hacker-news · Crawled Aug 10, 2026

⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors

2 IoCs 1 Actors
Read original article ↗

AI Summary

A zero-day vulnerability in Metabase, a business intelligence platform, is being exploited in the wild, allowing unauthenticated remote attackers to perform SQL injection and gain full administrator access to affected instances. This enables attackers to steal database credentials, exfiltrate data, and modify configurations. The vulnerability has a CVSS score of 10.0 but lacks a CVE identifier. One confirmed victim is Framework. Additionally, Chinese-made Zbtlink routers were found shipping with a factory-installed backdoor that phones home to Chinese C2 servers every 35 seconds, affecting at least 20 models. The backdoor enables remote command execution. Separately, the threat actor UNC6671 is conducting vishing attacks against financial firms, using voice phishing to capture credentials and MFA tokens via adversary-in-the-middle infrastructure, then deploying scripts for data exfiltration from cloud environments.

AI-extracted · verify before operational use

Extracted Entities 1 found

Threat Actor UNC6671 →

Indicators of Compromise 2 extracted

Type Value Detail
Domain registry[.]modelcontextprotocol[.]io Details →
GitHub Repo jUXTAPOSITION1/V.A.P.E Details →

MITRE ATT&CK TTPs 41 techniques

T1003 OS Credential Dumping · Credential Access T1020 Automated Exfiltration · Exfiltration T1027 Obfuscated Files or Information · Defense Evasion T1059 Command and Scripting Interpreter · Execution T1059.001 PowerShell · Execution T1059.003 Windows Command Shell · Execution T1071.001 Web Protocols · Command And Control T1071.004 DNS · Command And Control T1078 Valid Accounts · Defense Evasion T1078.004 Cloud Accounts · Defense Evasion T1087 Account Discovery · Discovery T1087.003 Email Account · Discovery T1090 Proxy · Command And Control T1090.002 External Proxy · Command And Control T1095 Non-Application Layer Protocol · Command And Control T1105 Ingress Tool Transfer · Command And Control T1110 Brute Force · Credential Access T1110.001 Password Guessing · Credential Access T1114 Email Collection · Collection T1133 External Remote Services · Persistence T1190 Exploit Public-Facing Application · Initial Access T1213 Data from Information Repositories · Collection T1480 Execution Guardrails · Defense Evasion T1482 Domain Trust Discovery · Discovery T1486 Data Encrypted for Impact · Impact T1495 Firmware Corruption · Impact T1496 Resource Hijacking · Impact T1529 System Shutdown/Reboot · Impact T1530 Data from Cloud Storage · Collection T1531 Account Access Removal · Impact T1538 Cloud Service Dashboard · Discovery T1538.001 T1538.001 T1555 Credentials from Password Stores · Credential Access T1566 Phishing · Initial Access T1566.002 Spearphishing Link · Initial Access T1567 Exfiltration Over Web Service · Exfiltration T1567.001 Exfiltration to Code Repository · Exfiltration T1567.002 Exfiltration to Cloud Storage · Exfiltration T1568 Dynamic Resolution · Command And Control T1568.002 Domain Generation Algorithms · Command And Control T1611 Escape to Host · Privilege Escalation