eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
PaperCut Discloses Two Zero-Day Vulnerabilities
Bottom Line: PaperCut disclosed two zero-day vulnerabilities impacting PaperCut NG and PaperCut MF products, which can be chained together to achieve unauthenticated Remote Code Execution (RCE).
On August 27th, 2026, PaperCut Software disclosed two zero-day vulnerabilities impacting its PaperCut NG and PaperCut MF software. The vulnerabilities include:
- CVE-2026-81578 (CVSS: 8.8) - An improper access control vulnerability within the web management interface of PaperCut NG/ MF that can allow an unauthenticated remote attacker to modify “certain system configurations”
- CVE-2026-82078 (CVSS: 9.4) - An unsafe dynamic class loading vulnerability within the database connection utilities of PaperCut NG/ MF that can allow for the execution of arbitrary Java code
PaperCut Software has confirmed that they are aware of “confirmed customer incidents” involving the disclosed vulnerabilities and are investigating “active exploitation”. Emergency patches were released on August 28th to address the flaws in versions 24, 25, and 26 of both PaperCut NG and PaperCut MF. A second patch, referred to as Emergency Patch (Release 2), was published several hours later which includes “additional hardening”. Further mitigation steps include restricting access to Internet-accessible PaperCut NG/ MF Application Servers to trusted IP addresses only using firewall rules and network access controls.
The advisory also includes investigation guidance steps, stating that organizations should review for suspicious activity from the PaperCut Application Server, investigate missing, unexpectedly truncated, or deleted PaperCut server log files, and review relevant log files for specific indicators. PaperCut states that they will publish “validated” Indicators of Compromise (IoCs) and further guidance as they become available.
eSentire Threat Intelligence Analysis:
PaperCut specifically thanks both Huntress and watchTowr Labs within the advisory. Huntress published a blog on the vulnerabilities on August 28th, calling out that they had observed exploitation as early as August 26th. watchTowr Labs posted that they were working with PaperCut to resolve “bypasses” in the initial patches, suggesting that they were potentially ineffective, and led to Emergency Patch (Release 2) to fully mitigate the flaw.
Details on CVE-2026-82078 indicate that an attacker must “manipulate system configuration parameters” to enable RCE, while exploitation of CVE-2026-81578 can lead to unauthenticated attackers modifying system configurations. This would suggest that the two vulnerabilities can be chained together in an exploit to allow for unauthenticated RCE, highlighting the critical severity of the flaws. Within their analysis, Huntress indicated that they were able to develop a working Proof-of-Concept (PoC), but do not appear to have published it. Based on this information, it is likely that other researchers or threat actors may also be able to develop a PoC for the exploit chain, potentially using patch diffing techniques or the assistance of AI. As vulnerabilities impacting PaperCut have a history of being targeted within attacks, with examples including Iranian APTs and ransomware actors, impacted organizations should ensure that all relevant patches are applied as soon as possible.
eSentire has published an advisory addressing CVE-2026-82078 and CVE-2026-81578 on August 28th, and eSentire's Threat Response Unit (TRU) is continuing to track these flaws for additional information and detection opportunities.
Disclosure of Log4j2 Deserialization Flaw
Bottom Line: Security researchers disclosed a deserialization flaw within Apache Log4j2, which could lead to Remote Code Execution (RCE).
On August 26th, 2026, a containerized lab was published on GitHub to reproduce an Apache Log4j2 vulnerability that can allow an attacker to bypass a deserialization allowlist and execute arbitrary code. The vulnerability does not have a CVE identifier and is tracked as Log4j2 #4255. The flaw impacts Log4j2’s FilteredObjectInputStream (FOIS), that provides an allowlist intended to restrict Java deserialization. Exploitation of the flaw, which requires a non-standard configuration, can enable attacker-controlled serialized objects to bypass intended deserialized restrictions, leading to possible Remote Code Execution (RCE).
On August 27th, a Log4j maintainer responded to a GitHub thread, explaining that this issue is not a vulnerability, but a known “non-finding”. It was noted that the configuration required to exploit the flaw would still lead to “remote code execution with or without this allowlist entry”, as deserialization of untrusted data is “an inherently dangerous configuration”. As Log4j2 #4255 was confirmed to not be related to a widely exploitable flaw, its criticality has been reduced.
eSentire Threat Intelligence Analysis:
The researcher emphasizes that this is not a universal vulnerability comparable to Log4Shell. Instead, exploitation depends on a specific deployment scenario in which an application accepts serialized Log4j LogEvent objects through a FOIS-protected receiver and contains a compatible deserialization gadget chain on its classpath.
Since the original disclosure by U-Sec and the publication of the reproduction lab by dinosn, additional technical research has emerged. Most notably, researcher joanbono released log4j2-4255-exploit, a repository containing exploit and validation materials for Log4j2 Issue #4255. The repository describes the issue as an unauthenticated Java deserialization vulnerability affecting services that process serialized Log4j LogEvent objects through FilteredObjectInputStream (FOIS) and includes exploitation, laboratory, and detection-related resources. This activity indicates growing community interest in reproducing, validating, and assessing the exploitability of the reported vulnerability.
Organizations using serialized Log4j event receivers should assess their exposure as a priority and implement mitigations where necessary while monitoring the upstream project for official remediation guidance. In response to the release of this report, eSentire's Threat Intelligence team is actively tracking this topic for additional details and detection opportunities.
DOJ/FBI Disruption of PRC-Linked QTFY Infrastructure (QScan & QTRouter)
Bottom Line: The Justice Department and FBI announced court-authorized domain seizures disabling QScan and QTRouter, two complementary hacking platforms operated by PRC state-sponsored group QTFY, used to compromise IoT devices worldwide and build an obfuscation network concealing intrusions against U.S. critical infrastructure.
On August 26th, 2026, the Justice Department and FBI announced court-authorized domain seizures disabling two complementary hacking platforms, QScan and QTRouter, used to target U.S. critical infrastructure and other sensitive networks. Court documents unsealed in the Southern District of California identify a People’s Republic of China (PRC) state-sponsored group, tracked as QTFY and employed by China-based Nanjing Xinjiuwei Network Technology Company, as the creator and operator of both platforms. Confirmed victims of QTFY intrusion activity include NASA, the Federal Reserve, the Department of Energy, the Department of Justice, the Department of Health and Human Services, the National Institutes of Health, and the U.S. Senate.
According to court documents, QTFY offers hacking-as-a-service to paying customers, including China’s Ministry of State Security (MSS) and the People’s Liberation Army (PLA). QScan and QTRouter work in tandem: QScan scans for and automatically infects thousands of Internet-of-Things (IoT) devices worldwide, adding them to the QTRouter network of QTFY-controlled devices, commercial proxy service devices, and leased virtual private servers. QTRouter then functions as an obfuscation network, allowing QTFY and other malicious cyber actors to conceal the PRC origin of their intrusion activity by routing malicious communications through compromised devices located outside China, and in some cases, in physical proximity to the targeted network itself. Because the seized domains were hardcoded into both the QScan and QTRouter malware for essential functions including communication and authentication, the seizures rendered both platforms inoperable.
eSentire Threat Intelligence Analysis:
The disruption is significant because QScan and QTRouter formed a sophisticated ecosystem used to compromise internet-connected devices and obscure the true origin of malicious cyber activity. The targeting of U.S. government agencies and critical infrastructure entities suggests that the infrastructure was intended to support strategic intelligence collection, network access operations, and potentially future disruptive activities. The selection of victims spanning government, research, regulatory, and healthcare sectors indicates a broad intelligence requirement rather than opportunistic cybercrime.
The operation underscores the growing role of IoT devices in state-sponsored cyber campaigns. IoT devices remain attractive targets for adversaries seeking to establish botnets and proxy networks. Organizations, particularly those in critical infrastructure, government-adjacent, and IoT-heavy environments, should review the newly published FBI/NSA joint advisory and Black Lotus Labs’ TTP analysis for Indicators of Compromise (IoCs), and audit IoT devices on their networks for signs of compromise consistent with QScan’s infection methodology. Identified indicators should be treated as a starting point for a broader compromise assessment. eSentire's Threat Intelligence team is actively tracking this topic for additional details and detection opportunities.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
