# Threat Intel Brief — July 27, 2026

TL;DR

  • Critical Fastjson RCE under active exploitation: CVE-2026-16723 (CVSS 9.0) in Alibaba Fastjson 1.x enables unauthenticated remote code execution in Spring Boot applications; no patch available, only workarounds.
  • Cl0p ransomware targets manufacturing PLM systems: Affiliates exploit CVE-2026-12569 in PTC Windchill for data extortion against aerospace, automotive, and retail sectors.
  • GitLab RCE PoC published: Authenticated users with push access can execute arbitrary commands on self-managed instances ≤18.11.4 via malicious Jupyter notebooks; patch available but not initially classified as security fix.
  • Malvertising campaigns evolve delivery techniques: SourTrade assembles malware client-side in browsers to evade detection; insurance phishing now uses real-time OTP relay to bypass MFA.
  • Gaming and cryptocurrency users targeted: ClickFix distributes cryptominers via Steam forums; fake trading platform sites deliver in-memory malware to crypto investors.

Critical Threats

Fastjson 1.x Remote Code Execution (CVE-2026-16723)

What happened
Alibaba's Fastjson 1.x JSON library contains a critical unauthenticated remote code execution vulnerability actively exploited since at least July 20. The flaw (CVSS 9.0) affects versions 1.2.68 through 1.2.83 deployed in Spring Boot executable fat-JAR configurations. Attackers can execute arbitrary code by sending malicious JSON requests to vulnerable endpoints. ThreatBook and Imperva report active attacks targeting financial services, healthcare, computing, and retail sectors, primarily in the United States. Alibaba has stated no patch will be released for Fastjson 1.x; organizations must migrate to Fastjson2 or implement workarounds.

Impact
Unauthenticated attackers gain Java process-level code execution on affected Spring Boot applications. The vulnerability exploits Fastjson's type-resolution mechanism combined with Spring Boot's fat-JAR loader architecture. Organizations running affected versions face immediate compromise risk with only mitigation options available—no security patch exists. Plain JARs, generic uber-JARs, and WAR deployments are not affected, limiting exposure to a specific deployment pattern, but this configuration is common in production environments.

Recommendations

  • Immediate (0-24h): Inventory all Fastjson dependencies across Java applications; prioritize Spring Boot fat-JAR deployments running versions 1.2.68–1.2.83.
  • Immediate (0-24h): Enable SafeMode with JVM flag -Dfastjson.parser.safeMode=true or switch to com.alibaba:fastjson:1.2.83_noneautotype artifact as temporary mitigation.
  • 24-72h: Monitor affected systems for suspicious @type values in JSON logs, nested JAR URLs, unexpected outbound connections, new child processes, and web shell indicators.
  • This week: Plan migration to Fastjson2 as the permanent solution; implement network-level controls to restrict JSON parsing endpoints from untrusted sources.

Cl0p Ransomware Exploits PTC Windchill (CVE-2026-12569)

What happened
Cl0p ransomware affiliates (also tracked as FIN11, Lace Tempest) are exploiting unauthenticated remote code execution vulnerabilities in internet-exposed PTC Windchill and FlexPLM Product Lifecycle Management systems. Attackers chain a pre-authentication information disclosure flaw in FlexPLM WSDL endpoints with CVE-2026-12569 (CVSS 9.3), a critical server-side vulnerability in Windchill login servlets. Post-exploitation activity includes deployment of hex-named JSP web shells under /Windchill/login/, data staging, and double extortion campaigns targeting manufacturing, automotive, aerospace, and retail organizations.

Impact
PLM systems contain high-value intellectual property, engineering designs, and proprietary product data. Successful exploitation grants attackers full access to sensitive business-critical information suitable for extortion. Cl0p's established pattern of mass exploitation campaigns against enterprise applications poses significant risk to any organization with internet-exposed Windchill or FlexPLM instances. The group's history includes weaponizing zero-days in Accellion FTA, GoAnywhere MFT, and MOVEit Transfer, demonstrating sustained capability and intent.

Recommendations

  • Immediate (0-24h): Patch PTC Windchill and FlexPLM to versions addressing CVE-2026-12569 and the FlexPLM WSDL disclosure flaw; prioritize internet-exposed instances.
  • Immediate (0-24h): Block known malicious IPs at network perimeter: 216.152.148.54, 216.152.151.204, 104.243.35.63, 5.180.41.35.
  • 24-72h: Hunt for hex-named JSP files under /Windchill/login/ directories and review application logs for unusual servlet activity indicating web shell deployment.
  • This week: Implement network segmentation to isolate PLM systems from direct internet exposure; require VPN or zero-trust access controls for remote access.

GitLab Remote Code Execution via Jupyter Notebook Parsing

What happened
Security researcher depthfirst published a working proof-of-concept exploit on July 24 for a GitLab remote code execution vulnerability affecting self-managed instances. The flaw impacts GitLab CE/EE versions 15.2.0–18.10.7, 18.11.0–18.11.4, and 19.0.0–19.0.1. Authenticated users with push access to a project can execute arbitrary commands as the git user by crafting a malicious Jupyter notebook and viewing its commit diff. GitLab patched the vulnerability on June 10 but classified it as a bug fix rather than a security issue, resulting in no CVE assignment or CVSS score—potentially causing security teams to deprioritize patching.

Impact
Attackers with valid credentials and push access gain command execution with access to source code, Rails secrets, service credentials, CI/CD data, and internal services reachable by the GitLab application. The 45-day window between patch availability and public PoC publication has likely passed for most organizations, but the lack of security classification means many instances may remain unpatched. Versions 15.2–18.9 receive no backport and must upgrade to supported release trains. The exploit was built for GitLab 18.11.3 on x86-64; porting to other versions requires effort but the underlying bugs are architecture-agnostic.

Recommendations

  • Immediate (0-24h): Upgrade GitLab self-managed instances to version 18.10.8, 18.11.5, 19.0.2 or later; verify the GitLab version inside the Webservice/Puma container image, not just Helm chart or Operator versions.
  • 24-72h: Audit GitLab access logs for unusual Jupyter notebook (.ipynb) commits or diff views from users with push access since May 2026.
  • This week: Review user accounts with push access; implement least-privilege access controls and repository permissions to limit the pool of authenticated users who could exploit this vulnerability.
  • This week: For installations on unsupported versions (15.2–18.9), plan immediate migration to a supported release train—no backports are available.

Threat Actor Activity

Malvertising Campaigns Target Cryptocurrency and Trading Users

SourTrade is a malvertising campaign operating since late 2024 that impersonates TradingView, Solana, and Luno trading platforms to deliver malware to retail traders across 12 countries in 25 languages. The operation uses a novel client-side assembly technique: landing pages fingerprint visitors to evade researcher detection, then deliver Base64-encoded PE headers and malicious JavaScriptCore bytecode via a /config endpoint. The victim's browser retrieves a legitimate Bun runtime from a secondary domain and combines it with pseudorandom AES-CTR byte streams to assemble a unique executable per session, evading hash-based detection. Earlier iterations used the open-source StreamSaver.js library; current versions embed the streaming architecture directly. Related clusters have delivered JSCEAL/WeevilProxy stealer payloads capable of credential theft and traffic interception.

A separate large-scale malvertising campaign uses fake Solana, Luno, and TradingView webpages with malicious JavaScript to assemble malware directly in browser memory, bypassing traditional antivirus detection. Both campaigns demonstrate evolution in delivery techniques designed to evade signature-based defenses and network inspection.

Defensive priorities: Monitor for ServiceWorker/SharedWorker registrations from unexpected domains; detect /config endpoints returning large Base64 payloads followed by runtime binary fetches; educate users to install trading platforms exclusively from vendor-official websites, never from advertisements.

Insurance Phishing Evolves to Real-Time Account Hijacking

CTM360 research documents a shift in insurance-focused phishing from traditional credential harvesting to real-time account hijacking. Attackers purchase Google Ads to deliver phishing sites that act as live proxies, intercepting and relaying credentials and multi-factor authentication codes to legitimate insurance portals during victim login sessions. The InsureOTP phishing kit enables attackers to bypass MFA by relaying OTP codes in real time, completing account takeover within a single session before detection. Campaigns primarily target Saudi Arabia with additional activity in Europe, the United States, and India. Free hosting platforms (GitHub Pages, Netlify, Hostinger, Wix, Lovable) and randomized domains reduce effectiveness of traditional brand protection tools.

Defensive priorities: Deploy phishing-resistant MFA (FIDO2/WebAuthn) that binds authentication to the legitimate domain; implement behavioral analytics to detect simultaneous logins from disparate geolocations; monitor for unauthorized Google Ads campaigns impersonating your brand.

ClickFix Distributes Cryptominers via Steam Forums

ClickFix threat actors are distributing XMRig cryptominers through Steam discussion forums, disguising malware as fixes for game and computer problems. The campaign exploits user trust in community-driven platforms, targeting gamers who frequently seek peer-provided solutions for technical issues. By positioning malicious content as helpful troubleshooting steps within trusted forum environments, attackers capitalize on users' urgency to resolve gaming problems.

Defensive priorities: Implement user awareness training warning against downloading fixes from unverified forum posts; monitor for XMRig-related process names, unusual CPU utilization spikes, and network connections to known mining pools; deploy application control policies to prevent execution of scripts downloaded from web browsers.

Sextortion Scams Leverage ShinyHunters Breach Data

Unrelated threat actors (not ShinyHunters themselves) are conducting sextortion email campaigns using email addresses from data breaches previously leaked by the ShinyHunters extortion group. Victims include customers of Amtrak, Hallmark, Substack, Betterment, CarGurus, ADT, Panera Bread, and McGraw Hill. The emails falsely claim device compromise and surveillance, demanding $2,000 in Bitcoin. ShinyHunters denied involvement when contacted. The campaign represents secondary victimization where individuals affected by initial data breaches become targets for follow-on fraud by actors who download and weaponize leaked datasets.

Defensive priorities: Implement email filtering rules to detect and quarantine messages containing sextortion keywords combined with Bitcoin wallet addresses; educate users that possession of an email address does not indicate device compromise; proactively notify customers when organizational data breaches are publicly leaked.

Geopolitical Context

The DevMan ransomware-as-a-service operation (tracked as Funky Mantis by PRODAFT) demonstrates increasing professionalization of transnational cybercrime. The group's targeting policy—excluding CIS countries and Serbia while encouraging critical infrastructure attacks—is consistent with threat actors operating from or aligned with Russian-speaking jurisdictions. DevMan's development of specialized SCADA-targeting capabilities designed to cause physical damage represents a concerning escalation, blurring lines between financially motivated cybercrime and potential state-tolerated operations. The operation claimed 184 victims as of February 2026, with nearly 50 in the United States, primarily targeting technology, healthcare, financial services, and government sectors. No new victims have been reported after February 4, 2026, suggesting potential operational pause following a June 2025 doxxing incident that caused affiliate defections. European critical infrastructure entities face elevated risk given the group's SCADA capabilities and exclusion of only CIS-aligned targets.

Recommended Actions

Immediate (0-24 hours)

  • Inventory and patch Fastjson 1.x deployments; enable SafeMode or migrate to Fastjson2 (CVE-2026-16723).
  • Patch PTC Windchill and FlexPLM instances; block Cl0p-associated IPs (CVE-2026-12569).
  • Upgrade GitLab self-managed instances to patched versions (18.10.8, 18.11.5, 19.0.2+).
  • Block known malicious domains associated with fake Solana, Luno, and TradingView sites.

24-72 hours

  • Hunt for indicators of compromise in Fastjson, Windchill, and GitLab environments.
  • Audit GitLab access logs for suspicious Jupyter notebook activity since May 2026.
  • Review insurance portal authentication logs for simultaneous logins from disparate geolocations.
  • Monitor for ServiceWorker registrations and /config endpoints delivering Base64 payloads.

This week

  • Plan Fastjson2 migration as permanent fix; implement network-level controls for JSON endpoints.
  • Implement network segmentation to isolate PLM systems from direct internet exposure.
  • Deploy phishing-resistant MFA (FIDO2/WebAuthn) for high-risk accounts, particularly insurance portals.
  • Educate users on verifying URLs before login and avoiding sponsored search results.
  • Review and restrict GitLab user permissions; implement least-privilege access controls.

Watch List

  • DevMan ransomware: Monitor for resumption of activity following February 2026 operational pause; specialized SCADA locker poses risk to European critical infrastructure.
  • Cl0p affiliates: Continued exploitation of enterprise application vulnerabilities; history includes Accellion FTA, GoAnywhere MFT, MOVEit Transfer, and now PTC Windchill.
  • Malvertising evolution: Client-side malware assembly techniques (SourTrade) and real-time OTP relay (insurance phishing) represent significant defensive challenges requiring behavioral detection.
  • GitLab vulnerability disclosure practices: June 10 patch classified as bug fix rather than security issue; organizations should treat dependency bumps in security-sensitive parsers as potential security fixes.

Sources

  • BleepingComputer: Steam forum ClickFix attacks, malicious sites using JavaScript for in-memory malware, ShinyHunters sextortion scams
  • The Hacker News: Fastjson 1.x RCE (CVE-2026-16723), GitLab RCE PoC, CTM360 insurance phishing research, Cl0p PTC Windchill exploitation (CVE-2026-12569), DevMan RaaS analysis, SourTrade malvertising campaign
  • CISA KEV Catalog: CVE-2026-12569 added June 2026
  • PRODAFT: DevMan/Funky Mantis tracking
  • Confiant: SourTrade campaign analysis with 96 malicious domains and three SHA-256 hashes
  • CTM360: InsureOTP phishing kit research