hacker-news Aug 10, 2026 · Crawled Aug 10, 2026

⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors

2 IoCs 1 Actors

AI Summary

A zero-day vulnerability in Metabase, a business intelligence platform, is being exploited in the wild, allowing unauthenticated remote attackers to perform SQL injection and gain full administrator access to affected instances. This enables attackers to steal database credentials, exfiltrate data, and modify configurations. The vulnerability has a CVSS score of 10.0 but lacks a CVE identifier. One confirmed victim is Framework. Additionally, Chinese-made Zbtlink routers were found shipping with a factory-installed backdoor that phones home to Chinese C2 servers every 35 seconds, affecting at least 20 models. The backdoor enables remote command execution. Separately, the threat actor UNC6671 is conducting vishing attacks against financial firms, using voice phishing to capture credentials and MFA tokens via adversary-in-the-middle infrastructure, then deploying scripts for data exfiltration from cloud environments.

AI-extracted · verify before operational use

Extracted Entities 1 found

Threat Actor UNC6671 →

Indicators of Compromise 2 extracted

Type	Value	Detail
Domain	registry[.]modelcontextprotocol[.]io	Details →
GitHub Repo	jUXTAPOSITION1/V.A.P.E	Details →

MITRE ATT&CK TTPs 17 techniques

T1003 OS Credential Dumping · Credential Access T1027 Obfuscated Files or Information · Defense Evasion T1059 Command and Scripting Interpreter · Execution T1059.001 PowerShell · Execution T1059.003 Windows Command Shell · Execution T1071.001 Web Protocols · Command And Control T1071.004 DNS · Command And Control T1078 Valid Accounts · Defense Evasion T1190 Exploit Public-Facing Application · Initial Access T1486 Data Encrypted for Impact · Impact T1496 Resource Hijacking · Impact T1530 Data from Cloud Storage · Collection T1531 Account Access Removal · Impact T1555 Credentials from Password Stores · Credential Access T1566 Phishing · Initial Access T1566.002 Spearphishing Link · Initial Access T1611 Escape to Host · Privilege Escalation