Cyber Threat Brief — July 27 2026
⚠️ This report is AI-generated. Always validate findings.
1. Cl0p Extortion Wave via PTC Windchill/FlexPLM — CVE-2026-12569
TL;DR: Cl0p ransomware affiliates are mass-exploiting CVE-2026-12569 (CVSS 9.3) in PTC Windchill and FlexPLM, deploying JSP webshells for engineering data theft and launching double-extortion emails to victims as of July 20-24.
What’s New:
- ReliaQuest confirmed Cl0p tradecraft July 24; BleepingComputer confirmed extortion emails from
support@cryptohox[.]com(new Cl0p address) - Attack chains FlexPLM WSDL pre-auth info disclosure with Windchill login servlet flaw for unauthenticated RCE
- Hex-named JSP webshells deployed under
/Windchill/login/[0-9a-f]{16}.jsp; filesystem enumeration viaflst.txt - Four new C2 indicators released July 25 alongside prior IOC batches from 7/8, 7/1, 6/25, 6/18
- Confirmed victims in Manufacturing, Automotive, Aerospace, Retail/Apparel sectors
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
/Windchill/login/[0-9a-f]{16}.jsp | JSP webshell | T1505.003 | Web server access logs, file integrity | Hunt/Block |
flst.txt on Windchill server | Recon artifact | T1083 | EDR file create | Alert |
5.180.41[.]35 | C2 IP | T1071.001 | Firewall/proxy logs | Block |
support@cryptohox[.]com | Extortion email | T1566 | Email gateway | Block |
/Windchill/codebase/login/*.jsp creation | Webshell drop | T1505.003 | Sysmon EID 11 / file integrity | Alert |
Custom X-windchill-req HTTP header | C2 comms | T1071.001 | WAF/proxy logs | Hunt |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Web Shell Indicator (generic) | No Windchill-specific rule; need URI pattern + hex filename match |
| Elastic | Web Shell Detection: Script Process Child of Common Web Processes (partial) | Tomcat/Windchill child process context missing |
| Sigma | webshell_detection_file_creation.yml (generic) | No Windchill path-specific rule |
Sources: BleepingComputer, ReliaQuest, Ransom-ISAC, The Hacker News
2. GitLab RCE PoC via Oj Parser Memory Corruption — No CVE
TL;DR: Public exploit dropped July 24 chains two Ruby Oj parser memory corruption bugs through Jupyter notebook diffs to achieve RCE as git user on any self-managed GitLab 15.2.0–19.0.1 instance — any authenticated user with push access can execute it.
What’s New:
- depthfirst published full working PoC and writeup July 24; GitLab patched silently in June 10 release with no security advisory or CVE
- Stack OOB write + heap pointer info leak in Oj JSON parser triggered via
ipynbdiffgem notebook rendering - Three crafted
.ipynbfiles: first leaks heap pointer (ASLR defeat), next two hijack callback pointer intosystem() - No admin rights, no CI/runner access, no victim interaction required — just push + open commit diff
- Nine companion Oj CVEs span buffer overflows, use-after-free, integer overflows across parser/loader/dumper APIs
- GitLab did not file fix as security fix — operators who triaged June release had no signal to prioritize
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
Rapid .ipynb commits followed by diff views | Exploit delivery | T1203 | GitLab audit log (push events + UI diff views) | Hunt |
system() call from ruby process under GitLab | Post-exploitation | T1059 | EDR / auditd | Alert |
| GitLab version < 19.0.2 self-managed | Vulnerable software | — | Asset inventory | Patch |
| High-entropy Jupyter notebook content with nested JSON | Exploit payload | T1027 | Git pre-receive hooks | Hunt |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No GitLab Oj parser or notebook-diff rule |
| Elastic | Linux Suspicious Child Process From Web Server (generic) | Puma/GitLab-specific context missing |
| Sigma | None | No coverage for GitLab notebook diff exploitation |
Sources: depthfirst, The Hacker News, Cyber Kendra
3. Dolphin X Infostealer with AI Target Profiler
TL;DR: New Windows RAT/stealer targets 300+ applications and uses an AI profiler to score, categorize, and rank infected machines by value — helping operators prioritize high-value victims for follow-on attacks.
What’s New:
- Varonis Threat Labs (Daniel Kelley) disclosed; sold by “Kontraktnik” on cybercrime forums
- 329 features across 10 categories: credential theft, crypto wallets, SSH keys,
.envfiles, cloud tokens, DevOps credentials - AI Profiler analyzes application usage, browser domains, installed software, and risk scores to produce ranked victim profiles
- Targets cryptocurrency wallets, browser stores, messaging apps, and cloud/DevOps tooling
- Marketed as all-in-one RAT with remote access, keylogging, screen capture alongside stealer capabilities
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Outbound HTTPS to C2 with victim profiling JSON payloads | C2 exfil | T1041 | Proxy/EDR | Hunt |
| Mass access to browser credential stores (Chrome, Edge, Firefox) | Credential theft | T1555.003 | EDR (file read on Login Data/Cookies) | Alert |
Enumeration of .env, SSH key directories, cloud token paths | Recon/harvest | T1552.001 | Sysmon EID 1+11 | Hunt |
| Cryptocurrency wallet file access (MetaMask, Exodus, Electrum) | Theft | T1005 | EDR file read | Alert |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Credential Access — Browser Credential Store Access (generic) | No Dolphin X-specific IOCs yet |
| Elastic | Credential Access via Known Utilities (generic) | Covers browser store access patterns |
| Sigma | proc_creation_win_susp_browser_credential_access.yml (generic) | No specific Dolphin X process names/hashes |
Sources: BleepingComputer, Infosecurity Magazine, Hackread
Status Updates
- CVE-2026-56155 (AD FS EoP): Federal CISA KEV deadline TOMORROW July 28. Zero-day exploitation ongoing. Original brief.
- CVE-2026-50522 (SharePoint deserialization RCE): Federal deadline passed July 25. Active exploitation via BinaryFormatter payload at
/_trust/default.aspx. Machine key theft for persistence. Original brief. - CVE-2026-16232 (Check Point SmartConsole auth bypass): Federal deadline passed July 25. Zero-day exploitation ongoing against small number of customers. Original brief.
- CVE-2026-6875 (ServiceNow sandbox escape RCE): Active exploitation ongoing since July 18. Second sandbox-escape gadget chain confirmed by Defused. Fortune 500 and critical infrastructure victims. Still NOT on CISA KEV. Original brief.
- LegacyHive (Windows ProfSvc 0day): ACROS Security released free 0patch micropatches July 20. Still UNPATCHED by Microsoft. Works on all supported Windows with July patches. Original brief.