Threat Intelligence Brief - Monday, September 21, 2026

Operational threat reporting for defenders who need signal, not noise.

By DevSecOpsDad
Posted on September 21, 2026

Threat Radar

  • Colorado water utilities suffered confirmed OT cyberattacks that changed equipment settings, disabled alarms, and altered pumping cycles — direct physical-process manipulation is now an active, demonstrated threat to U.S. water infrastructure.

  • Three Linux kernel vulnerabilities are being actively exploited in the wild, enabling denial-of-service, memory disclosure, and memory modification; patch windows are effectively closed — treat this as an emergency patching event.

  • North Korean Jade Sleet compromised an Indian IT services provider using FLATROOF and ROOFDECK backdoors, continuing a pattern of targeting developers and smaller providers as stepping stones into larger downstream networks.

  • Supply chain pressure is intensifying on three simultaneous fronts: a nation-state IT provider breach, CrowdSec source code theft via the TanStack attack, and malicious npm packages evading install-time defenses by hiding payloads in runtime behavior.

  • ChainScript RAT is being delivered via ClickFix social engineering lures and uses the Polygon blockchain to rotate C2 endpoints, making traditional domain-based blocking ineffective against this campaign.



Immediate Action Required

  • Linux kernel patching — emergency priority: Three kernel vulnerabilities are confirmed exploited in the wild. Treat this as an emergency patch cycle. Validate patch status across servers, containers, and cloud workloads. Prioritize internet-exposed and privileged Linux systems first.

  • OT/ICS security review for water and critical infrastructure operators: The Colorado attacks confirm adversaries are manipulating physical process controls, not just gaining access. OT security teams must immediately audit remote access paths, verify alarm integrity, and confirm equipment settings match authorized baselines.

  • npm dependency audit — runtime behavior focus: Standard install-script scanning will not catch the indexed-btree campaign. Engineering and AppSec teams must audit npm dependencies for runtime-triggered malicious behavior. Static install-time defenses are insufficient against this technique.

  • Jade Sleet / IT provider supply chain review: Organizations using India-based IT service providers or outsourced development should review those relationships now. Validate that third-party developer access is scoped, monitored, and has no uncontrolled paths into build systems or production environments.



High-Impact Developments

Colorado Water Utilities Hit by OT Cyberattacks — Physical Process Manipulation Confirmed

  • What happened: Attackers targeted operational technology systems at Colorado water utilities, changing equipment settings, disabling remote access and alarms, and altering pumping cycles. This is confirmed, hands-on manipulation of physical processes — not a network intrusion.

  • Why it matters: This is not a data breach — it is direct interference with public safety infrastructure. Disabling alarms while altering pumping cycles creates conditions where harm can occur before operators detect the intrusion. The attack pattern (T1657, T1531) indicates deliberate operational disruption, not reconnaissance.

  • Who should care: OT security teams, critical infrastructure operators, executive leadership at utilities and industrial organizations, and incident response teams with OT capability.

  • Recommended action: Audit all remote access paths into OT environments. Verify current equipment settings against authorized baselines. Confirm alarm systems are functional and have not been tampered with. Review network segmentation between IT and OT. Engage sector-specific ISACs for threat intelligence sharing.

  • Confidence: High — confirmed by officials per SecurityWeek reporting.

  • Search metadata: T1657, T1531, OT systems, water utility, critical infrastructure, operational technology attack, Colorado

Intelligence Context



Three Linux Kernel Vulnerabilities Actively Exploited in the Wild

  • What happened: Three Linux kernel vulnerabilities are confirmed under active exploitation, enabling denial-of-service, memory disclosure, and memory modification. Patches are available and must be treated as emergency deployments.

  • Why it matters: Kernel-level exploitation gives attackers deep system access. Memory disclosure can expose credentials and sensitive data; memory modification enables persistent, stealthy compromise. Linux’s breadth across enterprise infrastructure, cloud, and containerized environments means exposure is likely widespread.

  • Who should care: Infrastructure teams, Linux administrators, SOC and incident response teams, and vulnerability management leads responsible for server and cloud workload patching.

  • Recommended action: Apply available Linux kernel security patches immediately. Prioritize internet-exposed systems, privileged hosts, and systems with access to sensitive data or OT networks. Validate patch deployment across container base images and cloud AMIs, not just bare-metal servers.

  • Confidence: High — active exploitation confirmed per SecurityWeek.

  • Search metadata: T1190, Linux kernel, Linux, denial-of-service, vulnerability exploitation

Intelligence Context



Software Supply Chain Under Simultaneous Pressure: Jade Sleet, CrowdSec, and Malicious npm

  • What happened: Three distinct supply chain incidents are active concurrently. North Korean threat actor Jade Sleet compromised an India-based IT services firm, deploying FLATROOF and ROOFDECK backdoors by targeting developers. CrowdSec confirmed its source code was stolen as a downstream consequence of the May 2026 TanStack supply chain attack. Separately, an ongoing npm campaign using the indexed-btree package hides malicious payloads in runtime behavior rather than installation scripts, bypassing common defenses.

  • Why it matters: A nation-state actor targeting IT providers, a security vendor losing source code through a third-party dependency, and a novel npm evasion technique — all in the same reporting window — confirm that supply chain risk is an active, multi-vector attack surface. Source code theft from a security vendor gives adversaries a roadmap for identifying exploitable weaknesses in that vendor’s products. The npm runtime evasion technique specifically undermines install-time scanning controls that many organizations treat as a primary defense.

  • Who should care: Security leadership, engineering and AppSec teams, supply chain risk owners, developer security programs, and any organization using third-party IT providers or open-source npm packages in their build pipeline.

  • Recommended action: Review and scope third-party developer access, particularly for India-based IT service providers. If CrowdSec is deployed in your environment, monitor vendor communications for follow-on disclosures about product-level impact. Audit npm dependencies with a focus on runtime behavior, not just install scripts. Validate that software composition analysis tooling covers runtime execution, not only static package manifests.

  • Confidence: High across all three incidents — confirmed by The Hacker News, SecurityWeek, and Bleeping Computer respectively.

  • Search metadata: T1195, Jade Sleet, FLATROOF, ROOFDECK, CrowdSec, TanStack, npm, indexed-btree, supply chain attack, North Korea, backdoor deployment, India, IT services

Intelligence Context



ChainScript RAT Deployed via ClickFix Lures with Blockchain-Based C2 Rotation

  • What happened: Threat actors are using ClickFix-style social engineering lures to deliver ChainScript, a previously undocumented RAT. The malware appears under multiple build names — ComponentTask33, UpdateDigital, HostShared, OrchidViolet66 — and masquerades as legitimate applications. It uses the Polygon blockchain to rotate C2 endpoints, complicating blocking and takedown efforts.

  • Why it matters: Blockchain-based C2 infrastructure removes the central domain or IP that defenders typically block; the C2 channel is embedded in a decentralized, censorship-resistant network. ClickFix lures remain effective against end users. Once deployed, ChainScript enables persistent access, credential theft, and lateral movement.

  • Who should care: SOC teams, threat hunters, incident responders, and security awareness program owners. Any organization with a broad end-user population is exposed to the delivery mechanism.

  • Recommended action: Reinforce user awareness around ClickFix-style prompts that instruct users to run commands or install applications. Validate endpoint controls against known ChainScript build names (ComponentTask33, UpdateDigital, HostShared, OrchidViolet66). Assess whether existing network controls can identify or restrict blockchain-based C2 traffic patterns.

  • Confidence: High — active campaign confirmed per The Hacker News.

  • Search metadata: T1566, T1204, ChainScript, ClickFix, Polygon, C2 infrastructure, RAT, remote access trojan, social engineering, ComponentTask33, UpdateDigital, HostShared, OrchidViolet66

Intelligence Context



Monitor Only



Analyst Observation

Today’s brief reflects a threat environment where attackers are operating simultaneously across OT, kernel, supply chain, and endpoint vectors — and succeeding. The Colorado water utility attacks are the most operationally significant item: physical process manipulation at a public utility is no longer a theoretical risk category, and any critical infrastructure operator who has not stress-tested OT remote access controls and alarm integrity should treat this as a forcing function. The supply chain cluster is notable not for any single incident but for the volume — a nation-state actor, a security vendor breach, and a novel npm evasion technique all landing in the same 24-hour window indicates adversaries are finding consistent success in this attack surface. The ChainScript blockchain C2 technique deserves attention from architects: domain and IP blocking as a C2 mitigation has a meaningful gap when the C2 channel lives on a decentralized ledger. Teams relying heavily on that control should assess their exposure.





Generated by DevSecOpsDadAttack cyber threat intelligence.

Tags:  Cyber-Security-News  T1195  T1657  T1531  T1190  T1566  T1204  T1548  T1078  Google  Microsoft  Linux-kernel
DevSecOpsDadAttack!
Share: X (Twitter) LinkedIn