Weekly Threat Bulletin – September 2nd, 2026

QTFY Threat Group Exploits Log4Shell, Ivanti, and BeyondTrust Vulnerabilities Using QTRouter and OpenWrt

Joint Cybersecurity Advisory JCSA-20260826-01, issued by the FBI, NSA, and CNMF, details the ongoing operations of the China-linked threat group QTFY (also known as QT or QTCYBER), which is associated with Nanjing Xinjiuwei Network Technology Co. Active since 2018, the group targets critical infrastructure, government, and defense sectors globally using three proprietary platforms: QScan, a high-volume distributed vulnerability scanning and exploitation pipeline; QTRouter, an obfuscation network that routes malicious traffic through compromised OpenWrt routers and commercial residential proxies like Fastlink; and various botnet management systems that enroll compromised IoT devices as proxy nodes. QTFY's initial access strategy relies on exploiting public-facing applications, leveraging a database of over 200 exploits targeting vulnerabilities such as Log4Shell (CVE-2021-44228), Ivanti CSA zero-days (CVE-2024-8190, CVE-2024-8963, CVE-2024-9380), and BeyondTrust Remote Support (CVE-2026-1731). Because QTRouter blends malicious commands with legitimate residential and commercial proxy traffic, defenders must vet associated indicators of compromise before implementing broad IP blocking to avoid collateral disruption, while prioritizing the patching of edge devices and monitoring for persistent web shells.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Immediately patch all internet-facing Ivanti Cloud Services Appliance (CSA) instances against CVE-2024-8190, CVE-2024-8963, and CVE-2024-9380.
• Immediately patch all internet-facing Check Point Quantum Gateway devices against CVE-2024-24919.
• Immediately patch all internet-facing BeyondTrust Remote Support (RS) instances against CVE-2026-1731.
• Immediately patch all internet-facing CrushFTP servers against CVE-2025-31161.
• Immediately identify and patch all systems vulnerable to Log4Shell (CVE-2021-44228) by updating Apache Log4j libraries to the latest secure version.
• Immediately patch all internet-facing Atlassian Confluence servers against CVE-2023-22515.
• Immediately patch all internet-facing Pulse Secure VPN appliances against CVE-2019-11510.
• Immediately patch all internet-facing Fortinet FortiOS SSL VPN devices against CVE-2018-13379.
• Immediately patch all internet-facing Citrix Application Delivery Controller (ADC) and Gateway appliances against CVE-2019-19781.
• Immediately patch all Microsoft Exchange servers against the ProxyLogon vulnerability (CVE-2021-26855).
• Immediately patch all F5 BIG-IP appliances against CVE-2020-5902.
• Immediately patch all web servers running Kentico CMS against CVE-2019-10068.
• Download the IOCs from the 'QTFY_IOC_Files.csv' and 'QTFY_IOC_Infrastructure.csv' files mentioned in the advisory and conduct a retrospective search in SIEM, firewall, proxy, and DNS logs for any matches. Investigate all hits before implementing any blocking rules.
• Perform an immediate scan of all internet-facing web servers, especially those running Content Management Systems (CMS), for the presence of web shells or other unauthorized scripts.

Compliance Best Practices

• Develop and implement a network segmentation strategy based on Zero Trust principles to isolate critical internal systems from internet-facing edge devices and services.
• Establish a formal asset lifecycle management program to identify, track, and create a replacement plan for all hardware and software that is approaching or has passed its End-of-Life (EOL) or End-of-Support (EOS) date.
• Configure security monitoring tools to baseline normal traffic patterns and create alerts for anomalous authentication activity originating from commercial proxy services, residential IP ranges, and cloud providers like Alibaba Cloud.
• Implement monitoring on network devices, including IoT and SOHO routers, to detect unauthorized outbound connections, SOCKS5 proxy behavior, or the presence of tools like Clash.
• Implement a recurring security audit process for all public-facing web applications to identify and remove exposed secrets, API keys, tokens, and sensitive configuration details.
• Implement an automated patch management system for operating systems and third-party applications on servers and endpoints to reduce the time window between vulnerability disclosure and patch deployment.

PaperCut NG and MF Facing Active Zero-Day Exploitation

PaperCut has issued an urgent warning regarding the active zero-day exploitation of a vulnerability affecting all versions of its PaperCut NG and PaperCut MF print management software. In response to confirmed customer compromises, emergency patches have been released for public-facing PaperCut NG/MF application servers, and administrators are urged to immediately restrict web interface access to trusted IP addresses using firewalls or network access controls. Identified indicators of compromise (IOCs) include suspicious activity originating from the legitimate `pc-app.exe` process, modified or missing `server.log` files, and specific log errors such as "ERROR No suitable driver found for jdbc:no:x" and "ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST". Although details regarding the threat actors and post-exploitation activities remain undisclosed, historical precedents with prior PaperCut flaws like CVE-2023-27350 show a pattern of exploitation by ransomware groups, including Clop, LockBit, and Bl00dy, as well as state-sponsored actors for initial network access.

Severity: High

Threat Details and IOCs

Mitigation Advice

• Apply the emergency patches for PaperCut NG and PaperCut MF to all servers immediately, prioritizing those exposed to the internet.
• Use firewall rules or network access controls to immediately restrict all access to PaperCut Application Server web interfaces, allowing connections only from explicitly trusted internal IP addresses.
• Scan all PaperCut server.log files for the specific error messages 'ERROR No suitable driver found for jdbc:no:x' and 'ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST' to identify potential compromise.
• Investigate PaperCut servers for signs of compromise by checking file integrity of server.log files and analyzing process monitoring logs for any anomalous activity associated with the pc-app.exe process.

Compliance Best Practices

• Re-architect network access to eliminate all direct internet exposure for PaperCut servers, mandating that all administrative access occurs via a secure solution like a VPN with multi-factor authentication.
• Implement network segmentation to isolate print management servers from the broader corporate network, strictly limiting their communication paths to only what is required for their function and preventing access to critical assets like domain controllers and databases.
• Configure PaperCut servers to forward application and system logs to a central SIEM and create automated detection rules to generate alerts for the specific IOCs mentioned in the advisory and other suspicious activities.
• Formally classify PaperCut servers as critical assets within the vulnerability management program, subjecting them to more frequent automated scanning and a stricter patching SLA.

CVE-2026-31431 'Copy-Fail' Local Privilege Escalation in Linux Kernel

CVE-2026-31431, also known as "Copy-Fail," is a high-severity local privilege escalation vulnerability (CVSS 7.8) residing in the Linux kernel's `algif_aead` module, which implements the AEAD (Authenticated Encryption with Associated Data) interface within the `AF_ALG` socket family. The vulnerability is caused by an out-of-bounds write that occurs during `sendmsg()` and `recvmsg()` operations when the output buffer is smaller than expected; specifically, the kernel executes a `copy_to_user` operation via `algif_aead_copy_sgl()` and `sg_copy_to_buffer()` without properly validating the buffer size, allowing an unprivileged local attacker to overwrite adjacent kernel heap structures and escalate privileges to root. This flaw affects Linux kernel versions prior to 5.10.254, 5.15.204, 6.1.170, 6.6.137, 6.12.85, 6.18.22, 6.19.12, and 7.0, with active exploitation demonstrated on systems running vulnerable branches such as kernel 6.2.x. Remediation requires upgrading to a patched kernel version, though immediate mitigations include blacklisting the `algif_aead` module, disabling unprivileged user namespaces by setting ``kernel.unprivileged_userns_clone=0`,` or restricting `AF_ALG` socket creation using AppArmor policies.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Identify all Linux systems running vulnerable kernel versions (e.g., < 5.10.254, < 5.15.204, < 6.1.170) and apply the latest kernel security updates provided by your distribution vendor using commands like `sudo apt update && sudo apt dist-upgrade` or `sudo dnf update`.
• On systems that cannot be immediately patched, prevent the vulnerable `algif_aead` module from loading by adding it to the modprobe blacklist. Execute `echo "blacklist algif_aead" | sudo tee /etc/modprobe.d/blacklist-algif-aead.conf`, then run `sudo update-initramfs -u` and reboot the system as soon as a maintenance window is available.
• On systems where it will not break critical functionality (e.g., Docker), disable unprivileged user namespaces by running `sudo sysctl -w kernel.unprivileged_userns_clone=0`. To make this change persistent across reboots, add `kernel.unprivileged_userns_clone=0` to a configuration file in `/etc/sysctl.d/`.
• For systems using AppArmor, update the profiles for at-risk services, such as web servers running as `www-data`, to explicitly deny access to the `AF_ALG` socket family. Add the rule `deny network af_alg,` to the relevant AppArmor profile and reload it using `sudo apparmor_parser -r /etc/apparmor.d/<profile_name>`.
• Run vulnerability scans or manual checks across all Linux assets to identify systems with vulnerable kernel versions and the loaded `algif_aead` module. Use the commands `uname -r` and `lsmod | grep algif_aead` to confirm exposure on individual hosts.

Compliance Best Practices

• Establish a formal patch management policy and program that defines schedules for testing and deploying kernel and operating system security updates. Ensure the program includes a comprehensive asset inventory to track all Linux kernel versions in the environment.
• Conduct a comprehensive review of all user and service accounts on Linux systems to enforce the principle of least privilege. Remove unnecessary permissions, disable interactive shell access for service accounts where not required, and limit their access to only essential files and directories.
• Develop and deploy a comprehensive Mandatory Access Control (MAC) security policy using AppArmor or SELinux. Create default-deny profiles for all internet-facing services and critical applications to restrict their system call access and limit the impact of a potential compromise.
• Configure endpoint security tools (e.g., EDR) or system auditing (e.g., auditd) to monitor for and alert on anomalous usage of the `AF_ALG` socket interface, especially from unexpected processes like web servers or common user shells. Forward these logs to a SIEM for correlation and alerting.

GPUThor Rowhammer Exploit Bypasses ECC on NVIDIA Ampere GPUs for Root Access

Researchers at the University of Toronto have developed a new Rowhammer-class exploit called GPUThor that successfully bypasses Error-Correcting Code (ECC) and Target Row Refresh (TRR) protections on Ampere-generation NVIDIA GPUs equipped with GDDR6 memory, including the RTX A4000, RTX A4500, RTX A5000, and RTX A6000. By restructuring memory request sequences to align with the GPU's memory controller operations, GPUThor achieves memory corruption significantly faster than previous techniques, producing between 72,000 and 377,000 bit flips per gigabyte and locating exploitable faults in approximately 1.1 minutes compared to the 21.9 hours required by GPUHammer. Even with ECC enabled, the attack triggered 387 uncorrectable double-bit faults and two triple-bit errors, and it successfully demonstrated a denial-of-service condition on the RTX A6000. Furthermore, by corrupting the GPU's page tables, an unprivileged program running on the CUDA platform gained arbitrary memory access and escalated privileges to open a root shell on the host system. In response, NVIDIA recommends enabling memory error correction alongside hardware-based direct memory access isolation, monitoring for GPU errors, and restricting untrusted workloads, while researchers advise against sharing a single GPU across multiple tenants in cloud environments.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Inventory all systems to identify NVIDIA Ampere-generation graphics cards with GDDR6 memory, specifically the RTX A4000, RTX A4500, RTX A5000, and RTX A6000 models.
• On systems with affected NVIDIA GPUs, enable hardware-based Direct Memory Access (DMA) isolation, such as IOMMU or VT-d, in the system's UEFI/BIOS settings.
• Verify that memory Error-Correcting Code (ECC) is enabled on all identified vulnerable NVIDIA GPUs and their host systems.
• Configure system monitoring and alerting to detect and report GPU errors, specifically focusing on uncorrectable ECC errors and unexpected GPU resets on systems with affected NVIDIA cards.
• Immediately review and restrict the execution of untrusted or unnecessary applications, especially those utilizing the CUDA platform, on workstations equipped with the affected NVIDIA GPUs.

Compliance Best Practices

• Develop and implement a formal policy that prohibits sharing a single physical GPU among multiple users or virtual machines (multi-tenancy), especially in environments handling sensitive data.
• Implement a comprehensive application control solution, such as application whitelisting, on high-risk workstations to ensure only approved, signed, and vetted software can execute.
• Incorporate the GPUThor vulnerability findings into the hardware lifecycle and procurement process, prioritizing GPUs with more robust hardware-level protections for future purchases, especially for multi-user or high-security workloads.
• Integrate GPU-specific error logs into the central Security Information and Event Management (SIEM) system and tune Endpoint Detection and Response (EDR) rules to correlate GPU faults with suspicious process activity on the host system.

AuraStealer, ACRStealer, and Remus Stealer Show Malware-as-a-Service Trend, With Remus Using Ethereum for C2

The rise of malware-as-a-service (MaaS) has significantly lowered the barrier to entry for cybercriminals, driving the proliferation of sophisticated infostealers that target credentials, session tokens, and cryptocurrency wallets. Recent threat intelligence highlights three active infostealer families: AuraStealer, ACRStealer (also known as Amatera), and Remus Stealer. AuraStealer, which emerged in July 2025, recently integrated virtualization techniques in summer 2026 to obfuscate its code, increasing its file size from under 1 MB to 10 MB. ACRStealer, active since 2018, underwent a rebranding and technical alignment with the Amatera family following a brief hiatus in 2024. Remus Stealer, emerging in early 2026, functions as a 64-bit variant of LummaStealer, sharing its string obfuscation and application-bound encryption override methods, but distinguishing itself by utilizing Etherhiding via Ethereum smart contracts for command-and-control communications. These threats are primarily distributed through social engineering vectors such as ClickFix, ClearFake, and search engine optimization (SEO) poisoning campaigns, which trick users into executing malicious payloads.

Severity: High

Threat Details and IOCs

Mitigation Advice

• Add all file hashes listed in the article for AuraStealer, ACRStealer/Amatera, and Remus Stealer to your Endpoint Detection and Response (EDR) and antivirus (AV) blocklists.
• Block all domains, URLs, and IP addresses listed as Indicators of Compromise in the article at the network perimeter using the corporate firewall and web proxy.
• Query SIEM and EDR logs for any historical or current activity matching the file hashes, domains, URLs, and IP addresses provided for AuraStealer, ACRStealer, and Remus Stealer.
• Add all domains listed as Indicators of Compromise for AuraStealer, ACRStealer, and Remus Stealer to your DNS blocklist or sinkhole.

Compliance Best Practices

• Develop and implement a recurring security awareness training program that educates users on identifying and reporting social engineering attacks, including fake software updates, malicious search results, and prompts to run scripts.
• Implement and enforce a policy via Group Policy (GPO) or Mobile Device Management (MDM) to prevent web browsers from saving user passwords and credentials.
• Deploy PowerShell Constrained Language Mode and enable script block logging across all endpoints to restrict the execution of unauthorized scripts and improve visibility into command-line activity.
• Configure network firewalls to enforce an egress filtering policy that denies all outbound traffic by default and only allows connections to known-good destinations on expected ports and protocols.
• Tune your Endpoint Detection and Response (EDR) solution to create alerts for suspicious behavioral patterns like process injection, process hollowing, and attempts by non-browser processes to access browser data stores.
• Implement a web content filtering solution to block user access to high-risk website categories, including newly registered domains, malvertising networks, and sites with poor reputation.