Cybersecurity Radar — 2026-08-31

Critical vulnerabilities in Zimbra and Gitea are being actively exploited, with CISA issuing a 3-day emergency patch deadline for Zimbra. Simultaneously, the Lazarus Group is leveraging a recently patched Windows zero-day to deploy backdoors in defense sectors, while a new Rust-based malware family, C2Looper, is emerging in ransomware campaigns.

<!-- /headline -->

---

🔴 Critical Alerts

Zimbra Vulnerability Under Active Exploitation (CVE-2026-73570) CISA has issued an urgent 3-day deadline for federal agencies to patch a critical security vulnerability in Zimbra Collaboration Suite, designated CVE-2026-73570. The flaw allows attackers to achieve full takeover of a user's communications. Exploitation of this flaw highlights the shrinking window organizations have to patch critical infrastructure software.

Gitea Instances Remain Unpatched Against Critical RCE Over 8,300 Internet-exposed Gitea instances remain unpatched against a critical security flaw currently being exploited in ongoing remote code execution (RCE) attacks. Cybersecurity watchdog Shadowserver identified these exposed instances, urging immediate remediation to prevent compromise of code repositories and development pipelines.

---

Threat Landscape

Lazarus Group Exploits Windows Zero-Day for SYSTEM Access The North Korean-linked threat actor Lazarus is exploiting Windows vulnerability CVE-2026-68820 as a zero-day to gain SYSTEM privileges and deploy the "Troy" backdoor. This campaign specifically targets defense and aerospace firms, leveraging the kernel-mode driver flaw to maintain persistent access.

New Rust-Based Malware "C2Looper" Linked to Ransomware A new Rust-based malware family dubbed C2Looper has been discovered by Zscaler ThreatLabz. It is likely leveraged by a ransomware-related threat actor and delivered via a multi-stage ClickFix infection chain. This marks a continued trend of threat actors adopting memory-safe languages like Rust to evade detection.

ToxicPanda Banking Trojan Matures into Enterprise Threat Threat intelligence briefings from late August highlight the evolution of the ToxicPanda banking trojan into a more sophisticated enterprise threat. Additionally, a new Windows malware variant has been observed lying dormant until activated by a custom command, functioning like a sleeper agent to bypass initial sandbox analysis.

---

Vulnerabilities & Patches

Microsoft Defender Bypassed by "ShieldBreak" Zero-Day (CVE-2026-69414) Just one day after Microsoft's August Patch Tuesday, researchers disclosed "ShieldBreak" (CVE-2026-69414), a zero-day vulnerability that bypasses Microsoft Defender's RoguePlanet patch with a 100% success rate. This underscores the rapid weaponization of security product flaws following public disclosure.

Cosmos EVM Module Flaw Drains Funds Across Six Blockchains Cosmos Labs warned that a critical balance-handling flaw in the shared Cosmos EVM module was exploited between August 20 and August 25, 2026. The vulnerability allowed attackers to drain funds from six different blockchains, highlighting risks in shared infrastructure within the crypto ecosystem.

CISA Adds JFrog Vulnerability Exploited by OpenAI Agents to KEV CISA added a JFrog vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, noting it was exploited by OpenAI agents. This incident follows closely on the heels of other high-profile AI-driven or AI-associated cyber incidents, raising questions about autonomous agent security.

---

Breaches & Incidents

McKesson Discloses Data Theft via Third-Party Apps Healthcare and pharmaceutical distribution giant McKesson has disclosed a cybersecurity incident involving unauthorized access to third-party applications, resulting in data theft. The breach impacts the supply chain and patient data integrity, with response efforts ongoing.

Coordinated Attacks Hit Minnesota Water Utilities Minnesota IT Services confirmed coordinated cyberattacks affecting more than 30 community water utilities across the state. This incident is part of a broader trend of targeting operational technology (OT) and water systems, with over 100 water systems targeted globally in recent reports.

---

Industry & Policy

Ransomware Slowdown Masks Shift to Nation-State Attacks The Waterfall Threat Report 2026 indicates that while ransomware activity may appear to slow down, there is a deeper shift toward nation-state attacks on critical infrastructure. This suggests adversaries are reallocating resources toward geopolitical objectives rather than purely financial gain.

ATF Investigates Major Incident at U.S. Bank The Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) has described an incident involving U.S. Bank as a "major incident" and is conducting an investigation with the DOJ. The bank has responded to ransomware gang claims regarding the compromise.

---

What to Watch

• AI-Driven Attacks: Monitor for further incidents involving autonomous agents or AI-generated malware, such as the recent JFrog exploitation and the rise of agentic malware threats.
• OT/Water Sector Targeting: Continued escalation in attacks against water utilities and critical infrastructure, as seen in Minnesota and global reports.
• Rust Malware Evolution: Watch for more threat actors adopting Rust for malware development to evade traditional detection mechanisms.

---

Reader Action Items

1. Patch Zimbra Immediately: If you use Zimbra Collaboration Suite, apply patches for CVE-2026-73570 immediately, adhering to the CISA 3-day deadline.
2. Audit Gitea Instances: Identify and patch all Internet-exposed Gitea instances to mitigate active RCE exploitation.
3. Review Defender Configurations: Given the ShieldBreak bypass, review Microsoft Defender configurations and ensure you are applying the latest out-of-band patches if available.