We've got one word for it, and it's usually the wrong one

What it is

UAT-10820's WebDAV-based infection chain delivering the Amatera stealer, disclosed by Cisco Talos after a Ukrainian government incident. The newsletter also rounds up concurrent items: active exploitation of Cisco Secure FMC (CVE-2026-20079, CVE-2026-20316), a ClickFix campaign using Google Visualization API as C2, and the "ShieldCrash" Defender zero-day.

How it works

The attack abuses legitimate infrastructure to evade filtering: BNB Smart Chain is used for bulletproof hosting, and fake CAPTCHA prompts trick users into copy-pasting malicious commands (a ClickFix-style lure). Amatera executes largely in memory, and disguised DLLs are run via rundll32.exe using suspicious ordinal calls. A vulnerable driver is dropped alongside the stealer to kill EDR processes, and NetSupport Manager (legitimate RMM software) is deployed for persistent remote access once EDR is down. Talos assesses with moderate confidence this is opportunistic credential/crypto theft rather than a targeted espionage operation, despite the high-profile initial victim.

The separately-flagged ClickFix/Google Visualization campaign pulls obfuscated JavaScript from a publicly published Google Sheets document and injects it into the victim's browser session to steal cryptocurrency — using Google's own infrastructure as the C2 channel.

Preconditions / Affected

• Amatera chain: requires user interaction with a fake CAPTCHA/verification prompt that gets the victim to execute a command.
• Cisco Secure FMC: CVE-2026-20079 and CVE-2026-20316 are under active exploitation; Cisco has released hotfixes for affected versions.
• ShieldCrash: a Defender zero-day (exploit publicly released by researcher "Nightmare Eclipse") that grants SYSTEM access, surfaced right after September 2026 Patch Tuesday — no vendor fix confirmed in the text.

What to do

• Monitor for unusual WebDAV activity and rundll32.exe executions using suspicious ordinal calls.
• Configure endpoint tools for robust memory scanning, since Amatera runs largely in-memory.
• Educate users against copy-pasting commands from fake verification/CAPTCHA prompts.
• Pull the full IOC list from Talos's dedicated blog post on the Amatera chain.
• Apply Cisco's released hotfixes for CVE-2026-20079 and CVE-2026-20316 on Secure Firewall Management Center immediately, given confirmed active exploitation.
• Treat unexpected traffic to Google Sheets/Visualization API endpoints as a potential C2 indicator.

Caveats

Attribution of the WebDAV chain to UAT-10820 is Talos's own tracking designation, and the "opportunistic vs. targeted" assessment is explicitly stated as moderate confidence, not confirmed. Details on ShieldCrash and the North Korean Linux/HAProxy toolkit are headline-level pointers to external outlets (Bleeping Computer, SecurityWeek), not Talos's own analysis — no patch status is given for ShieldCrash in this text.