Published Sunday, September 06, 2026 at 09:01 AM PT
BLUF: MikroTik routers remain exploited via unauthenticated SSH; REVSTEALER variants now disabling Windows Update and Defender for crypto persistence; Russia escalates rhetoric as Ukraine deploys new radar aircraft to combat operations.
CYBER
• MikroTik routers under active attack via unauthenticated SSH on internet-exposed ports. No patch available; affected devices typically enterprise perimeter infrastructure. Attackers gain full system access without credentials. [The Hacker News] [HIGH CONFIDENCE]
• REVSTEALER-linked modules now disable Windows Update and Windows Defender before deploying crypto miners. Represents phase progression from credential theft to defensive system disablement for persistent undetected access. Affects Windows production hosts. [The Hacker News] [HIGH CONFIDENCE]
• Claude accounts compromised through infostealer malware campaigns; details minimal in available feeds. Suggests either Anthropic credential harvesting or downstream compromise of Claude API users. [Help Net Security] [MODERATE CONFIDENCE]
• CVE-2026-8732 (CVSS 9.8), CVE-2026-6279 (CVSS 9.8), CVE-2025-29927 NextJS (CVSS 9.1) now have public POCs on Sploitus. No reported production exploitation yet; timeline to weaponization estimated 2–4 weeks. [sploitus] [MODERATE CONFIDENCE]
• Berlin city administration data breach: 1.4M files exfiltrated to dark web. Indicative of ransomware/data-extortion campaigns targeting municipal infrastructure; pattern repeats across EU. [news4hackers] [MODERATE CONFIDENCE]
• Windows-disabling malware deployment suggests attackers prioritizing persistence over lateral speed. Implies larger botnet infrastructure or follow-on payload delivery pipeline. [The Hacker News] [MODERATE CONFIDENCE]
MILITARY/GEOPOLITICAL
• Russia’s Foreign Minister Lavrov warns West of “start of real war” following allegations of strikes on Russian territory. Rhetorical escalation ahead of autumn campaign phase. Timing aligns with historical Ukrainian autumn offensives. [Reuters, live news] [HIGH CONFIDENCE]
• Ukraine confirms combat flights of Swedish-supplied Saab 340 AEW&C (ASC 890) radar aircraft. Closes critical ISR gap against Russian air operations; enables distributed targeting discipline. First NATO-standard airborne early warning asset in Ukrainian inventory. [Defence Blog] [HIGH CONFIDENCE]
• Satellite imagery confirms strikes on Millerovo airbase (Rostov Oblast, Russia): two radar systems, ammunition depot damaged. Coordinated targeting suggests improved Ukrainian ISR-to-fires pipeline. [Defence Blog] [HIGH CONFIDENCE]
• Ukraine receives first RCH 155 wheeled howitzers from Germany after years of delay. Adds self-propelled long-range strike capability; complements existing towed artillery. [Defence Blog] [HIGH CONFIDENCE]
• US Marine Corps F-35B squadron deployed to Japan (rotation, not surge). Replaces Hornet squadron. Routine deterrent posture maintenance; no strategic shift. [Defence Blog] [HIGH CONFIDENCE]
• US military now disabling ad trackers military-wide after commercial location data was used to track and target US forces in Middle East. Indicates adversary exploitation of civilian commercial surveillance for targeting intelligence. [Task & Purpose] [HIGH CONFIDENCE]
PHYSICAL/LOCAL
• Greece: F-4 Phantom (Hellenic Air Force) crashed during Athens Flying Week airshow, 05 SEP. No pilot ejection observed. Likely mechanical or pilot-error cause, not hostile action. Under investigation. [The Aviationist] [HIGH CONFIDENCE]
• Southern California: NOSIG. No credible threats to LA-area critical infrastructure detected. Commercial data tracking of deployed US military personnel remains concern; mitigation ongoing. [MODERATE CONFIDENCE]
NUCLEAR/WMD
• NOSIG
ASSESSMENT
Commodity malware is consolidating toward anti-forensics and anti-defense tactics (Windows Update/Defender disablement). This is a phase progression: attackers moving from credential harvest to system hardening for persistence. REVSTEALER variants should be treated as APT-equivalent in behavioral sophistication, if not attribution.
Network perimeter risk is acute: MikroTik SSH flaws affect tens of thousands of US routers with no available patch. Exploitation requires only network access; no user interaction necessary. Prioritize isolation and segmentation of MikroTik devices pending vendor remediation.
Geopolitically, Russia’s escalation rhetoric combined with Ukraine’s new ISR capability (Saab 340 operational) signals a transition to a new conflict phase—likely asymmetric attrition with improved Ukrainian targeting discipline. Lavrov’s warning of “real war” is positioning language for domestic and international audiences; expect intensified Ukrainian strikes and Russian conventional retaliation in September–October timeframe.
KEY JUDGMENTS
MikroTik SSH exploitation and REVSTEALER’s evolution present immediate production risk; Windows Update/Defender disablement is a leading indicator for botnet persistence campaigns targeting enterprise infrastructure. CVE-2026-8732 and CVSS 9.8 siblings will likely see active exploitation within 2–4 weeks; ensure vendor patch readiness before exploitation begins. Russia’s escalation rhetoric and Ukraine’s operational radar aircraft suggest autumn campaign phase transition; monitor INDOPACOM posture for any force rotation changes beyond current F-35B deployment to Japan.
Our own posture, for context:
