24th August – Threat Intelligence Report - Check Point Research

What Happened

Multiple organizations disclosed data breaches this week, including Latvia's traffic safety directorate affecting 1.2 million people and a Japanese cloud provider exposing up to 1.36 million customer accounts. Several critical software vulnerabilities were discovered and patched in widely used products like GitLab, Citrix NetScaler, and Cisco platforms, with some already being actively exploited by attackers. Researchers demonstrated that AI can autonomously hack into systems and warned of AI-generated attacks targeting industrial equipment. Organizations should prioritize patching the identified vulnerabilities, particularly those with active exploitation, and review their security posture for the described attack methods.

Key Takeaways

• GitLab CVE-2026-19478 (CVSS 9.4) is an unauthenticated code injection vulnerability in self-managed Community and Enterprise editions with observed exploitation attempts after disclosure
• Cl0p extortion campaign is actively exploiting CVE-2026-12569 in PTC Windchill and FlexPLM, using a custom implant for credential decryption and bulk data theft from over 40 organizations
• StopAndProtect campaign abuses thousands of compromised WordPress sites to distribute malware using ClickFix technique, combining ransomware with data theft
• Microsoft-signed BTR.sys driver can be repurposed for privileged file and registry changes during startup, with multiple versions sharing a hard-coded RC4 key
• AI-assisted attacks are targeting Siemens S7 industrial controllers, and an autonomous AI agent demonstrated exploitation of GitHub Actions to access Snowflake's internal Jira

Affected Systems

• GitLab self-managed Community and Enterprise editions
• Cisco Crosswork platforms
• Cisco Secure Workload software
• Citrix NetScaler ADC
• Citrix NetScaler Gateway (with SAML authentication)
• NASA/JPL AMMOS Instrument Toolkit AIT-GUI (pre-2.5.2)
• PTC Windchill
• PTC FlexPLM
• Siemens S7 industrial controllers
• WordPress sites (targeted for compromise in StopAndProtect campaign)
• Snowflake GitHub Actions workflows

Vulnerabilities (CVEs)

Attack Chain

1. Initial Access: Cl0p exploits CVE-2026-12569 in PTC Windchill and FlexPLM systems
2. Execution: Custom implant deployed to compromised product lifecycle management environments
3. Credential Access: Implant decrypts credentials stored within the environment
4. Collection: Implant accesses databases and facilitates bulk data theft
5. Exfiltration: Stolen data used for extortion campaign targeting 40+ organizations

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No
• Platforms: Check Point IPS

Check Point IPS provides protection against CVE-2026-12569 exploitation in PTC products. No YARA, Sigma, Snort, Suricata, KQL, SPL, or EQL rules are provided in the article.

Detection Engineering Assessment

Required Log Sources

• Web server logs (for CVE exploitation detection)
• IPS logs (for CVE-2026-12569 protection)
• Authentication logs (for SAML bypass and credential access detection)
• EDR telemetry (for malware execution and ransomware behavior)
• DNS logs (for C2 resolution if applicable)
• Driver loading events (for BTR.sys monitoring)
• Database audit logs (for bulk data access in PLM environments)

Hunting Hypotheses

Control Gaps

• Signature-based detection would not catch AI-generated scripts and tools designed to mimic legitimate monitoring software
• Application whitelisting may not block the Microsoft-signed BTR.sys driver when repurposed for malicious operations
• SAML authentication bypass (CVE-2026-19489) would not be mitigated by multi-factor authentication
• Compromised legitimate WordPress sites used for malware distribution may bypass URL filtering and email security controls
• Hard-coded RC4 key in BTR.sys versions could allow decryption of remediation tasks by attackers with access to the driver

Key Behavioral Indicators

• BTR.sys driver loaded or invoked outside of expected Windows Defender remediation context
• Unexpected credential decryption activity in PLM environments (PTC Windchill/FlexPLM)
• Bulk database access patterns in product lifecycle management systems
• WordPress sites serving ClickFix-style social engineering content prompting command execution
• Scripts or binaries masquerading as industrial monitoring tools targeting Siemens S7 controllers
• Unauthenticated access to Citrix NetScaler appliances configured with SAML authentication
• Unauthenticated code injection attempts targeting GitLab self-managed instances

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Consider reviewing internet-facing systems for unnecessary exposure, particularly those handling sensitive data, as demonstrated by the Latvia CSDD breach exploiting an internet-facing vulnerability.
• Evaluate whether WordPress sites in your environment are hardened and monitored for compromise, given the StopAndProtect campaign's abuse of thousands of WordPress sites.
• If your organization operates industrial control systems with Siemens S7 controllers, consider network segmentation and monitoring for unauthorized configuration changes.
• Consider reviewing CI/CD pipeline security (e.g., GitHub Actions workflows) for credential exposure and token leakage, as demonstrated by the Snowflake AI agent research.
• If your organization uses Citrix NetScaler with SAML authentication, consider evaluating whether additional access controls can mitigate bypass risk until patches are fully deployed.

User Protection

• Consider deploying endpoint protection that can detect ransomware behavior and data theft, particularly for organizations in the education sector which saw increased targeting.
• Consider monitoring for BTR.sys driver loading outside of expected Windows Defender remediation activities, if your EDR provides driver loading telemetry.
• If your organization is in the education sector, consider heightened monitoring ahead of the school year given the documented increase in attacks and seasonal phishing lures.

Security Awareness

• Consider incorporating warnings about ClickFix-style social engineering into existing security awareness programs, where users are prompted to fix errors by running commands.
• If applicable, consider educating staff in the education sector about seasonal phishing lures impersonating schools and student reward programs.
• Consider raising awareness about AI-assisted attacks and the potential for AI-generated content to be used in phishing and social engineering, including the existence of platforms like Kriminal.

MITRE ATT&CK Mapping