10 mincritical
6th July – Threat Intelligence Report
This weekly threat intelligence bulletin covers multiple active ransomware campaigns, four critical vulnerabilities under active exploitation, and emerging AI-driven threats. Notable items include actively exploited RCE flaws in Oracle E-Business Suite and Progress Kemp LoadMaster, a Citrix NetScaler memory disclosure flaw exploited within 24 hours of disclosure, a North Korean supply-chain campaign (PolinRider) deploying 108 malicious packages, and a proof-of-concept browser-native ransomware generated by an LLM abusing Chrome's File System Access API.
Sens:■ ImmediateConf:high
Detection / Hunteropenrouter
What Happened
Several organizations including banks, defense contractors, and insurance firms were hit by ransomware or data breaches this week, exposing millions of customer records and terabytes of corporate data. Separately, researchers found that artificial intelligence can be used to create new types of ransomware that work directly inside web browsers without needing traditional malware. Four serious software vulnerabilities are being actively exploited by attackers, including flaws in Oracle business software, Citrix networking appliances, and Progress load balancers — organizations using these products should patch them immediately. A North Korean hacking group also published over 100 malicious software packages in open-source repositories, tricking developers into installing malware through legitimate-looking code libraries.
Key Takeaways
- Four major ransomware/data breach incidents disclosed: River Bank & Trust (ransomware), Indra Group (Gentlemen ransomware), Nidec subsidiary (BlackField ransomware, 2TB+ data theft), and Aflac Japan (4.4M customer records exposed)
- Critical CVE-2026-46817 in Oracle E-Business Suite is reportedly being actively exploited against ~950 internet-exposed instances, enabling remote code execution and ERP takeover
- CVE-2026-8451 in Citrix NetScaler ADC/Gateway was exploited in the wild less than 24 hours after disclosure, leaking session tokens from SAML IdP configurations
- North Korea-aligned PolinRider supply-chain campaign published 108 malicious packages and a Chrome extension across open-source registries, deploying DEV#POPPER and OmniStealer malware
- Researchers demonstrated browser-native ransomware generated by an LLM that abuses Chrome's File System Access API to encrypt files on Android and Windows without traditional malware binaries
Affected Systems
- Oracle E-Business Suite (internet-exposed instances)
- Linux servers, desktops, and Android devices (kernel epoll subsystem)
- Citrix NetScaler ADC and NetScaler Gateway with SAML Identity Provider configurations
- Progress Kemp LoadMaster load balancers
- Open-source AI coding agents (10 of 11 tested tools vulnerable to shell command injection)
- Chrome browser on Android and Windows (File System Access API abuse)
- VS Code with auto-run tasks enabled
- PyPI and open-source package registries
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-46817 | Oracle E-Business Suite | Critical | Remote code execution flaw reportedly exploited against approximately 950 internet-exposed instances, allowing attackers to gain control over ERP systems. |
| CVE-2026-46242 | Linux kernel (epoll subsystem) | High | Bad Epoll privilege escalation race-condition use-after-free vulnerability allowing unprivileged local users to gain root access; public exploit demonstrated reliable exploitation. |
| CVE-2026-8451 | Citrix NetScaler ADC and NetScaler Gateway (SAML IdP configurations) | High | Memory disclosure flaw actively exploited less than 24 hours after disclosure, enabling attackers to leak session tokens from vulnerable appliances. |
| CVE-2026-8037 | Progress Kemp LoadMaster load balancers | Critical | OS command injection flaw with CVSS 9.6 allowing unauthenticated remote code execution; exploitation attempts began June 29. |
| CVE-2024-1212 | Progress Kemp LoadMaster | Referenced alongside CVE-2026-8037 in Check Point IPS protection for Kemp LoadMaster command injection. |
Attack Chain
- Initial Access: Multiple vectors including supply-chain compromise (PolinRider malicious packages), exploitation of CVE-2026-46817 in Oracle EBS, CVE-2026-8451 in Citrix NetScaler, CVE-2026-8037 in Kemp LoadMaster, and credential theft via TeamPCP partnership with Vect ransomware
- Execution: PolinRider abuses VS Code auto-run tasks and hidden JavaScript loaders; ChocoPoC deploys Python RAT via fake PoC exploits; ClickFix uses API-driven delivery with AMSI bypass
- Persistence: Malicious packages and Chrome extension maintain presence in open-source registries and developer environments
- Credential Access: Citrix NetScaler flaw leaks SAML session tokens; TeamPCP specializes in supply chain credential theft
- Exfiltration: BlackField allegedly exfiltrated 2TB+ from Nidec; Aflac Japan exposed 4.4M customer records; ChocoPoC RAT steals files and browser data
- Impact: Ransomware deployment at River Bank & Trust, Indra Group, and Nidec; browser-native ransomware encrypts files via Chrome File System Access API
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: Check Point IPS, Check Point Threat Emulation, Check Point Harmony Endpoint
The article references Check Point IPS, Threat Emulation, and Harmony Endpoint protections for several threats but does not provide any rule bodies or queries. Protection names mentioned include 'Oracle E-Business Suite Authentication Bypass (CVE-2026-46817)', 'Citrix NetScaler Out Of Bounds Read (CVE-2026-8451)', and 'Progress Kemp LoadMaster Command Injection (CVE-2024-1212, CVE-2026-8037)'.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | For supply-chain attacks like PolinRider and ChocoPoC, EDR would see process execution from VS Code auto-run tasks and Python RAT behavior. However, browser-native ransomware operating via Chrome File System Access API may have limited EDR visibility since file operations occur within the browser process context. |
| Network Visibility | Medium | C2 communications for ChocoPoC hidden in Mapbox datasets and ClickFix API-driven delivery would generate network traffic to legitimate services, making detection harder. Exploitation of CVE-2026-46817, CVE-2026-8451, and CVE-2026-8037 against public-facing services would be visible in network logs if monitored. |
| Detection Difficulty | Hard | Multiple threats abuse legitimate services and platforms (GitHub, PyPI, Mapbox, Chrome APIs) for delivery and C2, blending with normal traffic. Supply-chain attacks via open-source packages are inherently difficult to detect pre-execution. Browser-native ransomware operates within legitimate browser processes, reducing traditional endpoint detection efficacy. |
Required Log Sources
- Web application firewall logs for Oracle EBS, Citrix NetScaler, Kemp LoadMaster
- EDR process execution and file operation logs
- DNS resolution logs for Mapbox and package registry traffic
- Package manager logs (pip, npm) for malicious package installation
- VS Code task execution logs
- Browser extension installation logs
- SAML authentication and session token logs
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for VS Code auto-run task execution followed by suspicious network connections or child process spawning, which may indicate PolinRider supply-chain compromise. | EDR process telemetry, VS Code task logs, network connection logs | Execution | Medium - legitimate VS Code extensions and tasks are common in developer environments |
| Consider hunting for Python processes making outbound connections to Mapbox API endpoints with unusual data patterns, which may indicate ChocoPoC RAT C2 communication. | EDR network telemetry, DNS logs, proxy logs | Command and Control | Medium - Mapbox is a legitimate service used by many applications |
| Consider hunting for Chrome browser processes accessing large numbers of files via the File System Access API followed by file modification or encryption activity, which may indicate browser-native ransomware. | EDR file operation logs, browser security event logs | Impact | Low - bulk file access and encryption by browser processes is unusual |
| Consider hunting for unauthenticated requests to Citrix NetScaler SAML endpoints followed by session token usage from unexpected locations, which may indicate CVE-2026-8451 exploitation. | NetScaler audit logs, SAML IdP logs, network flow data | Credential Access | Low - unauthenticated access to SAML endpoints is anomalous |
| Consider hunting for pip or npm install commands for packages with low download counts or recently published timestamps, especially those with post-install scripts, which may indicate supply-chain packages. | EDR process logs, package manager logs, proxy logs | Initial Access | High - new packages are published constantly and many use post-install scripts legitimately |
Control Gaps
- Traditional AV and signature-based detection would not catch browser-native ransomware operating via Chrome File System Access API
- Network-based detection would struggle with C2 traffic hidden in legitimate Mapbox API calls
- Package registry allowlisting may not catch 108 newly published malicious packages before they are identified
- AMSI bypass techniques in ClickFix payloads would evade AMSI-based script inspection
- Shell command injection in AI coding agents bypasses traditional endpoint controls since execution occurs within trusted developer tooling
Key Behavioral Indicators
- VS Code auto-run task execution spawning child processes or network connections
- Python process accessing browser data directories and making outbound HTTPS connections
- Chrome process requesting File System Access API permissions followed by bulk file read/modify operations
- Unauthenticated HTTP requests to Oracle E-Business Suite authentication endpoints
- SAML token issuance from NetScaler followed by access from new or unexpected IP addresses
- Unauthenticated OS command execution on Kemp LoadMaster management interface
- Recently published PyPI or npm packages with post-install scripts and low download counts
False Positive Assessment
Medium - Several detection indicators involve legitimate services (Mapbox, GitHub, PyPI, Chrome APIs) and developer tooling (VS Code, Python), which are common in many environments. Behavioral baselines and context-aware analysis would be needed to reduce false positives.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider immediately patching Oracle E-Business Suite, Citrix NetScaler ADC/Gateway, Progress Kemp LoadMaster, and Linux kernel to address actively exploited CVEs.
- If your organization uses Oracle E-Business Suite, consider auditing for internet-exposed instances and restricting access via network controls until patched.
- If applicable, consider reviewing Citrix NetScaler SAML IdP configurations for signs of session token leakage and rotating credentials if compromise is suspected.
- Consider auditing developer machines for recently installed PyPI packages or VS Code extensions, especially those with auto-run tasks or post-install scripts.
Infrastructure Hardening
- Evaluate whether internet-facing Oracle EBS, Citrix NetScaler, and Kemp LoadMaster instances can be placed behind VPN or zero-trust network access controls.
- Consider implementing package allowlisting or private package registries for developer environments to reduce supply-chain risk.
- If supported by your browser management policy, consider restricting Chrome File System Access API permissions to approved domains only.
- Evaluate whether AI coding agent tools in use have adequate command injection protections, and consider the 10 of 11 failure rate when selecting tools.
User Protection
- Consider deploying EDR with behavioral detection capabilities on developer endpoints to catch supply-chain malware execution.
- If your organization uses Chrome on Android or Windows, consider educating users about granting folder access permissions to unfamiliar websites.
- Consider implementing browser security policies that restrict or prompt for File System Access API usage.
Security Awareness
- Consider incorporating warnings about fake proof-of-concept exploits on GitHub into developer security training programs.
- Consider adding guidance on verifying package legitimacy (download counts, maintainer reputation, post-install scripts) to existing developer onboarding.
- If applicable, consider briefing staff on the ClickFix social engineering technique and its evolution into API-driven malware delivery.
- Consider educating users about AI-generated phishing domains and the risk of LLM phantom squatting for credential theft.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping9 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Privilege Escalation
Tactic
Stealth
Tactic
