28th September – Threat Intelligence Report - Check Point Research
Check Point reports active exploitation of critical pre-auth RCE flaws in its Security Gateway and F5 BIG-IP APM, alongside AI-driven malware and multiple ransomware campaigns. Bitget lost $351.6M from hot wallet theft with suspected DPRK involvement. ShinyHunters defaced FBIjobs.gov and leaked personnel records. CLOSEDQUORUM Windows malware uses four commercial AI models to orchestrate post-compromise actions including credential theft and process injection. Storm-2570 operates as a multi-ecosystem ransomware affiliate. TeamFiltration campaign compromised 5,700+ M365 accounts across 28 Latin American tenants.
Detection / Hunteropenrouter
Immediate Actions
- Patch Check Point Security Gateway and Management for CVE-2026-85102 and CVE-2026-93616 immediately.
- Patch F5 BIG-IP APM for CVE-2026-94127 if OAuth profiles are configured.
- Update WordPress to version 7.1.2 or later.
- Block AnyDesk execution on non-IT-managed endpoints.
Key Takeaways
- WordPress CVE-2026-87902 affects versions before 7.1.2 and is being exploited for PHP file inclusion and command execution.
- INC ransomware intrusion hit 175 endpoints using BYOVD, AnyDesk, and scheduled task lateral movement over 17 days.
- AI agent campaign compromised 27 online retailers stealing 600,000+ payment card records between September 10-15.
- Storm-3168 (JADEPUFFER) used compromised service principals for destructive bulk deletion of Azure storage, SQL, and VMs.
- Astrana Health attackers spoofed phone numbers to impersonate personnel and accessed servers; systems restored from backups.
Attack Chain
- Initial Access: Exploit pre-auth RCE in Check Point or F5 products
- Execution: Deploy AnyDesk and use scheduled tasks for execution
- Defense Evasion: BYOVD-based disabling of security tools
- Lateral Movement: Move across endpoints via scheduled tasks
- Exfiltration: Cloud-based data exfiltration before ransomware deployment
- Impact: Deploy ransomware or destructive Azure resource deletion
Affected Systems
- Check Point Security Gateway and Security Management products
- F5 BIG-IP Access Policy Manager with OAuth profile configured
- WordPress versions before 7.1.2
- Microsoft 365 accounts across 28 tenants in Latin America
- Azure environments (storage, SQL, Key Vaults, virtual machines)
- Online retailer payment card processing systems
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-85102 | Check Point Security Gateway and Security Management | Critical (9.8) | Pre-authentication vulnerability enables remote code execution in security products. |
| CVE-2026-93616 | Check Point Security Gateway and Security Management | Critical (9.8) | Pre-authentication vulnerability enables remote code execution in security products. |
| CVE-2026-94127 | F5 BIG-IP Access Policy Manager | Critical (9.8) | Heap-based buffer overflow allows unauthenticated RCE with OAuth profile configured. |
| CVE-2026-87902 | WordPress (versions before 7.1.2) | Unauthenticated attackers can include local PHP files and execute commands. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | BYOVD, AnyDesk, scheduled tasks, and process injection are EDR-visible. Pre-auth RCE exploitation may not be. |
| Network Visibility | Medium | C2 and exfiltration traffic visible. Cloud API abuse requires cloud provider logs. |
| Detection Difficulty | Moderate | Multiple TTPs observable via standard telemetry. BYOVD and cloud account abuse require specialized visibility. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Process injection or persistence by previously unknown binaries (T1055, T1547) on endpoints with recent external network connections. | EDR process lineage and module loading events | Execution | Low — legitimate software rarely injects into unrelated processes |
| Scheduled tasks created for lateral movement (T1053.005) originating from endpoints running remote access software. | Scheduled task creation events and process telemetry | Lateral Movement | Medium — admin tools create scheduled tasks routinely |
| Compromised service principals performing bulk resource deletion in Azure (T1485) after reconnaissance activity. | Azure Activity Log delete operations | Impact | Low — bulk deletion is unusual for service principals |
| Pre-auth exploitation of public-facing security appliances (T1190) followed by unexpected process execution. | Appliance logs, network flow, and process telemetry | Initial Access | Low — unexpected processes on security appliances are rare |
Required Log Sources
- EDR process execution logs
- VPN authentication logs
- Azure Activity Log
- Web server access logs
- Microsoft 365 audit logs
- Network flow data
Key Behavioral Indicators
- BYOVD driver loads followed by security tool process termination
- AnyDesk installation outside of IT-sanctioned deployment windows
- Scheduled task creation from non-standard parent processes
- Service principal performing bulk Azure resource deletion
- PHP file inclusion requests targeting non-theme directories
- VPN authentication from new locations using service accounts
Control Gaps
- Pre-auth RCE in security appliances bypasses network controls
- BYOVD exploits bypass EDR agent protections
- Cloud service principal abuse may bypass MFA requirements
- Legitimate remote access tools evade application allowlisting
- Phone number spoofing bypasses voice-based verification
False Positive Assessment
Medium — AnyDesk, scheduled tasks, and remote access tools have legitimate administrative uses. BYOVD and pre-auth RCE exploitation are more distinctive.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Restrict service principal permissions in Azure using least-privilege RBAC.
- Enable Azure Activity Log alerts for bulk deletion operations.
- Enforce MFA for all VPN and M365 account access.
- Isolate security appliances in segmented management networks.
User Protection
- Deploy EDR with BYOVD detection capability across all endpoints.
- Monitor for credential reuse across M365 tenants and VPN.
- Block external access to management interfaces of security appliances.
- Implement application allowlisting to control remote access tools.
Security Awareness
- Train staff to verify caller identity through secondary channels before sharing access information.
- Alert finance teams to report unsolicited contact referencing payment card processing systems.
MITRE ATT&CK Mapping
Initial Access
Execution
Persistence
Privilege Escalation
Stealth
Credential Access
Discovery
Command and Control
Exfiltration
Plain-Language Summary
Multiple cyberattacks hit organizations worldwide this week. Hackers defaced an FBI jobs website and stole records. A cryptocurrency exchange lost over $350 million. A healthcare provider and a German university also reported data breaches. Researchers found new flaws in Check Point, F5, and WordPress products that let attackers run code remotely — some are already being exploited. A new Windows malware called CLOSEDQUORUM uses AI models to decide how to steal data. Several ransomware groups continue attacking businesses using stolen credentials and cloud services. Patch all affected products immediately.
- cveCVE-2026-85102Pre-authentication vulnerability enables remote code execution in security products.
- cveCVE-2026-87902Unauthenticated attackers can include local PHP files and execute commands.
- cveCVE-2026-93616Pre-authentication vulnerability enables remote code execution in security products.
- cveCVE-2026-94127Heap-based buffer overflow allows unauthenticated RCE with OAuth profile configured.