24th August – Threat Intelligence Report

1. Executive summary

Check Point Research's weekly bulletin covers multiple developments relevant to EMEA financial services. The most urgent is an active Cl0p extortion campaign exploiting CVE-2026-12569 (CVSS 9.3 CRITICAL, CISA KEV) in PTC Windchill and FlexPLM, with 40+ organisations already named by the group; attribution to Cl0p is unconfirmed (no MITRE ATT&CK profile in verified reference data). GitLab has issued out-of-band fixes for CVE-2026-19478 (CVSS 9.4 CRITICAL), an unauthenticated code injection in self-managed instances with observed exploitation attempts. Citrix has patched two NetScaler vulnerabilities — CVE-2026-19490 (CVSS 9.3 CRITICAL, SAML authentication bypass) and CVE-2026-19489 (CVSS 8.8 HIGH, buffer overflow DoS) — both absent from CISA KEV. The bulletin also reports a breach at Latvia's CSDD affecting payment records of 1.2 million people, and an autonomous AI agent that exfiltrated Snowflake Jira tokens via a GitHub Actions flaw.

2. Regulatory framing

3. Technical analysis & attack chain

Cl0p campaign exploiting CVE-2026-12569 (PTC Windchill / FlexPLM)

CVE-2026-12569 is rated CVSS 9.3 CRITICAL, is IN CISA KEV (added 2026-06-25), and carries EPSS 41%. NVD classifies it as CWE-20 (Improper Input Validation) and CWE-502 (Deserialization of Untrusted Data). The dual CWE classification indicates the vulnerability involves improper input validation that permits deserialization of untrusted data, a classic remote code execution vector in Java-based enterprise applications.

Attack chain (confirmed steps from source)

1. Initial access — Exploitation of CVE-2026-12569 in internet-facing PTC Windchill or FlexPLM instances. The deserialization flaw allows unauthenticated remote code execution.
2. Credential access — A custom implant is deployed that is capable of decrypting credentials stored within the product lifecycle management environment.
3. Database access — The implant provides direct database access from the compromised host.
4. Data exfiltration — The implant supports bulk data theft from compromised PLM environments.
5. Extortion — Cl0p has publicly named 40+ organisations as victims.

Attribution caveat: The actor "Cl0p" has no MITRE ATT&CK profile in the verified reference data. Attribution is therefore unconfirmed. The campaign details — custom implant, 40+ named victims, extortion methodology — are single-sourced (Check Point Research only); verify before enforcement.

GitLab CVE-2026-19478

CVSS 9.4 CRITICAL, NOT in CISA KEV, EPSS 6%. CWE-94 (Code Injection). Affects self-managed Community and Enterprise editions. Unauthenticated remote attackers can alter or delete public projects and user data. Exploitation attempts were observed after disclosure. The source does not specify affected version ranges or the exact injection vector.

Citrix NetScaler CVE-2026-19490 and CVE-2026-19489

• CVE-2026-19490 — CVSS 9.3 CRITICAL, NOT in CISA KEV, EPSS 0%. CWE-288 (Authentication Bypass Using an Alternate Path or Channel). Unauthenticated attackers can access NetScaler ADC and NetScaler Gateway appliances configured with SAML authentication. The alternate path is the SAML authentication flow itself — attackers bypass primary authentication by abusing an alternate channel in the SAML SSO mechanism.
• CVE-2026-19489 — CVSS 8.8 HIGH, NOT in CISA KEV, EPSS 0%. CWE-120 (Classic Buffer Overflow). Causes denial of service on affected NetScaler appliances.

Cisco Crosswork and Secure Workload (nine critical vulnerabilities)

The source reports nine critical vulnerabilities across Crosswork platforms and Secure Workload software, including six rated CVSS 10.0. The issues span authentication, access-control and file-system weaknesses that could enable unauthorised access or system compromise. No individual CVE identifiers are provided in the source for these nine flaws. Specific CVE IDs, affected versions, and patch identifiers are not available in the source material — consult Cisco's advisory directly.

NASA/JPL AIT-GUI

The source reports a critical vulnerability (CVSS 9.4 per source) in the open-source AMMOS Instrument Toolkit AIT-GUI enabling unauthenticated command execution through its web console — remote command execution, script launches and sequence execution. Fixed in AIT-GUI version 2.5.2. Discrepancy note: The verified reference data does not include a CVE entry for this item, so the CVSS 9.4 figure is source-only and unverified against NVD.

Breach incidents

• Latvia CSDD — Breach of payment records affecting 1.2M+ individuals and 200K organisations. Stolen data: identification numbers, license plates, payment amounts, dates, addresses. Attackers exploited a vulnerability in an internet-facing system. No CVE or actor attributed.
• Sakura Internet — Unauthorised access to rental server environments and a sales management system. Up to 1.36M customer accounts potentially exposed. Attackers accessed hundreds of rental server accounts and installed malware. No malware family named.
• Hospital for Sick Children — Data theft via a third-party application affecting its careers website. Employee, applicant and related-staff data exposed. Clinical systems and patient data unaffected.
• Berlin government — Urban development and mobility ministries isolated from government IT networks following a security breach. Email and internet access disrupted.

AI threats

• Snowflake GitHub Actions — Autonomous AI agent exploited a GitHub Actions flaw in Snowflake's public repository, gaining read access to internal Jira and exfiltrating tokens within seconds. No human steering required. Snowflake patched the workflow and rotated credentials.
• Siemens S7 controllers — US authorities warn of active AI-assisted attacks targeting Siemens S7 industrial controllers. Attackers use AI-generated scripts disguised as monitoring tools and open-source libraries to probe internet-exposed devices, attempting unauthorised configuration changes, operational disruption or equipment damage. Sectors affected: manufacturing, energy, water.
• 'Kriminal' AI platform — Publicly accessible uncensored AI platform offering social engineering and exploit assistance via cryptocurrency subscriptions. Combines Grok, Claude and Llama models. Generates phishing content, malicious code and cybercrime material.

Check Point research outputs

• StopAndProtect campaign — Abuses thousands of compromised WordPress sites for malware distribution and stolen data storage. Combines ransomware with data theft. Uses ClickFix technique to infect visitors. Operational errors exposed logs, screenshots and victim IP addresses.
• BTR.sys driver research — Windows Defender Boot-Time Removal driver (BTR.sys), Microsoft-signed, can be repurposed for privileged file and registry changes during startup. Researchers developed BTR_CLI to craft encrypted tasks. Multiple versions share a hard-coded RC4 key.
• Education sector targeting — Averaged 4,696 weekly attacks per organisation Jan–Jul 2026, up 8%. Education-themed domain registrations and seasonal phishing lures impersonating schools and student reward programs.

4. Mitigation & containment

P1 — within 24 hours

• PTC Windchill / FlexPLM (CVE-2026-12569): This is the only CISA KEV-listed vulnerability in this bulletin with active exploitation by a named extortion campaign. Immediately identify all internet-facing Windchill and FlexPLM instances. If patching is not immediately possible, isolate affected systems from the internet or place behind WAF/IPS with signatures for deserialization attacks. Check Point IPS provides protection: "PTC Multiple Products Remote Code Execution (CVE-2026-12569)." Hunt for the custom implant: search for evidence of credential decryption activity, unusual database access patterns, and bulk data transfers from PLM environments. If compromise is confirmed, activate incident response and prepare for DORA Art. 19 major-incident reporting.
• GitLab (CVE-2026-19478): Apply out-of-band fixes to all self-managed Community and Enterprise instances immediately. Exploitation attempts have been observed post-disclosure. Restrict internet exposure of self-managed instances where feasible until patched. Review audit logs for unauthorised alterations or deletions of public projects and user data.
• Citrix NetScaler (CVE-2026-19490, CVE-2026-19489): Apply Citrix patches to all NetScaler ADC and NetScaler Gateway appliances. For CVE-2026-19490, prioritise appliances configured with SAML authentication — these are the specific attack target. If SAML is configured and patching is delayed, consider temporarily disabling SAML SSO and reverting to local authentication as a containment measure.

P2 — within 72 hours

• Cisco Crosswork / Secure Workload: Identify all deployed Crosswork and Secure Workload products. Apply patches for the nine critical vulnerabilities (six rated CVSS 10.0). The source does not provide individual CVE identifiers — consult Cisco's security advisory directly for patch mapping. Restrict management interface access to internal networks only.
• Sakura Internet tenants: If your organisation uses Sakura Internet as a hosting or cloud provider, contact them to determine whether your rental server environments or customer data are affected. Request forensic confirmation of whether malware was installed on your instances. Review all credentials and keys stored on Sakura-hosted systems and rotate as a precaution.
• AIT-GUI (NASA/JPL): If AMMOS Instrument Toolkit AIT-GUI is deployed, upgrade to version 2.5.2. Restrict web console access to trusted networks.

P3 — within 7 days

• StopAndProtect campaign: Audit WordPress installations for compromise. Check for unauthorised plugins, especially fake WooCommerce plugins. Review web server logs for ClickFix-related traffic patterns. The campaign's operational errors exposed logs, screenshots and victim IPs — monitor threat feeds for leaked victim data.
• BTR.sys hardening: The BTR.sys driver's hard-coded RC4 key across versions means any attacker with BTR_CLI can craft encrypted tasks for privileged file/registry modification at boot. Restrict access to BTR.sys, monitor for its loading outside of legitimate Defender remediation workflows, and alert on any BTR_CLI artefacts.
• AI threat posture: Block access to the 'Kriminal' AI platform at network egress. Review Siemens S7 controller exposure: ensure no S7 controllers are internet-facing, enforce network segmentation between OT and IT networks, and monitor for AI-generated script activity disguised as monitoring tools.
• Education sector lures: If your organisation has education-sector affiliations or staff with .edu addresses, alert users to seasonal phishing lures impersonating schools and student reward programs.

5. Indicators of compromise

No atomic indicators of compromise (IPs, domains, hashes, URLs) are present in the source material.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules. The source material describes behaviours and campaign names but does not provide the specific atomic artefacts (file hashes, distinctive strings, mutex names, command-line flags, registry keys, ransom-note text, or hard-coded values) required to build functional YARA or Sigma rules. The BTR.sys hard-coded RC4 key is referenced but its value is not provided in the source.

CVE assessment

4 referenced CVEs — 1 actively exploited (CISA KEV), 3 critical (CVSS ≥ 9.0)

7. Sources

• Check Point Research, "24th August – Threat Intelligence Report," https://research.checkpoint.com/2026/24th-august-threat-intelligence-report/, 2026-08-24
• Check Point Research, "3rd August – Threat Intelligence Report," https://research.checkpoint.com/2026/3rd-august-threat-intelligence-report/, 2026-08-03
• Check Point Research, "22nd June – Threat Intelligence Report," https://research.checkpoint.com/2026/22nd-june-threat-intelligence-report/, 2026-06-22

8. Adverse Trace position

The dominant risk in this bulletin is the Cl0p extortion campaign exploiting CVE-2026-12569 in PTC Windchill and FlexPLM — it is the only KEV-listed vulnerability with confirmed active exploitation and a named victim cohort of 40+ organisations. EMEA financial services clients with PLM estates (particularly those in retail banking with card/payment product lines, or insurance with product configuration systems) should treat this as a P1 emergency. Attribution to Cl0p is unconfirmed (no MITRE profile in verified data) and the campaign detail is single-sourced from Check Point Research — we will monitor for corroboration from additional vendors or incident responders. GitLab CVE-2026-19478 and Citrix CVE-2026-19490 are both critical, unauthenticated, and have either observed exploitation (GitLab) or a high-impact attack surface (Citrix SAML bypass) — patch both within 24 hours. The Sakura Internet breach engages DORA third-party risk obligations for any client using them as an ICT provider. We will issue a dedicated deep-dive on the Cl0p/Windchill campaign if additional technical detail or IOCs emerge from corroborating sources.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.