Threat Intelligence Brief - Tuesday, August 4, 2026

Threat Radar

• IMMEDIATE: Over 24,000 internet-exposed BMC management interfaces are leaking authentication hashes pre-login — active exploitation confirmed, data center infrastructure at direct risk.

• IMMEDIATE: CISA added CVE-2026-18577 in N-able N-central to the KEV catalog following confirmed customer compromises — patch or isolate now.

• APT29/Midnight Blizzard is running an active global campaign intercepting Microsoft 365 credentials via compromised hotel Wi-Fi networks using custom malware — any traveling employee is a potential target.

• Device code phishing surged 1,500% in 2026 and vishing doubled — both techniques are engineered to bypass MFA and leave minimal forensic evidence.

• Russian loader-as-a-service DOUBLECUP is combining ClickFix social engineering with PNG steganography to deliver CountLoader and the DeviceManager RAT on Windows endpoints.

• Healthcare extortion continues: an unnamed group stole personal, financial, and medical records for 150,000 individuals from Madera Community Hospital.

Immediate Action Required

• BMC Hash Exposure — Audit Internet-Exposed Management Interfaces Now: Identify any BMC/IPMI interfaces reachable from the internet. Remove public exposure immediately. Rotate credentials on any interface that may have been accessible. Active exploitation is confirmed.

• N-able N-central CVE-2026-18577 — Emergency Patch: If your organization or any MSP in your supply chain runs N-able N-central, treat this as an emergency patch cycle. CISA KEV listing with confirmed customer compromises means exploitation is active and targeted. Validate patch status today.

High-Impact Developments

Decades-Old BMC Vulnerability Exposes 24,000+ Data Center Management Interfaces

• What happened: A long-standing vulnerability in Baseboard Management Controller (BMC) interfaces causes authentication hashes to be disclosed to unauthenticated users before login. More than 24,000 such interfaces are directly reachable from the internet, and active exploitation has been confirmed.

• Why it matters: BMC interfaces provide out-of-band control over physical servers — firmware, power, console access. A stolen hash enables authentication bypass or offline cracking, giving attackers persistent, low-level server access that survives OS reinstalls.

• Who should care: Infrastructure teams, data center operations, security leadership, incident response.

• Recommended action: Audit for internet-exposed BMC interfaces immediately. Remove public exposure. Rotate all BMC credentials. Determine whether any exposed interfaces were accessed by unauthorized parties. Prioritize environments hosting sensitive workloads or shared infrastructure.

• Confidence: High — active exploitation confirmed.

• Search metadata: T1110, BMC, authentication hashes, credential exposure, authentication bypass, data center

Intelligence Context

• Decades-Old BMC Vulnerability Exposes Thousands of Data Centers to Attacks — SecurityWeek
  • Context: SecurityWeek reports over 24,000 internet-accessible BMC interfaces are disclosing authentication hashes before login, with active exploitation confirmed in the wild.

CISA KEV: N-able N-central Actively Exploited Following Customer Compromises

• What happened: CISA added CVE-2026-18577, a high-severity vulnerability in N-able N-central, to its Known Exploited Vulnerabilities catalog. The addition follows confirmed active exploitation resulting in customer environment compromises.

• Why it matters: N-central is a widely deployed remote monitoring and management platform used by MSPs and enterprise IT teams. Exploitation of RMM platforms gives attackers broad, trusted access to managed endpoints — a well-established ransomware and espionage pivot path.

• Who should care: Vulnerability management, SOC, IT operations, security leadership, and any organization whose MSP runs N-able N-central.

• Recommended action: Patch CVE-2026-18577 immediately. If patching cannot be completed today, determine whether N-central instances are internet-exposed and restrict access. Require confirmation of patch status from any MSPs in your supply chain. Review N-central audit logs for anomalous activity.

• Confidence: High — CISA KEV listing with confirmed exploitation.

• Search metadata: CVE-2026-18577, T1190, N-able N-central, N-able, CISA KEV, vulnerability

Intelligence Context

• CISA Adds Exploited N-able N-central Flaw to KEV After Customer Compromises — The Hacker News
  • Context: The Hacker News reports CISA’s KEV addition of CVE-2026-18577 follows real-world exploitation and confirmed compromise of N-able customer environments, elevating urgency beyond routine patching.

APT29/Midnight Blizzard Targets Hotel Wi-Fi to Steal Microsoft 365 Credentials

• What happened: Microsoft attributed a global campaign to Russian state actor Midnight Blizzard (APT29) in which the group deploys custom malware against hospitality Wi-Fi networks to intercept Microsoft 365 credentials from connected users.

• Why it matters: This is a targeted credential harvesting operation against a ubiquitous enterprise platform. Traveling employees — executives, sales, legal, government liaisons — connecting to hotel Wi-Fi are the attack surface. Compromised M365 accounts expose email, SharePoint, Teams, and downstream SaaS integrations.

• Who should care: Identity and access management, SOC, security leadership, any organization with employees who travel regularly.

• Recommended action: Issue a travel advisory requiring VPN use before connecting to any hotel or public Wi-Fi. Review M365 sign-in logs for anomalous authentication events, particularly from unexpected geographies or IP ranges. Confirm that phishing-resistant MFA (e.g., FIDO2) is enforced for M365 access. Evaluate conditional access policies that flag or block authentication from untrusted networks.

• Confidence: High — attributed by Microsoft, active campaign.

• Search metadata: T1557.002, T1556, Midnight Blizzard, APT29, Microsoft 365, hotel Wi-Fi, credential theft, account compromise

Intelligence Context

• Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts — Bleeping Computer
  • Context: Bleeping Computer reports Microsoft directly attributed the hospitality Wi-Fi campaign to Midnight Blizzard (APT29), confirming use of custom malware to intercept M365 credentials at scale.

Social Engineering Surge: DOUBLECUP Malware Campaign and 1,500% Rise in Device Code Phishing

• What happened: Two converging threats define the current social engineering landscape. Russian loader-as-a-service DOUBLECUP uses ClickFix browser lures and PNG steganography to stage and deliver CountLoader and the DeviceManager RAT on Windows systems. Separately, device code phishing attacks increased 1,500% in 2026 and vishing doubled — both techniques are engineered to bypass MFA and leave minimal forensic artifacts.

• Why it matters: These are not incremental phishing evolutions. They represent a deliberate shift toward techniques that circumvent controls organizations have invested heavily in. Device code phishing abuses legitimate OAuth flows; ClickFix manipulates users into executing malicious commands themselves. Both reduce attacker reliance on malware delivery and increase reliance on user action, degrading the effectiveness of endpoint controls.

• Who should care: SOC, endpoint security, email security, identity and access management, help desk, security leadership.

• Recommended action: Confirm whether device code authentication flows are restricted or monitored in your environment. Brief SOC analysts on ClickFix lure patterns and PNG-embedded payload delivery. Verify that user awareness training covers device code phishing scenarios explicitly. Review whether help desk social engineering controls are current.

• Confidence: High (DOUBLECUP campaign); Medium (device code phishing trend data).

• Search metadata: T1566.002, T1027.003, T1598.004, DOUBLECUP, CountLoader, DeviceManager, ClickFix, steganography, device code phishing, vishing, Windows, malware delivery, remote access trojan

Intelligence Context

• DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT — The Hacker News
  • Context: The Hacker News details DOUBLECUP’s multi-stage delivery chain: ClickFix lures trigger browser cache staging of steganographic PNG files, ultimately deploying CountLoader and the previously undocumented DeviceManager RAT.
• Device Code Phishing Up 1,500% in 2026; Vishing Doubles — Dark Reading
  • Context: Dark Reading reports that device code phishing and vishing are specifically designed to bypass entrenched security controls and minimize forensic evidence left behind.

Monitor Only

• Madera Community Hospital disclosed a breach affecting 150,000 individuals after an extortion group stole personal, financial, and medical records — healthcare security and privacy teams should validate data exfiltration controls and incident response readiness. Source: 150,000 Impacted by Madera Community Hospital Data Breach — https://www.securityweek.com/150000-impacted-by-madera-community-hospital-data-breach/

Analyst Observation

Today’s brief reflects a threat environment where attackers are systematically targeting the seams between controls: management plane interfaces that predate modern authentication standards, RMM platforms trusted by design, OAuth flows that MFA doesn’t cover, and physical network access points that endpoint agents can’t see. The convergence of Russian state activity — APT29’s hotel Wi-Fi campaign and DOUBLECUP’s loader service — with commodity exploitation of exposed infrastructure (BMC, N-central) should prompt a hard look at what your perimeter actually is. Patching N-central and removing BMC interfaces from internet exposure are executable today. The rest requires an honest assessment of whether identity and network controls are keeping pace with how attackers are actually operating.

Source Links

• Decades-Old BMC Vulnerability Exposes Thousands of Data Centers to Attacks — https://www.securityweek.com/decades-old-bmc-vulnerability-exposes-thousands-of-data-centers-to-attacks/

• CISA Adds Exploited N-able N-central Flaw to KEV After Customer Compromises — https://thehackernews.com/2026/08/cisa-adds-exploited-n-able-n-central.html

• Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts — https://www.bleepingcomputer.com/news/security/hotel-wi-fi-attacks-use-custom-malware-to-breach-microsoft-365-accounts/

• DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT — https://thehackernews.com/2026/08/doublecup-uses-clickfix-and-cached-pngs.html

• Device Code Phishing Up 1,500% in 2026; Vishing Doubles — https://www.darkreading.com/cybersecurity-analytics/device-code-phishing-vishing-doubles

• 150,000 Impacted by Madera Community Hospital Data Breach — https://www.securityweek.com/150000-impacted-by-madera-community-hospital-data-breach/

Generated by DevSecOpsDadAttack cyber threat intelligence.