parallel emphasis on trusted infrastructure, but at the Linux application and traffic-management layer. Rapid7 identified a previously undocumented framework involving a backdoored HAProxy build, CurlRAT, an SSH credential logger, and trojanized system daemons in South Korean automotive and media environments. The strongest assessment is DPRK nexus rather than attribution to a specific unit. ( Rapid7 )

The broader technical pattern is increasingly clear: state-linked operators are moving away from infrastructure defenders can simply block and toward infrastructure defenders already trust. Routers, hypervisors, authentication servers, cloud hosting, developer projects, load balancers, and legitimate AI platforms are becoming operational components of the intrusion chain.

Priority: Critical Attribution: China nexus, with significant overlap with UNC3886 Confidence: High that the described activity occurred; Moderate regarding precise actor equivalence with UNC3886.

Sygnia disclosed new activity showing Fire Ant moving beyond the VMware ESXi and vCenter environments documented in its earlier investigations. The actor targeted Cisco IOS XR routers, TACACS authentication servers, and Linux management hosts, using them as intelligence-collection and access platforms rather than merely transit systems. ( Sygnia )

The investigation began with a GRE tunnel on a Cisco IOS XR router that had no corresponding configuration or commit history. Technical analysis indicated that the adversary had manipulated the platform so normal administrative inspection did not faithfully represent the actual operating state. ( The Hacker News )

Created covert network tunnels.

Captured PCAP traffic from Cisco infrastructure.

Uploaded collected traffic to external FTP systems.

Modified router behavior to suppress attack-related log messages.

Manipulated command output using automatically appended exclusion filters.

Compromised TACACS infrastructure to steal administrator credentials.

Maintained access on Linux management systems with rootkits and custom SSH tooling.

Renamed malicious binaries to resemble security products such as SentinelOne and Cybereason. ( The Hacker News )

The TACACS compromise is particularly important. Sygnia identified a credential-collection framework called TacTap . A loader injected a malicious library into the legitimate tac_plus process and passed session information to a second process over a local Unix socket. Captured credentials were stored in:

/var/log/.tacplus.acct

with simple XOR obfuscation using key:

0xEF ( The Hacker News )

Fire Ant’s objective appears broader than persistence inside a single victim.

Sygnia characterizes the activity as targeting the “target behind the target” : compromise infrastructure that holds trust relationships, credentials, connectivity, or visibility into other high-value environments. A router or TACACS server may therefore be valuable less for its own data than because it becomes an access broker into interconnected organizations. ( Sygnia )

This aligns conceptually with other PRC-linked campaigns emphasizing:

Telecommunications infrastructure.

Authentication infrastructure.

Long-duration access with minimal conventional endpoint visibility.

ATT&CK-aligned behavior

Relevant techniques include network sniffing, credential collection, protocol tunneling, defense evasion through log modification, masquerading, rootkit deployment, account discovery, remote services, and exploitation of trusted infrastructure.

The most important defensive implication is forensic: After router or authentication-server compromise, the device’s own logs and configuration output can no longer be assumed authoritative.

Independent telemetry becomes essential.

Sygnia’s reporting is based on incident-response evidence rather than unattributed intelligence claims. Secondary reporting from The Record, BleepingComputer, and others is consistent with the primary account. ( Sygnia )

Veracity: High. China nexus: Moderate to High. Exact Fire Ant = UNC3886 equivalence: Not established.

Sygnia Fire Ant technical research

Priority: High Actor: Unnamed Chinese-speaking operator State attribution: Unproven Confidence: High regarding technical observations; Low to Moderate regarding government sponsorship.

Hunt.io published an unusually valuable dataset on September 3 after prior disclosure to affected national CERTs. Researchers recovered five exposed operator workspaces belonging to a campaign using SecFlow to coordinate Claude, Qwen, and DeepSeek models as specialized offensive workers. ( Hunt )

Taiwan’s Kuomintang Party History Archives.

Indonesia’s Ministry of Foreign Affairs.

Government environments in mainland China.

Chinese educational systems.

Industrial systems in Da Nang, Vietnam. ( Hunt )

AI-enabled attack architecture

SecFlow divided tasks among AI workers performing:

Credential collection.

Operators could swap between Claude, Qwen, and DeepSeek without changing the task interface. Model traffic was routed through private niestools.com infrastructure while target-facing activity used authenticated SOCKS proxies. ( Hunt )

This is materially different from an attacker using a chatbot to write a phishing email.

The AI systems were components inside an operational orchestration framework.

Confirmed compromises

The strongest documented compromise involved a Fengtai District government environment, where Hunt.io found evidence of:

Registry-hive acquisition.

Access to government and health information.

Researchers also found root database and Grafana administrator access in a university campus-card environment. ( Hunt )

Hunt.io identified active or staged workflows involving:

CVE-2014-6271 , Shellshock.

CVE-2020-1938 , Ghostcat.

CVE-2022-22965 , Spring4Shell.

Apache Shiro deserialization techniques.

Nacos authentication bypass. ( Hunt )

This is notable because the campaign did not depend primarily on cutting-edge zero-days. AI orchestration was used to scale exploitation of known weaknesses, exposed systems, and credential opportunities.

Infrastructure observables

Hunt.io connected the five workspaces through shared infrastructure, tooling, credentials, and the recurring handle Nie . ( Hunt )

The most important finding: AI failure propagation

The recovered data also provides one of the clearest public demonstrations of a weakness in offensive agentic systems.

An AI worker incorrectly assessed a Shiro exploitation attempt as successful. That unsupported conclusion persisted in shared campaign context and triggered more than 27 unsuccessful follow-up actions. ( Hunt )

This matters defensively.

Agentic offensive systems can increase speed and scale, but shared machine context can also amplify a false premise across multiple specialist agents.

Defenders may eventually exploit this characteristic through deception, honeypots, deliberately misleading response conditions, and adversarial environment design.

Attribution assessment

The operator is clearly Chinese-speaking based on artifacts and infrastructure, but the available evidence does not establish a named PLA, MSS, or state-contractor relationship.

Chinese-speaking operator: High confidence. Organized cyberespionage: High confidence. PRC state direction: Low to Moderate confidence.

Treat claims calling this a confirmed “Chinese government AI attack” as premature.

Hunt.io SecFlow investigation

Priority: High Actor: Mirage Kitten Aliases/overlap: Commonly associated with UNC1549, Smoke Sandstorm, and Nimbus Manticore in vendor reporting Attribution confidence: Kaspersky High; broader Iranian linkage High.

Kaspersky published new research on September 1 documenting two previously unknown malware families, NodeRabbit and PollCat , used against aviation, aerospace, and FinTech targets across the Middle East and Africa. ( Securelist )

The campaign represents a substantial tooling evolution.

Mirage Kitten historically used native C, C++, and Go malware. NodeRabbit and PollCat are its first publicly documented Node.js and JavaScript implants, allowing a common codebase across Windows, Linux, and macOS. ( Securelist )

The actor approached developers using fake recruiter personas on and other employment platforms.

Targets received purported coding assessments hosted on legitimate cloud infrastructure. One archive was:

Front-Technical-Challenge.zip

1EA83E4E4592B01E4ACAB63EB867BEE5

and was hosted in an Amazon S3 bucket. ( Securelist )

The fake assessment used Express, React, and Vite.

Its server.js loaded a malicious package:

colorized_terminal version 2.1.0

The attackers bundled the package inside the project’s existing node_modules directory instead of publishing it publicly. Importing the package launched:

node_modules/.cache/.320697f1/index.js ( Securelist )

Anti-analysis through workflow manipulation

The README imposed a three-hour completion limit and explicitly prohibited use of AI assistants.

Kaspersky assesses that an AI code-review system might have flagged the suspicious package import. The restriction therefore had an operational security benefit: convince the victim not to invoke a defensive capability already available inside the development workflow. ( Securelist )

This should be treated as social engineering rather than a technical AI-evasion mechanism.

NodeRabbit generates an identifier using host information including:

It hashes those values with SHA-256 and truncates the output.

as a single-instance mechanism. ( Securelist )

Later variants incorporated deeper development-environment persistence, including malicious VS Code extension behavior and Git-hook injection.

PollCat uses a separate JavaScript architecture and was delivered through another programming-assessment lure.

The actor’s move toward Node.js and JavaScript is operationally logical. Developer systems routinely execute such environments, reducing the anomalous character of the runtime itself.

Mirage Kitten continues combining:

Microsoft Azure Websites.

Cloudflare-backed domains.

Legitimate cloud storage.

Kaspersky specifically notes that Azure-hosted subdomains can make C2 activity resemble ordinary organizational cloud traffic. Some hostnames incorporated victim organization names. ( Securelist )

Observed infrastructure included:

msmanagementgrp[.]com

visitfinancedentists[.]com

Kaspersky identified approximately 11 additional related infrastructure assets through these patterns. ( Securelist )

Selected file indicators

The targeting supports technical intelligence collection against aviation, aerospace, and financial-technology organizations .

The developer emphasis is particularly dangerous because developer workstations commonly possess:

Package-registry credentials.

Internal infrastructure access.

The workstation itself may therefore be only the first target.

Kaspersky Mirage Kitten technical report

Priority: High Actor: DPRK nexus Possible overlap: APT37 and Lazarus tradecraft Attribution confidence: Medium.

Rapid7 published analysis on September 4 of a previously undocumented Linux espionage framework targeting South Korean automotive and media organizations. ( Rapid7 )

The toolkit includes:

A trojanized HAProxy build, dubbed ted backdoor .

SSH password interception.

Evidence suggesting a broader nginx-related framework may exist.

The attacker recompiled HAProxy 2.8.12 with a malicious component called ted_plugin .

Rather than merely masquerading as HAProxy, the malware operates inside the legitimate HAProxy architecture, using its native:

Process-management mechanisms.

This allows it to inspect traffic while genuine load-balancing activity continues.

Capture high-value HTTP traffic.

Steal session cookies.

Select visitors based on source IP.

Inject malicious scripts into returned webpages.

Create an interactive shell.

Suppress HAProxy connection statistics.

That last capability makes the compromised load balancer an unreliable forensic source.

A trojanized SSH component intercepts plaintext credentials and stores them under:

/var/lib/sshd/c8c68e629bba773a10ac80012d10bf19

The data is encoded using a custom substitution cipher and Base64.

CurlRAT and daemon replacement

The stager profiles the operating system and replaces legitimate Linux daemons with malicious versions.

It subsequently timestomps the replacement crond binary to match:

and selectively removes evidence from:

/var/log/audit/audit.log

Observed infrastructure includes:

img.monderhouse[.]space

img.smartnords[.]site

img.darklights[.]store

img.responsive.pstatic[.]autos

img.socialteams[.]store

img.worksongo[.]store

The img.responsive.pstatic.autos naming convention appears designed to resemble Naver’s legitimate pstatic.net infrastructure, reinforcing South Korean victim orientation.

Rapid7 deliberately stops at medium-confidence DPRK attribution .

South Korean victimology.

C2 overlap reported elsewhere with APT37.

Similar encryption practices.

Korean groupware targeting.

Watering-hole behavior documented in DPRK operations.

Similarities with Lazarus Operation SyncHole.

However, Rapid7 explicitly notes that APT37 and Lazarus are separate North Korean clusters and says current evidence is insufficient for more precise attribution.

This distinction should be preserved.

Claims labeling the campaign definitively “APT37” or “Lazarus” exceed the primary source.

Rapid7 DPRK Linux toolkit analysis

Three separate state-linked ecosystems now show the same strategic preference:

The commonality is not malware lineage. It is control of trusted operational layers .

This materially changes defensive priorities.

Endpoint telemetry alone will increasingly miss campaigns operating:

Below the endpoint at the hypervisor or router.

Above the endpoint in cloud/application workflows.

Alongside the endpoint in identity and authentication systems.

Inside legitimate infrastructure processes such as HAProxy.

Through AI orchestration outside the victim environment.

The reporting period produced limited new government-issued nation-state vulnerability advisories. The most important exploitation lesson instead comes from the SecFlow campaign: significant government compromise was achieved using well-known vulnerabilities including Shellshock, Ghostcat, Spring4Shell, and Log4Shell , rather than a new zero-day.

This reinforces a recurring finding: Advanced operators do not require advanced vulnerabilities when externally exposed legacy systems remain exploitable.

The current Chrome zero-day, CVE-2026-85046 , was confirmed as exploited in the wild during the period, but no reviewed primary source currently ties the exploitation to a nation-state actor. It is therefore not assessed here as APT activity.

Similarly, Microsoft’s September 1 Silver Fox investigation documented substantial malicious activity against China-based organizations but explicitly did not attribute the campaign to a nation-state , so it is excluded from the principal state-threat findings. ( Microsoft )

That exclusion is deliberate rather than an intelligence gap.

Fire Ant versus UNC3886: Sygnia identifies meaningful tooling and operational overlap but does not establish identity. Treat Fire Ant as a China-nexus cluster with UNC3886 overlap.

Chinese SecFlow campaign: Chinese-speaking operator is established. Chinese government sponsorship is not.

Mirage Kitten: Kaspersky assesses the campaign with high confidence. Vendor naming around Mirage Kitten, Nimbus Manticore, UNC1549, and Smoke Sandstorm remains partially overlapping rather than perfectly interchangeable.

Ted/CurlRAT: DPRK attribution is Medium confidence. Evidence does not support assigning the activity definitively to APT37 or Lazarus.

These distinctions matter because this week’s secondary coverage repeatedly compresses technical overlap into actor equivalence .

High confidence: Infrastructure compromise is becoming a primary espionage strategy rather than merely a method of initial access.

High confidence: Network and authentication infrastructure should increasingly be treated as potential adversary-controlled systems during incident response, not trusted telemetry sources.

High confidence: Developer environments remain a strategic espionage access point because compromising a developer can yield source code, cloud credentials, signing infrastructure, and downstream access.

Moderate confidence: Commercial AI models are moving from auxiliary attacker tools into actual orchestration layers for reconnaissance, exploitation, and post-compromise workflows.

High confidence: AI offensive automation currently introduces exploitable weaknesses of its own, particularly context poisoning, false-positive propagation, and repeated execution based on incorrect assumptions.

Moderate to High confidence: China-linked and DPRK-linked operators are independently converging on traffic-management and network-control systems as long-term surveillance platforms.

The most important changes this week are not simply new malware families.

Fire Ant: movement from hypervisor compromise toward the broader network trust plane.

Mirage Kitten: transition from predominantly native implants to cross-platform Node.js and JavaScript malware embedded in developer workflows.

DPRK nexus: malicious functionality compiled into existing HAProxy infrastructure, allowing espionage while legitimate services continue functioning.

Chinese SecFlow operator: AI models elevated from coding assistants to tasked operational agents participating directly in offensive execution.

Fire Ant: Initial access into Cisco IOS XR remains unresolved in publicly reviewed reporting.

SecFlow: No evidence currently connects the operator to a specific PRC intelligence organization, military unit, university, or contractor.

Mirage Kitten: Full infrastructure and IOC coverage remains partly restricted to commercial Kaspersky intelligence holdings.

Ted/CurlRAT: Initial access is unknown. Rapid7 considers exploitation of exposed South Korean groupware or mail infrastructure plausible but unconfirmed.

DPRK organizational attribution: The evidence does not yet distinguish whether Ted/CurlRAT belongs to APT37, Lazarus, another DPRK organization, or a shared tooling ecosystem.

Victim scope: For both Fire Ant and the DPRK Linux framework, public victim reporting likely represents only a subset of affected environments.

Fire Ant infrastructure pivots , especially Cisco IOS XR, TACACS+, ESXi, and vCenter compromises in telecommunications, defense, and critical infrastructure.

Additional SecFlow workspaces or Chinese AI-agent infrastructure , particularly niestools.com , the Nie persona, GLUTTON tooling, and the disclosed SOCKS ecosystem.

Mirage Kitten developer-targeting expansion , especially additional fake recruitment personas, malicious coding assessments, VS Code persistence, Git hooks, Azure Websites, and S3 delivery.

Ted/CurlRAT infrastructure , especially compromised Korean groupware, HAProxy systems, suspicious replacement of core Linux daemons, and the six disclosed img.* C2 domains.

AI-oriented defensive deception opportunities. The SecFlow evidence indicates that false state can propagate through agentic attack frameworks. This warrants investigation for future defensive counter-agent and honeypot design.

Vendor alias inflation. Continue checking whether reports labeled APT37, Lazarus, UNC3886, Mirage Kitten, or adjacent actor names actually contain sufficient technical linkage to justify that precision.

This week’s intelligence is less a dramatic destructive attack than a deeper structural change in state cyber operations.

The battlefield is moving into the trust layer.

Fire Ant is compromising routers and authentication infrastructure. DPRK-linked operators are weaponizing load balancers and system daemons. Mirage Kitten is inserting malware into development workflows and legitimate cloud services. A Chinese-speaking operator is inserting commercial AI models directly into reconnaissance, exploitation, and post-compromise orchestration.

The defensive corollary is significant: logs, management systems, network appliances, cloud services, software-development environments, and even automated analysis systems must increasingly be treated as potentially contested infrastructure.

The highest-priority analytic trend for the coming weeks is therefore not a particular malware family. It is the continuing convergence of trusted-infrastructure compromise, identity theft, traffic interception, legitimate-service abuse, and AI-assisted operational automation across otherwise unrelated state-linked campaigns.