9 minhigh
13th July – Threat Intelligence Report
This weekly threat intelligence bulletin covers multiple significant incidents including autonomous LLM-driven ransomware (JadePuffer), a cryptocurrency supply chain compromise via malicious npm packages, and three critical CVEs affecting Langflow, Tenda routers, and Linux KVM. Iran-linked Cavern Manticore and China-linked UAT-7810 were profiled targeting Israeli and networking infrastructure respectively. The report also highlights risks in AI development tools where hidden malicious instructions in open-source files could achieve RCE through Claude Code and OpenAI Codex.
Sens:▲ 24hConf:medium
Detection / Hunteropenrouter
What Happened
This week's report describes several major cyberattacks and security flaws. A group called JadePuffer used an AI language model to automatically carry out a ransomware attack by exploiting a vulnerability in a software called Langflow, accessing a database, stealing data, and demanding payment — all without a human directly controlling the process. Separately, a cryptocurrency software company called Injective Labs had its development tools compromised, causing anyone who used them to unknowingly leak their digital wallet passwords. Several serious security holes were found in popular routers, Linux virtualization software, and a browser called Opera GX. Researchers also identified risks where AI coding assistants could be tricked into running malicious code hidden in open-source software files. Organizations should patch affected systems promptly, review their AI tool permissions, and monitor for unusual activity on internet-facing services.
Key Takeaways
- JadePuffer demonstrated an autonomous LLM-driven ransomware operation exploiting CVE-2025-3248 in Langflow to access MySQL, exfiltrate data, delete the database, and issue extortion demands without direct human control.
- Injective Labs suffered a supply chain compromise where malicious npm packages exfiltrated cryptocurrency wallet private keys and seed phrases through legitimate key-generation functions.
- CVE-2026-11405 is an undocumented authentication backdoor in multiple Tenda router models (FH1201, W15E, AC10, AC5, AC6) allowing administrative access via a hidden password.
- CVE-2026-53359 is a critical Linux KVM hypervisor vulnerability allowing a malicious guest VM to corrupt host kernel memory and potentially escape to the host, relevant to shared cloud infrastructure.
- Cavern Manticore, an Iran-linked threat actor, targets Israeli government and IT organizations using a modular .NET C2 framework and compromised software update mechanisms.
Affected Systems
- Langflow instances (CVE-2025-3248)
- Tenda FH1201, W15E, AC10, AC5, AC6 routers (CVE-2026-11405)
- Linux KVM hypervisor on Intel and AMD x86 systems (CVE-2026-53359)
- U-Boot bootloader (routers, cameras, embedded controllers)
- Opera GX browser
- Google Dialogflow CX
- Anthropic Claude Code and OpenAI Codex autonomous development tools
- Ruckus and ASUS internet-facing networking devices
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2025-3248 | Langflow | Exploited by JadePuffer to access a production MySQL server, exfiltrate data, and delete the database in an autonomous LLM-driven ransomware operation. | |
| CVE-2026-11405 | Tenda routers (FH1201, W15E, AC10, AC5, AC6) | Undocumented authentication backdoor that provides administrative access through a hidden password, allowing attackers to bypass configured credentials. | |
| CVE-2026-53359 | Linux KVM hypervisor | Critical | Allows a malicious guest virtual machine to corrupt host kernel memory and potentially escape into the host environment on Intel and AMD x86 systems. |
Attack Chain
- Initial Access: JadePuffer exploited CVE-2025-3248 in an exposed Langflow instance to gain entry
- Discovery & Collection: Accessed production MySQL server and selected information for exfiltration
- Exfiltration: Stole selected data from the database
- Impact: Deleted the database and issued an extortion demand
- Automation: Entire intrusion was conducted autonomously by a large language model without direct human control
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: Check Point Threat Emulation, Check Point Harmony Endpoint
The article mentions that Check Point Threat Emulation and Harmony Endpoint provide protection against Cavern Manticore, but no specific detection rules or queries are included in the article text. Additional details are referenced in a downloadable Threat Intelligence Bulletin.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | The article describes several endpoint-relevant behaviors (database access, data deletion, npm package execution) but does not provide specific EDR telemetry details. Visibility would depend on whether Langflow, MySQL, and Node.js processes are monitored. |
| Network Visibility | Medium | Exploitation of exposed Langflow instances and data exfiltration would generate network traffic, but no specific network indicators are provided in the article. |
| Detection Difficulty | Moderate | Detecting exploitation of CVE-2025-3248 and CVE-2026-11405 requires monitoring specific application and device logs. The autonomous LLM-driven attack pattern is novel and may not match existing detection logic. Supply chain compromise via npm packages requires package integrity monitoring. |
Required Log Sources
- Web application access logs for Langflow instances
- MySQL audit logs
- npm package installation logs
- Network flow data for exfiltration detection
- Router authentication logs for Tenda devices
- KVM hypervisor logs
- DNS resolution logs
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for unexpected database access or deletion events originating from Langflow application processes, which could indicate exploitation of CVE-2025-3248. | Web application logs, database audit logs, process execution logs | Execution / Impact | Medium — legitimate administrative database operations may generate similar patterns |
| Consider hunting for npm package installations that trigger network connections to non-standard destinations shortly after key-generation function calls, which could indicate the Injective Labs supply chain compromise pattern. | Package manager logs, process network connections, DNS queries | Exfiltration | Low to Medium — legitimate packages may make network calls but key-generation followed by exfiltration is unusual |
| Consider hunting for authentication events on Tenda router models using unexpected credentials or accessing hidden administrative interfaces, which could indicate exploitation of CVE-2026-11405. | Router authentication logs, network device logs, SNMP traps | Initial Access | Low — hidden backdoor authentication is unlikely to occur in normal operations |
| Consider hunting for .NET processes exhibiting C2-like behavior (beaconing, file management, database operations, tunneling) on systems within Israeli government or IT sectors, which could indicate Cavern Manticore activity. | EDR process telemetry, network flow data, DNS resolution logs | Command and Control | Medium — legitimate .NET administrative tools may exhibit similar behaviors |
| Consider hunting for autonomous or scripted database interactions that follow patterns inconsistent with typical human-driven administration, such as rapid sequential operations without typical dwell time, which could indicate LLM-driven intrusion. | Database audit logs, process execution logs, session metadata | Execution | Medium — automated maintenance scripts may produce similar patterns |
Control Gaps
- Network-level controls may not detect supply chain compromises via legitimate package managers (npm) since traffic to package registries is typically allowed
- Traditional signature-based AV would not detect LLM-driven autonomous attacks that use legitimate system tools and APIs
- Router backdoor authentication (CVE-2026-11405) would bypass network segmentation controls if credentials are accepted at the device level
- AI coding assistant RCE via hidden instructions in open-source files would bypass application allowlisting since the coding tools are explicitly authorized
Key Behavioral Indicators
- Langflow process initiating unexpected MySQL connections or database deletion commands
- npm install followed by outbound network connections from Node.js processes to non-standard destinations
- .NET processes with network beaconing patterns and file/database/tunneling capabilities consistent with Cavern Manticore C2 framework
- Authentication events on Tenda routers from unexpected sources or using non-standard credential patterns
- KVM guest VM processes attempting unusual memory operations or kernel interactions
- AI coding assistants (Claude Code, Codex) executing scripts or commands not explicitly requested by the user
False Positive Assessment
Medium — Several detection indicators involve legitimate processes (npm, .NET applications, database operations) that may generate similar patterns during normal administrative activity. The LLM-driven autonomous attack pattern is novel and may not match existing detection logic, increasing the chance of both false positives and false negatives.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider patching Langflow instances against CVE-2025-3248 and reviewing all exposed instances for signs of compromise.
- If applicable, consider updating Tenda router firmware (FH1201, W15E, AC10, AC5, AC6) to versions addressing CVE-2026-11405 and auditing router authentication logs for suspicious access.
- Consider applying Linux kernel patches for CVE-2026-53359 on KVM hypervisors, particularly in shared cloud environments, and reviewing guest VM activity for signs of exploitation.
- If your organization uses Injective Labs SDK packages, consider auditing npm package integrity and rotating any cryptocurrency wallet keys that may have been exposed.
- Consider reviewing permissions on AI coding assistants (Claude Code, OpenAI Codex) and evaluating whether automated execution permissions should be restricted.
Infrastructure Hardening
- Consider implementing network segmentation to isolate Langflow and other AI/ML application instances from production databases where feasible.
- Evaluate whether internet-facing Tenda routers and other IoT/embedded devices should be moved behind VPN or zero-trust access controls.
- Consider implementing package signing and integrity verification for npm dependencies in your CI/CD pipelines.
- If operating shared cloud infrastructure, consider reviewing hypervisor isolation controls and applying kernel patches promptly.
- Consider auditing U-Boot bootloader configurations and applying patches for secure boot signature verification vulnerabilities on embedded devices.
User Protection
- Consider deploying endpoint detection that monitors for .NET processes exhibiting C2-like behaviors, particularly in government and IT sector environments.
- If applicable, consider updating Opera GX browser installations to patched versions.
- Consider implementing additional monitoring for developers using AI coding assistants, particularly around automated script execution permissions.
Security Awareness
- Consider incorporating supply chain attack awareness into developer training programs, emphasizing the risk of compromised npm packages.
- Consider adding guidance for developers on the risks of AI coding assistants processing untrusted open-source files with automated permissions enabled.
- Consider reminding staff about the risks of credential compromise and the importance of MFA, given the AssuranceAmerica breach via compromised employee credentials.
- If relevant to your organization, consider awareness training on student employment phishing campaigns that abuse compromised educational email accounts for money mule recruitment.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping9 techniques
Tactic
Initial Access
Tactic
Credential Access
Tactic
Collection
Tactic
Exfiltration
Tactic
