# Threat Intel Brief — August 19, 2026

TL;DR

  • Critical Windows IKE vulnerability (CVE-2026-33824) actively exploited for unauthenticated RCE; CISA mandates federal patching within three days.
  • Medusa ransomware has breached over 500 U.S. critical infrastructure organizations since 2021, targeting healthcare, defense, and government sectors.
  • Clop gang deploys custom web shell exploiting PTC Windchill (CVE-2026-12569) to decrypt credentials and exfiltrate engineering data from PLM systems.
  • Four critical flaws added to CISA KEV catalog: macOS Screen Sharing (CVE-2026-65400), SharePoint, vCenter, and IKE—exploited by suspected China-nexus APT groups.
  • Password spraying attacks surge 155x in H1 2026, exploiting MFA policy gaps and legacy OAuth flows to compromise Azure/Entra accounts.

Critical Threats

Windows IKE Extension RCE (CVE-2026-33824)

What happened: A critical remote code execution vulnerability in the Windows Internet Key Exchange (IKE) Service Extensions component is under active exploitation. The flaw affects all supported Windows 10, Windows 11, and Windows Server versions, allowing unauthenticated attackers to execute arbitrary code by sending specially crafted packets to UDP ports 500 or 4500. CISA added CVE-2026-33824 to its Known Exploited Vulnerabilities catalog on August 19, 2026, with a three-day remediation deadline for federal agencies under Binding Operational Directive 26-04.

Impact: Successful exploitation grants attackers complete system compromise with SYSTEM-level privileges, enabling ransomware deployment, credential theft, and persistent backdoor installation. The vulnerability requires no user interaction and no prior authentication, making it exploitable from any network position with access to IKE-enabled Windows systems. Organizations with internet-facing or DMZ-hosted Windows infrastructure face immediate risk.

Recommendations:

  • Apply Microsoft's April 2026 Patch Tuesday updates immediately for all Windows 10, 11, and Server systems.
  • Block inbound UDP ports 500 and 4500 at perimeter firewalls on systems not requiring IKE/IPsec functionality.
  • For systems requiring IKE, restrict UDP 500/4500 access to known, trusted peer IP addresses via firewall rules.
  • Monitor network logs for unusual traffic patterns on UDP 500/4500, particularly malformed IKE packets or connections from unexpected sources.

---

Medusa Ransomware Campaign Against U.S. Critical Infrastructure

What happened: The FBI and CISA confirmed that the Medusa ransomware gang has compromised over 500 critical infrastructure organizations in the United States since June 2021. The operation evolved from a closed ransomware variant into a Ransomware-as-a-Service (RaaS) platform in 2023, recruiting initial access brokers and adopting double-extortion tactics via the Medusa Blog leak site. Targeted sectors include Healthcare and Public Health, Defense Industrial Base, Critical Manufacturing, Government Services, Information Technology, and Financial Services.

Impact: The campaign represents sustained degradation of U.S. critical infrastructure resilience, with victim counts increasing from 300 in March 2025 to over 500 by April 2026. Double-extortion tactics combine data theft with encryption, pressuring victims to pay ransoms to prevent public disclosure of sensitive information. The affiliate model enables diverse initial access capabilities across multiple industries, complicating attribution and defense.

Recommendations:

  • Implement rigorous patch management to address security vulnerabilities in operating systems, software, and firmware exploited by Medusa affiliates.
  • Deploy network segmentation to restrict lateral movement and contain ransomware deployment to isolated zones.
  • Enforce multi-factor authentication (MFA) across all remote access points to mitigate credential abuse.
  • Establish data loss prevention (DLP) and egress filtering to detect large-scale data exfiltration attempts.
  • Block untrusted origins from accessing remote services on internal systems to reduce initial access broker entry points.

---

Clop Web Shell Targets PTC Windchill PLM Systems

What happened: The Clop ransomware gang deployed a custom JavaServer Pages (JSP) web shell following exploitation of CVE-2026-12569, a critical remote code execution vulnerability in PTC Windchill and FlexPLM servers. The web shell decrypts Windchill keystore credentials, LDAP manager passwords, and enumerates file vaults to map sensitive engineering data. Attribution is confirmed by Ransom-ISAC, eCrime.ch, and Defused based on extortion emails and infrastructure overlap.

Impact: Compromise enables immediate credential theft and mass exfiltration of proprietary engineering data, product designs, and intellectual property without additional tooling. Stolen LDAP credentials can pivot to Active Directory, email, VPN, and other enterprise services, escalating a single application breach to domain-wide compromise. High risk for manufacturing, aerospace, automotive, and sectors using PLM systems.

Recommendations:

  • Immediately patch PTC Windchill and FlexPLM to address CVE-2026-12569 per vendor advisory.
  • Hunt for JSP web shells in Windchill web directories; search for files containing strings 'Clop', 'ieStructProperties.txt', or commands 'S', 'E', 'L', 'J', 'D', 'G', 'R'.
  • Review Windchill application logs for anomalous credential decryption or vault enumeration activity.
  • Reset all LDAP manager passwords, Windchill administrative credentials, and object storage keys if compromise is suspected.
  • Isolate Windchill/FlexPLM servers from the network pending patch deployment and forensic review.

---

CISA Flags Four Critical Flaws Under Active Exploitation

What happened: CISA added four critical vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-65400 (Apple macOS Screen Sharing authentication bypass, CVSS 9.8), CVE-2026-55040 (Microsoft SharePoint RCE), CVE-2026-59310 (Broadcom VMware vCenter RCE), and CVE-2026-33824 (Microsoft IKE RCE). CVE-2026-59310 was exploited by a suspected China-nexus APT actor, resulting in backdoor deployment and Babuk-derived ransomware across 361 victim IPs in 47 countries. CVE-2026-33824 was exploited by a Chinese-speaking actor using AI-enabled autonomous hacking tools.

Impact: High-impact exploitation campaign affecting 361 organizations globally, with ransomware deployment confirmed. Vulnerabilities allow authentication bypass, remote code execution, and persistent backdoor access. Federal agencies under BOD 26-04 must patch by August 21, 2026. Patches available from all vendors, but exploitation continues post-disclosure.

Recommendations:

  • Immediately patch Apple macOS systems to address CVE-2026-65400; prioritize internet-facing and remote-access endpoints.
  • Apply Microsoft security updates for SharePoint (CVE-2026-55040) and IKE Service Extensions (CVE-2026-33824); verify patch deployment via WSUS or Intune logs.
  • Update Broadcom VMware vCenter to the latest version to remediate CVE-2026-59310; hunt for reverse_ssh binaries and unauthorized backdoors in existing vCenter instances.
  • Search network logs and EDR telemetry for indicators of compromise related to Babuk ransomware, Monero miners, and unauthorized Screen Sharing or IKE connections.
  • Review authentication logs for anomalous SharePoint and macOS Screen Sharing access patterns; isolate or disable affected services if patching cannot be completed within 48 hours.

---

MLflow SSRF and FUXA Path Traversal Flaws Exploited

What happened: Two critical vulnerabilities are under active exploitation: CVE-2026-64849 (MLflow SSRF, CVSS 9.3) and CVE-2026-25895 (FUXA path traversal, CVSS 9.5). Attackers are scanning and exploiting MLflow instances to exfiltrate cloud credentials via SSRF within hours of CVE assignment (August 17, 2026). Malicious scanning of FUXA installations began August 18, 2026, with attempts to overwrite files via path traversal.

Impact: MLflow SSRF allows unauthenticated attackers to proxy requests through vulnerable servers to internal cloud metadata endpoints (AWS, Azure, GCP), stealing credentials, secrets, and API keys. FUXA flaw enables unauthenticated remote file write and potential RCE on OT/SCADA systems. Cloud-hosted MLflow deployments and internet-exposed FUXA installations face immediate risk of credential theft and system compromise.

Recommendations:

  • Upgrade MLflow to version 3.15.0 or later immediately for all internet-facing and cloud-hosted instances.
  • Upgrade FUXA to version 1.2.10 or later; if unavailable, remove FUXA instances from public internet exposure and place behind VPN or firewall.
  • Review MLflow audit logs for suspicious HTTP requests to internal metadata endpoints (169.254.169.254, metadata.google.internal, etc.) since August 17, 2026.
  • Rotate all cloud credentials and secrets accessible from compromised MLflow servers, including AWS IAM keys, Azure managed identities, and GCP service account tokens.
  • Monitor network traffic from MLflow and FUXA servers for outbound connections to unexpected external IPs; check for file modifications to main.js or other application files in FUXA installations.

---

Ray Framework CVE-2025-62593 Exploited for Browser-Based RCE

What happened: CISA added CVE-2025-62593, a critical vulnerability in the Ray open-source Python distributed computing framework, to its Known Exploited Vulnerabilities catalog due to active exploitation. The flaw enables browser-based remote code execution via DNS rebinding attacks, allowing attackers to pivot from developer workstations into private corporate networks and attack internal Ray instances. The RondoDox DDoS botnet incorporated the exploit two days before public disclosure (November 24, 2025). The ShadowRay 2.0 campaign targets unpatched instances for cryptocurrency mining on NVIDIA GPU clusters.

Impact: Critical risk to AI/ML development infrastructure. Attackers can achieve remote code execution on developer workstations via phishing or malicious ads combined with DNS rebinding. The browser acts as a confused deputy to pivot into private corporate networks and attack internal Ray instances. Threat actors are actively weaponizing the flaw for botnet recruitment and cryptomining.

Recommendations:

  • Upgrade Ray to version 2.52.0 or later immediately on all development, testing, and production instances.
  • Audit network for Ray deployments using port scans (default ports 8265, 10001, 6379) and asset inventory; prioritize patching internet-exposed and developer workstation instances.
  • Implement network segmentation to isolate Ray clusters from general developer networks and restrict access via firewall rules or VPN.
  • Monitor Ray API endpoints (/api/jobs, /api/job_agent/jobs/) for unauthorized POST requests and unusual User-Agent strings in web proxy and Ray logs.
  • Deploy DNS security controls (DNS filtering, DNSSEC) to detect and block DNS rebinding attempts targeting internal RFC 1918 addresses.

Threat Actor Activity

Mabna Institute: $3.4B Intellectual Property Theft Campaign

The U.S. Department of Justice charged 17 Iranian nationals allegedly affiliated with the Mabna Institute, a hacking-for-hire company linked to Iran's Islamic Revolutionary Guard Corps (IRGC), for conducting years-long operations that resulted in the theft of intellectual property valued at approximately $3.4 billion. The campaign, active from around 2013 through 2018, targeted over 100,000 professor accounts worldwide, successfully compromising approximately 8,000 accounts at 178 universities (144 in the United States), 53 private firms, two NGOs, and at least 10 U.S. state government agencies. The operation exfiltrated 31.5 terabytes of academic materials including journals, theses, dissertations, ebooks, and research data. The State Department is offering rewards of up to $10 million for information on five defendants.

SilkParasite Espionage Campaign Targets Central Asia

SilkParasite, a previously unreported cyber espionage campaign assessed with medium confidence to be China-nexus, targets government bodies across Central Asia. First discovered in late 2025, the operation deploys seven remote access tool (RAT) families, including five newly documented tools: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT. The campaign uses spear-phishing emails with password-protected RAR archives containing malicious Microsoft Office documents that trigger DLL sideloading sequences. Confirmed victims include government entities in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Kazakhstan, and Georgia. The operation employs BLOODALCHEMY (an updated Deed RAT variant descended from ShadowPad/PlugX) and an updated version of SpiceRAT linked to Chinese-speaking actor SneakyChef. Bitdefender observed approximately 65 DriveSilkRAT infections, predominantly in Asia.

Operation CameraSwarm Compromises 14,530+ Dahua Devices

Operation CameraSwarm, disclosed by Hunt.io, compromised over 14,530 Dahua surveillance devices between June 17 and July 22, 2026, using credential attacks, authentication-bypass flaws (CVE-2021-33044, CVE-2021-33045), and P2P relay techniques. The campaign was reconstructed from a 407 MB exposed working directory containing 2,616 files. The operator is assessed to be Russian-speaking based on language artifacts, with confirmed compromises concentrated in Ukraine and Russia. The campaign leveraged Dahua's Easy4IP infrastructure to reach 283 cameras behind NAT using valid serial numbers, with 89.4% of live serial numbers returning an open channel without authentication.

StopAndProtect Exploits 2,000 WordPress Sites

StopAndProtect, a global cybercrime operation identified by Check Point Research in mid-May 2026, exploits nearly 2,000 hacked WordPress websites as infrastructure to distribute malware, compromise hosts, and store stolen data. The operation deploys six main components: SilentEncryptor ransomware, NetworkShareScanner SMB/USB worm, VBS spreader using WMI for lateral movement, LockScreen utility, SimpleChatProxy for C2 communications, and SilentDataCollector credential stealer with keylogging, WhatsApp automation, and screenshot capture. As of July 24, 2026, over 6,000 unique IP addresses have been compromised, with the highest concentration in the United States (1,852 victims), Russia (630), and India (630).

TWINLOOT Abuses Microsoft 365 Services for Covert C2

TWINLOOT, a previously undocumented Python implant framework discovered by Ontinue's Cyber Defense Center in July 2026, operates command-and-control infrastructure within trusted Microsoft services like SharePoint Online and Teams. The modular, PyArmor-hardened implant is used to steal credentials and move laterally across networks. Initial access is achieved through social engineering via Microsoft Teams, with the threat actor impersonating IT support to trick victims into executing malicious PowerShell commands. The malware employs pixel-perfect fake Windows lock screens for credential capture, uses Microsoft Graph API and SharePoint Online dead-drops for C2, and leverages WebRTC DataChannels relayed through Microsoft Teams TURN servers. The implant includes reverse SOCKS5 tunnel capabilities for lateral movement using captured credentials over RDP, WinRM, and SMB.

City Forum Campaign Scrapes Salesforce and ServiceNow Portals

City Forum, a campaign named after a domain associated with attacker infrastructure (IP address 158.220.87.79), has been scraping records from Salesforce Experience Cloud and ServiceNow customer portals across multiple industries since at least March 2025. The operation exploits overprivileged guest user identities to access publicly accessible records using a custom-compiled Go-based scraping tool. On Salesforce, the attacker leverages both the older Aura framework and the newer Lightning Web Runtime via UI-API. On ServiceNow, the tool targets the native Service Portal search endpoint. Targets span telecommunications, banking and financial services, enterprise software vendors, and public sector organizations. The infrastructure remains active as of August 2026, with attack volume reportedly increasing.

StubMaker Typosquatting Campaign Targets RubyGems

StubMaker, a typosquatting campaign tracked by OpenSourceMalware researchers and discovered on August 15, 2026, deployed 16 malicious RubyGems packages designed to steal browser credentials and cryptocurrency wallet information. The campaign impersonates popular Ruby dependencies (bundler, i18n, rake, json, activesupport) and leverages the "extconf.rb" hook to automatically execute during gem installation. The attack chain involves a Rust-based loader fetched from GitHub, which launches a Go-based stealer ("wincfg") containing a DLL payload that circumvents Google's app-bound encryption protections to steal credentials from Chromium-based browsers. Exfiltration occurs via upload to Gofile as password-protected ZIP archives, with download links transmitted over unencrypted HTTP to the C2 domain "dresslee.com".

Geopolitical Context

U.S.-Iran Cyber Tensions Escalate with Mabna Institute Indictment

The U.S. Department of Justice's expansion of charges against 17 Iranian nationals affiliated with the Mabna Institute represents a continuation of efforts to publicly attribute and sanction Iranian cyber operations targeting Western academic and commercial institutions. The campaign, which allegedly began around 2013 and compromised approximately 8,000 academic accounts globally to exfiltrate 31.5 terabytes of data, reflects Iran's strategic interest in acquiring dual-use research and proprietary information to offset technological gaps and sanctions-related isolation. The Justice Department's decision to announce rewards of up to $10 million for information on five defendants signals both the seriousness with which the U.S. views this activity and the practical challenges of apprehending individuals operating from Iranian territory.

China-Nexus APT Activity Targets Central Asia and Global Infrastructure

The SilkParasite espionage operation targeting Central Asian governments and the suspected China-nexus exploitation of CVE-2026-59310 (vCenter) affecting 361 organizations in 47 countries underscore sustained Chinese intelligence collection priorities. The vCenter campaign, which deployed backdoors and Babuk-derived ransomware, concentrated victims in Germany (55 IPs), the United States (41), Turkey (38), Iran (26), and France (25). The reported use of AI-enabled autonomous hacking tools (DeepSeek) by Chinese-speaking actors in exploiting CVE-2026-33824 signals a tactical evolution in adversary tooling, potentially lowering operational costs and accelerating vulnerability weaponization timelines.

Ransomware Ecosystem Threatens U.S. Critical Infrastructure

The Medusa ransomware campaign's breach of over 500 U.S. critical infrastructure organizations since 2021, combined with CISA's confirmation that ransomware gangs are actively exploiting CVE-2025-60710 (Windows Task Host), reflects the persistent threat posed by financially motivated cybercriminal groups to national resilience and economic security. The pattern of 112 Microsoft vulnerabilities being exploited in ransomware campaigns since 2021 highlights the systemic challenge facing organizations worldwide that depend on Windows-based infrastructure. CISA has cataloged 385 actively exploited Microsoft flaws since November 2021, with ransomware operations representing a significant portion of exploitation activity.

Recommended Actions

Immediate (0-24 hours)

  • Patch CVE-2026-33824 (Windows IKE) on all Windows 10, 11, and Server systems; block UDP 500/4500 if IKE is not required.
  • Patch CVE-2026-12569 (PTC Windchill) and hunt for JSP web shells in Windchill directories; reset LDAP and administrative credentials if compromise is suspected.
  • Patch CVE-2026-65400 (macOS), CVE-2026-55040 (SharePoint), CVE-2026-59310 (vCenter) per CISA KEV catalog; federal agencies must comply by August 21, 2026.
  • Upgrade MLflow to 3.15.0+ and FUXA to 1.2.10+; rotate cloud credentials accessible from compromised MLflow servers.
  • Upgrade Ray to 2.52.0+ on all development, testing, and production instances; isolate Ray clusters from general developer networks.
  • Block known MacSync Stealer domains at DNS/proxy layer and deploy detection rules for curl HTTP PUT uploads with API-key headers.

Within 24-72 hours

  • Audit Conditional Access Policies to require MFA for all users, all cloud applications, and all client app types with zero exclusions; disable Resource Owner Password Credentials (ROPC) grant flow.
  • Review and disconnect unnecessary third-party services from Microsoft Copilot Personal; audit Copilot memory stores for injected instructions.
  • Implement network segmentation to restrict lateral movement and contain ransomware deployment to isolated zones.
  • Deploy behavioral detection for Google Drive API abuse as C2 infrastructure, monitoring for automated polling of specific folders and programmatic file uploads from non-standard processes.
  • Monitor for TWINLOOT indicators: unusual PowerShell execution, anomalous Microsoft Graph API authentication patterns, headless browser instances running under suspicious parent processes.

This week

  • Conduct vulnerability scanning for GitLab CE/EE, SAP Commerce Cloud/NetWeaver/MII, Citrix NetScaler ADC/Gateway, and GeoServer; apply patches per vendor advisories.
  • Audit WordPress installations for outdated core and plugin versions; scan for unauthorized must-use (MU) plugins in wp-content/mu-plugins directory.
  • Review Dahua surveillance device configurations; disable P2P and Easy4IP connectivity where not operationally required; update firmware to versions released after mid-2024.
  • Implement allowlists for approved RubyGems packages and enforce dependency verification through lockfile pinning to prevent typosquatted package installation.
  • Establish data loss prevention (DLP) and egress filtering to detect large-scale data exfiltration attempts associated with double-extortion tactics.

Watch List

  • Proof-of-concept exploits for CVE-2026-19490 (Citrix NetScaler authentication bypass, CVSS 9.3) and critical GitLab code injection vulnerability may accelerate exploitation timelines.
  • Password spraying campaigns exploiting MFA policy gaps and legacy OAuth flows; monitor for 155x surge patterns observed in H1 2026.
  • AI-enabled autonomous hacking tools (DeepSeek) used by Chinese-speaking actors may lower operational costs and accelerate vulnerability weaponization.
  • Ransomware operations integrating CVE-2026-33824 (Windows IKE) and CVE-2025-60710 (Windows Task Host) into toolkits; expect surge in disruptive attacks against healthcare, local government, and manufacturing sectors.
  • Supply chain attacks targeting package repositories (RubyGems, npm) with typosquatted packages; monitor for namespace reclamation after package yanking.

Sources

  • BleepingComputer: US charges Iranian hackers over $3.4 billion intellectual property theft
  • BleepingComputer: Password spraying attacks surge 155x as hackers exploit MFA gaps
  • BleepingComputer: Critical RCE flaw in Windows IKE Extension now actively exploited
  • BleepingComputer: CISA: Medusa ransomware hit over 500 critical infrastructure orgs
  • BleepingComputer: Clop created custom web shell for Windchill data theft attacks
  • BleepingComputer: CISA: Windows Task Host flaw now exploited by ransomware gangs
  • The Hacker News: SilkParasite Espionage Campaign Targets Central Asian Governments with Five New RATs
  • The Hacker News: Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P
  • The Hacker News: StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data
  • The Hacker News: Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation
  • The Hacker News: Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure
  • The Hacker News: Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data
  • The Hacker News: Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps
  • The Hacker News: Attackers Exploit MLflow SSRF Flaw to Steal Cloud Credentials and Secrets
  • The Hacker News: TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks
  • The Hacker News: One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025
  • The Hacker News: 16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets
  • The Hacker News: CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE
  • Microsoft Security: Hunting MacSync Stealer infrastructure through behavioral pivots
  • CERT-EU Advisories: 2026-010: Critical Vulnerabilities in Citrix NetScaler ADC and NetScaler Gateway
  • CERT.BE (Belgium): Warning: Critical code injection vulnerability in GitLab CE/EE with available proof-of-concept
  • CERT.BE (Belgium): Warning: 4 Critical (1 actively exploited) vulnerabilities in SAP Commerce Cloud, NetWeaver and MII
  • CERT.BE (Belgium): Warning: 0-Day SQL injection in GeoServer