2026-W27 Classification: PUBLIC

WEEKLY INTELLIGENCE BRIEFING

2026-06-29 to 2026-07-05 80 articles

Articles scanned

Top IOCs

Awareness links

Download STIX LinkedIn X

Tagline

When the ransomware runs itself

Executive Summary

The week in one line

Autonomous AI ransomware arrived, credential pipelines fed live attacks, and oversight bodies proved they are not immune to the threats they investigate.

What happened

This week marked a qualitative shift in attacker automation with the first documented fully agentic ransomware operation, while several long-running credential-theft campaigns converted stolen access into ransomware deployments at scale. Regulators and law enforcement responded with enforcement actions, extraditions, and infrastructure seizures, but the pace of exploitation continued to outrun patching cycles.

JADEPUFFER, an AI agent, autonomously completed a full ransomware attack against a production database by exploiting CVE-2025-3248 in Langflow
FortiBleed operators linked to INC and Lynx ransomware deployed payloads across 12 confirmed victims after harvesting credentials from 430K+ FortiGate firewalls
Google and FBI disrupted NetNut/Popa, a 2-million-device proxy botnet used by 316 threat clusters in a single week
CISA added SharePoint RCE CVE-2026-45659 and Citrix CVE-2026-8451 to KEV with active exploitation confirmed for both
Citizen Lab confirmed an EU parliamentarian investigating Pegasus was infected with Pegasus twice while serving on the oversight committee

Why it matters for defenders and leaders

The JADEPUFFER case is not a research curiosity. It demonstrates that the reconnaissance-to-encryption timeline can now be collapsed to the speed of API calls, removing the human decision points defenders have historically relied on to detect intrusions. Meanwhile, the FortiBleed-to-ransomware pipeline illustrates how credential theft at the perimeter translates directly into business disruption, and the DHS HSIN breach shows that government networks are not a reference class for security.

AI-driven attackers can self-correct and adapt in real time, invalidating defenses designed around human attacker pace
Legacy OAuth flows and misconfigured Conditional Access enabled 81 million credential-spray attempts to bypass MFA
Residential proxy networks make attacker traffic statistically indistinguishable from consumer traffic at the IP layer
Open-source ecosystems remain a high-leverage supply chain risk with North Korean actors now spanning four package registries simultaneously

What to do this week

Patch Microsoft SharePoint Server for CVE-2026-45659 and Citrix NetScaler for CVE-2026-8451 before end of business
Audit all FortiGate firmware versions, rotate VPN and admin credentials, and check for FortiGate Sniffer artifacts in firewall logs
Disable ROPC OAuth flows in Azure AD and enforce Conditional Access policies that block legacy authentication for all Microsoft 365 tenants
Scan internal PyPI mirrors and npm lockfiles for any packages introduced in the last 30 days and verify maintainer-account integrity for critical dependencies
Verify that no public-facing Langflow or Nacos instances are exposed without authentication, and apply CVE-2025-3248 and CVE-2021-29441 patches immediately

TLDR

🤖 The world's first fully autonomous AI-driven ransomware operation (JADEPUFFER) completed a multi-stage attack without human intervention, raising the floor on attacker automation.
🔥 FortiBleed, the mass credential-harvesting campaign targeting 430K+ FortiGate firewalls, has been directly linked to INC and Lynx ransomware deployments across 150 countries.
🕵️ A European Parliament member investigating Pegasus spyware was himself infected with Pegasus twice, highlighting ongoing abuse of commercial surveillance tools against oversight bodies.
🌐 Google and the FBI dismantled NetNut/Popa, a 2-million-device residential proxy botnet used by 316+ threat clusters for password spraying and espionage.
🔗 North Korean supply chain operations (PolinRider) expanded across npm, Packagist, Go, and Chrome extensions, compromising maintainer accounts and rewriting Git history.
🏥 ShinyHunters breached Medtronic, exposing up to 9 million records including SSNs and health data, with a likely ransom payment suggested by the removal from the leak site.
⚖️ Regulators and courts moved on multiple fronts: CISA added SharePoint RCE CVE-2026-45659 to KEV, Spain fined an insurer €200K for ransomware failures, and a U.S. government entity paid $1M in extortion.

Intelligence Breakdown

6 modules

Vulnerabilities & Exploits

VULNERABILITIES-AND-EXPLOITS

2026-W27

CISA Adds Microsoft SharePoint RCE CVE-2026-45659 to KEV. CISA confirmed active exploitation of CVE-2026-45659, a deserialization flaw (CVSS 8.8) in Microsoft SharePoint Server that allows authenticated users with Site Member-level permissions to execute arbitrary code. Federal agencies faced a three-day patch deadline under BOD 26-04, and all organizations should treat this as an emergency patch given the low attack complexity.

CitrixBleed 2 Exploited Within 24 Hours of Disclosure. CVE-2026-8451, a critical out-of-bounds read in Citrix NetScaler ADC and Gateway, was weaponized by at least two threat actors less than 24 hours after Citrix released patches and watchTowr published technical details. Organizations running SAML IDP configurations should patch immediately or disable the feature and monitor for /saml/login traffic and anomalous NSC_TASS cookie values.

Bad Epoll Linux Kernel Flaw Enables Privilege Escalation to Root. CVE-2026-46242, a use-after-free bug dubbed "Bad Epoll," allows unprivileged users to escalate to root on Linux desktops, servers, and Android devices. Its exploitability from within Chrome's renderer sandbox amplifies the risk surface considerably for browser-facing workloads.

Cisco Confirms Active Exploitation of Unified CM SSRF Flaw. Cisco confirmed in-the-wild exploitation of CVE-2026-20230, a server-side request forgery flaw in Unified Communications Manager that allows unauthenticated remote file creation on devices with WebDialer enabled. Patches are available and upgrade is strongly recommended.

Key Takeaway

Treat CVE-2026-45659 (SharePoint) and CVE-2026-8451 (Citrix) as emergency patches this week; both are actively exploited with low barriers to entry. Learn more

Ransomware & Breaches

RANSOMWARE-AND-BREACHES

2026-W27

JADEPUFFER: The First Documented Agentic AI Ransomware Operation. Sysdig researchers documented JADEPUFFER, a ransomware operation conducted entirely by an autonomous AI agent that exploited CVE-2025-3248 in Langflow (CVSS 9.8) and CVE-2021-29441 in Alibaba Nacos. The agent performed reconnaissance, credential theft, lateral movement, privilege escalation, and encrypted 1,342 production database configuration items without human direction, self-correcting its payload when initial execution failed. Learn more

FortiBleed Credential Campaign Tied to INC and Lynx Ransomware. Researchers confirmed that the FortiBleed campaign, which deployed a custom packet sniffer called "FortiGate Sniffer" on over 73,000 compromised Fortinet devices, has directly enabled at least 12 ransomware deployments by INC Ransom and Lynx operators. Investigators estimate the operation spans roughly 20 members across 500 servers and may also be exploiting an undisclosed Nextcloud zero-day. Organizations should audit FortiGate firmware versions and rotate all VPN credentials immediately. Learn more

ShinyHunters Breaches Medtronic: 3.8 Million Affected, 9 Million Records Claimed. Medtronic disclosed that ShinyHunters accessed its corporate IT systems between April 13-19, 2026, with the threat group claiming over 9 million exfiltrated records including names, SSNs, dates of birth, and health-related details. The listing was subsequently removed from the group's Tor leak site, strongly suggesting a ransom payment was made. Learn more

U.S. Government Entity Pays $1 Million Extortion to Kairos. A U.S. government entity, believed to be Union County, Ohio, paid approximately $1 million in Bitcoin to the Kairos group to prevent publication of more than 2 terabytes of stolen data including SSNs and fingerprints. Notably, no encryption was involved, indicating a pure data-theft extortion model that bypasses traditional ransomware defenses. Learn more

Key Takeaway

The JADEPUFFER case signals that defenders must now account for fully autonomous attack pipelines; patch AI/ML infrastructure (especially Langflow instances) and segment sensitive databases as a priority.

Supply Chain

SUPPLY-CHAIN

2026-W27

PolinRider: North Korean Actors Expand Campaign Across npm, Packagist, Go, and Chrome. The PolinRider campaign, linked to North Korea's Contagious Interview cluster, published 108 malicious packages and browser extensions across four ecosystems, compromising maintainer accounts and rewriting Git history to bury malicious loaders disguised as font files or configuration entries. Payloads include DEV#POPPER and OmniStealer, targeting developers and cryptocurrency professionals via fake job recruitment lures. Learn more

ChocoPoC RAT Targets Security Researchers via Fake PoC Repos. Attackers published trojanized Python-based proof-of-concept exploit repositories on GitHub, embedding a malicious dependency in the package list that pulls ChocoPoC RAT from PyPI when a researcher clones and installs the project. The campaign has targeted high-profile CVEs, weaponizing the security research community's own workflows against them. Learn more

Unpatched FatFs Filesystem Flaws Affect Millions of Embedded Devices. runZero disclosed seven unpatched vulnerabilities in the FatFs library, embedded in millions of devices including security cameras, drones, and hardware crypto wallets. No upstream fix exists for most critical bugs, placing remediation responsibility entirely on downstream vendors who may be slow to respond.

Key Takeaway

Audit all internal developer toolchains for recently added open-source dependencies and verify package integrity via lockfiles and provenance attestations before any new dependency is introduced.

APT & Nation-State

APT-AND-NATION-STATE

2026-W27

Pegasus Spyware Infected EU Parliamentarian Investigating Pegasus. Citizen Lab confirmed that Stelios Kouloglou, a member of the EU's PEGA Committee tasked with investigating commercial spyware, was himself infected with NSO Group's Pegasus twice (October 2022, March 2023) via a zero-click HomeKit exploit (PWNYOURHOME). Attack infrastructure overlaps with campaigns targeting Russian and Belarusian-speaking journalists, and the attacker identity remains unknown. This represents a direct attack on legislative oversight mechanisms.

Google and FBI Disrupt NetNut/Popa: 2 Million-Device Proxy Botnet. A joint operation by Google's Threat Intelligence Group and the FBI dismantled the NetNut residential proxy network, operated by Israeli public company Alarum Technologies, which had been used by 316 distinct threat clusters including nation-state espionage groups and ransomware operators. Google disabled C2 infrastructure, seized domains including netnut.com, and deployed Play Protect warnings to quarantine infected Android applications.

ToddyCat's Umbrij Malware Abuses OAuth to Exfiltrate Gmail. Kaspersky discovered that the ToddyCat APT is deploying a new tool called Umbrij that exploits active Gmail sessions in Chromium browsers via remote debugging ports to silently obtain OAuth tokens and harvest corporate email communications. The malware uses DLL side-loading for stealth and represents an evolution in browser-session credential theft.

Armored Likho APT Deploys BusySnake Stealer Against Government and Energy Sectors. A newly identified APT cluster called Armored Likho is targeting government agencies and electric power sectors in Russia, Brazil, and Kazakhstan using AI-generated loaders and a Python-based infostealer, BusySnake Stealer, that harvests browser credentials and cookies. The group shows overlap with the Eagle Werewolf cluster and blends cyber espionage with financial theft.

Key Takeaway

Residential proxy networks make nation-state and criminal traffic nearly indistinguishable from legitimate consumer activity; invest in behavioral anomaly detection rather than IP-reputation blocking alone.

Phishing & Social Engineering

PHISHING-AND-SOCIAL-ENGINEERING

2026-W27

ConsentFix and ClickFix Hijack Microsoft 365 Accounts in Seconds. Two newly documented techniques bypass MFA entirely: ClickFix tricks users into running commands via fake browser prompts, while ConsentFix exploits OAuth consent flows to steal session tokens in under three seconds. Detailed attack blueprints are being openly shared on cybercrime forums, lowering the barrier to entry significantly. Learn more

81 Million Login Attempts Target Microsoft 365 via ROPC OAuth Bypass. A two-week password-spraying campaign generated over 81 million login attempts against Microsoft 365, exploiting the Azure CLI and the legacy Resource Owner Password Credentials OAuth mechanism to bypass MFA where Conditional Access Policies were misconfigured. Huntress observed 78 compromised accounts across 64 organizations. Learn more

VEIL#DROP Abuses Google Blogger to Deliver PureLogs Stealer. The VEIL#DROP chain uses social engineering to deliver a JavaScript file that executes PowerShell, retrieving a PureLogs infostealer payload hosted on Google Blogger pages to blend malicious traffic with trusted infrastructure. This technique is designed to evade proxy and URL reputation controls that whitelist Google domains. Learn more

Key Takeaway

Disable legacy OAuth flows (ROPC) in Azure AD Conditional Access and enforce device compliance policies; MFA alone does not block token-theft techniques like ConsentFix.

References

REFERENCES

2026-W27

Regulatory Updates

Regulatory & Compliance

Action items and policy signal

Spain Fines Alkora €200K for Ransomware Breach and Missing DPIA. Spain's AEPD fined insurance brokerage Alkora €200,000 after a ransomware attack exposed data on approximately 40,000 individuals including 75 minors. The authority rejected the argument that an external criminal attack negates internal responsibility, and separately cited failure to conduct a Data Protection Impact Assessment despite known high cybercrime risks.

DHS Confirms Breach of HSIN Sensitive Information-Sharing Platform. The Department of Homeland Security confirmed that attackers accessed the Homeland Security Information Network (HSIN) and a related SharePoint system between late May and early June, targeting sensitive but unclassified information shared among government and private-sector partners. The threat actor's identity and the full scope of exfiltration remain unknown. Learn more

Scattered Spider Member Extradited; Group Linked to $100M+ in Losses. Peter Stokes, 19, was extradited from Finland to the U.S. to face charges related to Scattered Spider's operations, which span more than 100 network intrusions and over $100 million in extorted payments. Finnish police seized two 2TB hard drives at arrest. The extradition reinforces international law enforcement coordination against English-speaking cybercrime groups. Learn more

Key Takeaway

The Spain ruling confirms regulators expect proactive security measures and DPIAs regardless of whether a breach was caused by an external attacker; document your risk assessments before incidents occur.