# Threat Intel Brief — July 26, 2026

TL;DR

  • Critical RCE vulnerabilities in Alibaba Fastjson 1.x (CVE-2026-16723) and PTC Windchill (CVE-2026-12569) are under active exploitation with limited or no patches available.
  • Cl0p ransomware affiliates are chaining pre-authentication flaws in PTC Windchill and FlexPLM to conduct data extortion campaigns against manufacturing and aerospace sectors.
  • North Korean APT BlueNoroff deploys AI-enhanced phishing kits that profile cryptocurrency wallets before malware delivery, targeting high-value individuals in the crypto industry.
  • Public exploits released for GitLab RCE, Active Directory Certighost (CVE-2026-54121), and Redis authenticated RCE flaws, significantly lowering exploitation barriers.
  • AI-assisted intrusion documented at Thailand's Ministry of Finance, where attackers deployed autonomous Hermes AI agent for post-exploitation reconnaissance.

---

Critical Threats

Fastjson 1.x RCE Under Active Attack (CVE-2026-16723)

What happened: Alibaba's Fastjson 1.x JSON library (versions 1.2.68–1.2.83) contains a critical unauthenticated remote code execution vulnerability (CVSS 9.0) affecting Spring Boot fat-JAR deployments with SafeMode disabled. Active exploitation has been observed since July 22 targeting financial services, healthcare, computing, and retail sectors, primarily in the United States. No patch is available as of July 25.

Impact: Unauthenticated attackers can execute arbitrary code with Java process privileges by sending malicious JSON requests to vulnerable endpoints. The flaw requires no AutoType enablement and no classpath gadget dependencies, making it broadly exploitable across affected deployments. Proof-of-concept details are publicly disclosed.

Recommendations:

  • Immediate (0–24h): Enable SafeMode on all Fastjson 1.x deployments using JVM flag -Dfastjson.parser.safeMode=true or migrate to artifact com.alibaba:fastjson:1.2.83_noneautotype.
  • Inventory all direct and transitive Fastjson dependencies in Spring Boot applications using Maven or Gradle dependency analysis.
  • Hunt for exploitation indicators: suspicious @type values in JSON logs, nested JAR URLs, unexpected outbound connections, new child processes, and web shells.
  • Plan migration from Fastjson 1.x to Fastjson2, which is not affected by this vulnerability.

---

Cl0p Exploits PTC Windchill for Manufacturing Data Theft (CVE-2026-12569)

What happened: Cl0p ransomware affiliates (also tracked as FIN11, Lace Tempest) are exploiting CVE-2026-12569 (CVSS 9.3), a critical unauthenticated RCE in PTC Windchill and FlexPLM product lifecycle management platforms. Attackers chain this with a pre-authentication information disclosure flaw in FlexPLM WSDL endpoints to conduct data extortion campaigns against manufacturing, automotive, aerospace, and retail sectors.

Impact: Attackers deploy hex-named JSP web shells under /Windchill/login/ directories for persistence, then exfiltrate engineering designs, product specifications, and proprietary manufacturing data. Extortion communications originate from compromised email accounts and are sent to hundreds of users within victim organizations. The campaign targets high-value intellectual property in industries reliant on PLM platforms.

Recommendations:

  • Immediate (0–24h): Patch PTC Windchill to address CVE-2026-12569 following PTC's June 17 security advisory.
  • Block known malicious IPs: 216.152.148.54, 216.152.151.204, 104.243.35.63, 5.180.41.35.
  • Hunt for hex-named JSP files under /Windchill/login/ directories and unusual web shell deployment.
  • Remove direct internet exposure of PTC Windchill and FlexPLM; require VPN or zero-trust access.
  • Monitor for anomalous file system enumeration and large-scale data staging from PLM servers.

---

GitLab RCE Exploit Published for Self-Managed Instances

What happened: A working proof-of-concept exploit was published July 24 for a GitLab remote code execution vulnerability affecting self-managed instances version 18.11.3 and earlier. The flaw allows authenticated users with push access to execute arbitrary commands as the git user by crafting a malicious Jupyter notebook and viewing its commit diff. The underlying vulnerability in the Oj Ruby JSON parser was patched June 10, but GitLab did not classify it as a security fix—no CVE was assigned, and it appeared only as a dependency bump under bug fixes.

Impact: Authenticated users with push access to any project can compromise GitLab servers without admin rights, CI runner access, or victim interaction. Compromise scope includes source code, Rails secrets, service credentials, CI/CD variables, and lateral movement to internal services. Versions 15.2–18.9 receive no backport and must upgrade to supported release trains.

Recommendations:

  • Immediate (0–24h): Upgrade self-managed GitLab to 18.10.8, 18.11.5, or 19.0.2 or later. Prioritize instances with external contributors or untrusted authenticated users.
  • For Helm and Operator deployments, verify the GitLab version inside the Webservice/Puma container image, not the chart version.
  • Review GitLab application logs and git user activity for anomalous Jupyter notebook commits (.ipynb files) and unusual diff rendering requests between May 21 and present.
  • Audit projects with external or low-trust authenticated users who have push access.

---

Redis Patches Authenticated RCE Flaws Across Multiple Versions

What happened: Redis released seven security patches July 23 following researcher disclosure of authenticated remote code execution proof-of-concept exploits affecting versions 6.2.22, 7.2.14, 7.4.9, 8.2.7, 8.4.4, 8.6.4, and 8.8.0. The vulnerabilities involve memory flaws exploitable through RESTORE commands and, depending on version, require additional commands like EVAL, XGROUP, or the RedisBloom module. May 2026 patches (CVE-2026-25243, CVE-2026-25589) were incomplete and remain vulnerable.

Impact: Authenticated attackers with RESTORE privileges can achieve remote code execution on vulnerable Redis servers. Two distinct exploit chains exist: a Streams shared-NACK use-after-free (affects 6.2–8.6) and a RedisBloom TDigest out-of-bounds write (affects 8.8.0). Risk is elevated for Redis instances exposed to untrusted authenticated users or where credential compromise has occurred.

Recommendations:

  • Immediate (0–24h): Upgrade Redis to 6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, 8.6.5, or 8.8.1.
  • Revoke RESTORE command privileges from all Redis accounts that do not strictly require it using ACL rules.
  • Block untrusted network access to Redis ports (default 6379) using firewall rules or network segmentation.
  • Audit Redis ACLs and authentication logs for unauthorized RESTORE, EVAL, XGROUP command usage.

---

Active Directory Certighost Exploit Enables DC Impersonation (CVE-2026-54121)

What happened: Researchers published a working exploit July 24 for Certighost (CVE-2026-54121, CVSS 8.8), a vulnerability in Microsoft Active Directory Certificate Services that allows low-privileged domain users to obtain Domain Controller certificates and authenticate as DC machines. The exploit enables attackers to retrieve the krbtgt secret through DCSync. Microsoft patched the flaw July 14.

Impact: Low-privileged domain users can achieve full domain compromise by impersonating Domain Controllers. Exploitation requires only network access and a standard domain account (no admin rights). Default configurations with ms-DS-MachineAccountQuota of 10 allow attackers to create necessary computer accounts. The vulnerability exploits AD CS enrollment chase fallback mechanism without validation.

Recommendations:

  • Immediate (0–24h): Apply Microsoft July 14, 2026 security updates to all AD CS hosts.
  • If immediate patching is not possible, disable chase fallback using: certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC and restart Certificate Services (test in lab first).
  • Monitor for anomalous certificate enrollment requests from Machine template, especially those targeting Domain Controller identities.
  • Review DCSync activity logs and Domain Controller authentication events for unauthorized replication requests.

---

Threat Actor Activity

BlueNoroff (North Korea) — Cryptocurrency Wallet Profiling Campaign

North Korean APT BlueNoroff is operating an active phishing kit impersonating Zoom and Microsoft Teams to conduct social engineering campaigns against cryptocurrency and technology sector employees. The campaign leverages typosquatted domains and compromised industry contacts to profile cryptocurrency wallets before malware delivery. Attackers enumerate wallet extensions across Chrome, Edge, Brave, Opera, Vivaldi, and Firefox browsers, specifically identifying MetaMask and other crypto wallets. The operation features WebRTC-based webcam streaming for victim profiling, Telegram session hijacking for lateral propagation, and AI-generated deepfake videos to impersonate trusted contacts. Each compromised victim with Telegram access becomes a vector to target their own contacts, creating a self-propagating attack chain within cryptocurrency industry networks.

Defensive actions:

  • Monitor for registry modifications that disable Microsoft Defender or add broad exclusion paths like C:\Users.
  • Detect file enumeration targeting browser extension directories and implement alerts for bulk queries of cryptocurrency wallet extension IDs.
  • Block typosquatted domains impersonating Zoom and Microsoft Teams through DNS filtering.
  • Monitor for PowerShell execution chains that download and execute VBScript payloads accessing Telegram Web session files.
  • Implement WebRTC traffic analysis to detect unauthorized webcam streams to external mediasoup servers.

---

UAC-0099 (Russia-aligned) — Fake Notepad++ Plugin Campaign

Russia-aligned threat group UAC-0099 is distributing a malicious program disguised as a Notepad++ plugin to compromise Windows systems in Ukraine. The campaign uses phishing emails with image attachments containing obfuscated URLs, link shorteners, and file-sharing services for payload delivery. The group employs DLL side-loading through legitimate Notepad++ 8.8.3 to load malicious NppExport.dll plugin, establishes persistence via scheduled tasks executing every three minutes, and deploys BURNYBEAR loader to execute MATCHBOIL.V2, a C#-based second-stage loader. UAC-0099 has previously weaponized WinRAR vulnerabilities and maintains a consistent malware toolkit including LONEPAGE, MATCHWOK, and DRAGSTARE.

Defensive actions:

  • Update WinRAR, 7-Zip, and Notepad++ to latest versions.
  • Monitor for suspicious scheduled tasks executing binaries every 3 minutes (Event ID 4698).
  • Implement DLL side-loading detection by monitoring legitimate applications loading unexpected DLLs from user-writable directories.
  • Block VBScript execution from email attachments and downloads; consider disabling VBScript via Group Policy.

---

Golden Chickens MaaS — Four New Malware Families

Golden Chickens (also known as Venom Spider, TAG-195) malware-as-a-service operators have resurfaced with four new malware families: TinyEgg, ChonkyChicken, a modularized variant, and ChromEggscalator (a modified web browser credential stealer). The operation provides tooling to multiple cybercrime groups including Cobalt Group, Evilnum, and FIN6. TinyEgg provides initial access via ClickFix-style lures with anti-analysis capabilities. ChonkyChicken and its modular variant expand capabilities to include credential theft from browsers, live browser session control via Chrome DevTools Protocol, keylogging, screen capture, clipboard capture, audio capture, network reconnaissance, and persistence management. The modular architecture allows selective on-demand loading of 14 discrete capability modules from C2 infrastructure.

---

SourTrade — Malvertising Campaign Assembles Malware in Browser

SourTrade is a malvertising campaign operating since late 2024 that delivers malware in pieces through browsers, leveraging the legitimate Bun runtime to assemble the final Windows executable. The operation impersonates popular trading platforms including TradingView, Solana, and Luno to target retail traders across 12 countries in 25 languages. The campaign employs sophisticated fingerprinting to evade researcher detection, serving empty pages to suspected analysts while delivering convincing clones to intended targets. The final payload is linked to the JSCEAL/WeevilProxy stealer family with capabilities including credential theft, keylogging, traffic interception, wallet theft, and remote access.

---

Geopolitical Context

AI-Assisted Intrusion at Thailand Ministry of Finance

An attacker deployed the Hermes AI agent on a rented server with safety constraints disabled and directed it against Thailand's Ministry of Finance to conduct post-exploitation activities including reconnaissance for root access and file system enumeration. The operator had already established initial access via unknown means and planted a web shell prior to agent deployment. The agent autonomously executed standard post-exploitation tasks including kernel vulnerability scanning (targeting CVE-2026-31431, CVE-2026-43284, CVE-2026-43500, CVE-2026-43503), privilege escalation enumeration via LinPEAS, and file system crawling of personnel records dating to 2012. Linguistic indicators (Chinese password elements, FOFA API keys) and co-location with ShadowPad and VShell C2 infrastructure point to possible Chinese-speaking operators, though attribution confidence remains low-to-medium. Thailand's national CERT and cybersecurity agency were notified July 15; no public statement or attribution has been issued.

This incident represents an operational milestone in the use of autonomous AI tooling for post-compromise activity within government networks, demonstrating how open-source AI assistants can be weaponized for offensive operations without per-command human approval.

---

Russia-Ukraine Cyber Operations Continue

UAC-0099's campaign reflects Russia's sustained cyber espionage operations against Ukraine, consistent with broader patterns of intelligence collection targeting Ukrainian government and critical infrastructure. Separately, the U.S. government has attributed parallel webmail exploitation campaigns to Laundry Bear (also known as CL-STA-1114, TA488, Void Blizzard), assessing it as "almost certainly" involved in espionage with Russian government backing. Proofpoint tracks related webmail targeting activity as TA458, described as likely a Russian military intelligence operation targeting Ukrainian government and Eastern European military entities across Albania, Greece, Moldova, and Türkiye. The U.S. government assessment notes that Ukrainian targeting serves as both a priority objective and a "test bench for malicious cyber techniques before broader global deployment," suggesting NATO member states face elevated risk from techniques refined in the Ukrainian theater.

---

Recommended Actions

Immediate (0–24 hours)

1. Fastjson 1.x: Enable SafeMode on all deployments using -Dfastjson.parser.safeMode=true or migrate to com.alibaba:fastjson:1.2.83_noneautotype. Hunt for exploitation indicators in JSON logs and web server activity.

2. PTC Windchill/FlexPLM: Apply CVE-2026-12569 patches immediately. Block known malicious IPs (216.152.148.54, 216.152.151.204, 104.243.35.63, 5.180.41.35). Hunt for hex-named JSP web shells under /Windchill/login/ directories.

3. GitLab: Upgrade self-managed instances to 18.10.8, 18.11.5, or 19.0.2 or later. Review logs for anomalous Jupyter notebook commits and diff rendering requests since May 21.

4. Redis: Upgrade to patched versions (6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, 8.6.5, 8.8.1). Revoke RESTORE command privileges from non-essential accounts.

5. Active Directory: Apply Microsoft July 14 security updates for CVE-2026-54121 to all AD CS hosts. Monitor for anomalous certificate enrollment requests targeting Domain Controller identities.

6. Hotel/Conference Wi-Fi: Deploy always-on full-tunnel VPN for traveling employees. Enable encrypted DNS (DNS-over-HTTPS or DNS-over-TLS) in strict mode. Disable Device Code authentication flow in Microsoft Entra ID unless required.

7. Insurance Phishing: Monitor for suspicious Google Ads impersonating insurance brands. Implement session-based risk signals beyond OTP: device fingerprinting, geolocation anomaly detection, behavioral analytics.

Within 24–72 hours

8. NodeBB: Upgrade to version 4.14.2 or later. Test custom themes and plugins after upgrade. Review forum access logs for unauthorized admin dashboard access since May 2026.

9. ChatGPT Workspace Agents: Verify agents are updated to post-June 8, 2026 version. Review all active agents for unauthorized or suspicious agents created before June 8. Audit connector permissions and approval settings.

10. Bing Images (ImageMagick): Audit all internal services using ImageMagick or compatible libraries. Disable ImageMagick delegates in policy.xml. Restrict accepted image formats to raster-only (JPEG, PNG, GIF, WebP).

Within one week

11. Cryptocurrency Sector: Block typosquatted domains impersonating Zoom and Microsoft Teams. Implement WebRTC traffic analysis. Deploy behavioral detection for Telegram session cookie theft. Educate employees on ClickFix-style social engineering.

12. Ukraine/Russia-aligned Threats: Update WinRAR, 7-Zip, Notepad++ to latest versions. Monitor for suspicious scheduled tasks executing every 3 minutes. Implement DLL side-loading detection. Block VBScript execution from email attachments.

13. Hadoop/Hive Deployments: Audit Apache Hadoop HiveServer2 configurations to ensure authentication is set to Kerberos or LDAP rather than default NONE mode. Monitor port 10000 for unauthorized connections and unusual user-defined function installations.

---

Watch List

  • Fastjson 1.x patch availability: Monitor Alibaba security advisories and CISA KEV catalog for patch release timeline.
  • CVE-2026-58593 (NodeBB federation): Separate federation flaw allowing account impersonation with no known fix; monitor NodeBB security advisories.
  • DevMan RaaS: No new victims reported after February 4, 2026; monitor for operational resumption or rebranding.
  • OnTrac data breach: Parcel delivery company investigating network hack; monitor for breach notification details and scope.
  • Microsoft Azure/M365 outage: July 24 outage caused by automated network maintenance bug; no security implications identified.

---

Sources

BleepingComputer, The Hacker News, CERT-UA, Confiant, CTM360, Hunt.io, PRODAFT, ReliaQuest, Sekoia, Zenity Labs, Aikido Security, XBOW, depthfirst, H0j3n, Aniq Fakhrul, Bitdefent, Check Point, WithSecure, Recorded Future, Proofpoint, U.S. Government assessments.