<![CDATA[ETDA Cyber Threat Intelligence 03 July 2026]]>Industrial Sector

Vulnerabilities

Malware

  • JADEPUFFER: Agentic Ransomware For Automated Database Extortion
    "Ransomware has had a human at the keyboard, or at least a human writing its script, since it was first established as a category of threat. The Sysdig Threat Research Team (TRT) has captured what we assess to be the first documented case of agentic ransomware: a complete extortion operation driven end-to-end by a large language model (LLM). This operator, which we have dubbed JADEPUFFER, gained initial access to an internet-facing Langflow instance through CVE-2025-3248 and ran an adaptive and fully automated campaign, ultimately pivoting to the intended target and running a destructive database-extortion playbook against the victim's production database server. JADEPUFFER is considered an agentic threat actor (ATA), or an operator whose attack capability is delivered by an AI agent rather than a human-driven toolkit."
    https://www.sysdig.com/blog/jadepuffer-agentic-ransomware-for-automated-database-extortion
    https://thehackernews.com/2026/07/ai-agent-exploits-langflow-rce-to.html
    https://hackread.com/sysdig-jadepuffer-first-agentic-ransomware-operation/
    https://www.theregister.com/security/2026/07/02/smooth-ai-criminal-drives-first-end-to-end-agentic-ransomware-attack/5266073
  • Fake Google And Cloudflare Verification Pages Spread Multiple Malware Families
    "ClickFix attacks, which trick people into running malicious commands themselves, continue to evolve. This latest campaign uses fake Google and Cloudflare verification pages to convince victims to infect their own devices. A single mistake can install malware that steals passwords and other sensitive data, gives attackers remote access to your computer, or downloads additional malware that can take full control of your system. We uncovered multiple campaigns using the same infrastructure to deliver malware including HijackLoader, StealC, Remus, Amatera Stealer, CastleLoader, NetSupport, and a Rust-based stealer."
    https://www.malwarebytes.com/blog/threat-intel/2026/07/fake-google-and-cloudflare-verification-pages-spread-multiple-malware-families
  • Indirect Prompt Injection In Web Content Targets AI Agents
    "AI agents are increasingly changing how users interact with web content, making the content itself a growing attack surface for threat actors. Just as a human user can be socially engineered through phishing, AI agents are also susceptible to similar attacks. Indirect prompt injection (IPI) is an example of these types of attacks that embed malicious instructions in the content retrieved by an AI agent (websites, documents, email, etc.) to influence the agent’s reasoning during task execution. Zscaler ThreatLabz has observed malicious websites that impersonate legitimate services and use IPI to manipulate AI-driven workflows."
    https://www.zscaler.com/blogs/security-research/indirect-prompt-injection-web-content-targets-ai-agents
  • From CitrixBleed 2 To Cloudflared: The Tools And Techniques Behind Anubis Ransomware Attacks
    "Throughout 2026, Arctic Wolf has investigated multiple Anubis ransomware intrusions. Although threat actor tradecraft differs between intrusions, key themes have emerged: abuse of VPN infrastructure, blending in with legitimate activity through the use of Remote Monitoring and Management (RMM) solutions, and using other legitimate binaries on victim devices. Public reporting has focused largely on the group’s ransomware-as-a-service (RaaS) model, affiliate program, and encryptor payloads. In this research publication, we provide new insight into initial access techniques in Anubis ransomware cases, including exploitation of CitrixBleed 2 (CVE-2025-5777). We also report on the stealthy use of RMM tooling to blend in with legitimate activity, as well as various other techniques used to evade safeguards in victim environments. An understanding of these behaviors provides defenders with opportunities for early detection and containment."
    https://arcticwolf.com/resources/blog/citrixbleed-2-to-cloudflared-the-tools-and-techniques-behind-anubis-ransomware-attacks/
    https://thehackernews.com/2026/07/ransomware-groups-turn-to-citrix-bleed.html
  • Remus Stealer: A New, Not-So-New Infostealer
    "The underground marketplace rarely stays quiet for long. A new information-stealing malware dubbed Remus Stealer has surfaced in the cybercrime underground, exhibiting significant similarities to the notorious Lumma malware family across its administration panel, stolen log files, and core code structure. Despite parallels in its code and functionality, threat actors are eagerly buying into the platform. In addition to its familiar features, it provides attackers with a distinct, modern command and control (C2) and networking infrastructure designed to slip past current security perimeters."
    https://flashpoint.io/blog/remus-stealer-a-new-not-so-new-infostealer/
  • Vect And TeamPCP Partner For Ransomware Campaigns
    "Counter Threat Unit™ (CTU) researchers investigated two interconnected threat groups known as Vect and TeamPCP. The two groups announced a formal operational partnership in late March 2026 to combine TeamPCP’s credential harvesting and data theft capabilities with Vect’s ransomware deployment infrastructure in a widespread campaign involving supply chain attacks and the extortion of multiple organizations."
    https://www.sophos.com/en-us/blog/vect-and-teampcp-partner-for-ransomware-campaigns
  • Iran-Nexus TAG-182 Disseminates MarkiRAT Surveillance Tool
    "Insikt Group has identified new infrastructure associated with the TAG-182 threat cluster, used to disseminate MarkiRAT malware in support of Iranian government surveillance operations. It is highly likely that TAG-182 is targeting Iranians living inside and outside the country using different lures, including free download tools and fake VPN applications. The group’s operations are highly likely active across social media platforms like Instagram. As the kinetic conflict with the United States and Israel has subsided since April 2026, Iran's security apparatus is likely redirecting its focus toward intensified cyber surveillance and digital enforcement operations targeting perceived dissidents and alleged foreign collaborators."
    https://www.recordedfuture.com/research/nexus-tag182-disseminates-markirat
    https://assets.recordedfuture.com/insikt-report-pdfs/2026/cta-ir-2026-0701.pdf
  • The BYOVD Epidemic: How Attackers Are Weaponizing Trusted Windows Drivers To Kill Security
    "Defense evasion has quietly become one of the most consequential stages of an advanced cyber intrusion. As security products have grown harder to beat, attackers have changed their tactics. Rather than attempting to fly under the radar, they are opting to switch off security altogether. With ransomware attacks, in particular, attempting to disable security software is now a standard part of the attack chain. One technique has come to dominate the area of defense evasion and, over the past three years, it has become something close to an epidemic. The Bring Your Own Vulnerable Driver (BYOVD) technique lets attackers abuse flaws in legitimate, validly signed kernel drivers to seize control of the Windows kernel itself and operate at the highest level of privilege on a machine."
    https://www.security.com/threat-intelligence/byovd-vulnerable-drivers

Breaches/Hacks/Leaks

General News

  • Under Pressure: Insights From The 2026 Exposure Gap Report
    "Risk is concentrating. The 2026 Exposure Gap Report shows vulnerabilities claiming a larger share of critical exposure, and that shift has real implications for how security teams prioritize their response. Two findings are central to this change. Vulnerabilities now represent a much larger share of critical exposure, and only a small percentage of vulnerability alerts are validated as exploitable. Together, these findings show why prioritization depends on context, validation, and a clear understanding of which exposures require action."
    https://blog.checkpoint.com/exposure-management/under-pressure-insights-from-the-2026-exposure-gap-report/
  • The Endpoint Recovery Gap Many Teams Discover During An Incident
    "In this interview with Help Net Security, IGEL CTO Matthias Haas explains why backups alone do not equal recovery. He makes the case that endpoint recovery is often overlooked, leaving organizations exposed when thousands of devices go down at once. Haas walks through what a well-planned recovery looks like, where the bottlenecks appear, and why restoring trusted user access matters more than counting blocked threats. He also shares how security leaders can convince a CFO to fund recovery capability before an incident proves it was worth the spend."
    https://www.helpnetsecurity.com/2026/07/02/matthias-haas-igel-endpoint-recovery-gap/
  • Catching Ransomware On The Wire Before It Locks The File Server
    "Corporate networks keep sensitive files off individual workstations and store them on shared servers that staff reach through mapped network drives. That arrangement hands ransomware operators a target worth chasing. A single compromised laptop can begin encrypting files that live on a server across the building, and the encryption travels over the network as ordinary file-sharing traffic. Endpoint detection tools watch the machine they run on. When the encryption lands on a remote file server, the server does little of the visible work. It accepts read and write commands from a client and carries them out, the same way it serves any legitimate user. The agent on the server records normal operation. The agent on the client sees an application touching mapped files. Damage settles in the gap between the two machines, where each agent has a poor view."
    https://www.helpnetsecurity.com/2026/07/02/shared-storage-ransomware-detection-research/
    https://arxiv.org/pdf/2606.30586
  • What The AI Patch Gap Means For Enterprise Security
    "Open-source maintainers are receiving more vulnerability reports than they can act on, and a rising share now comes from an AI system working at machine speed. Over roughly two months this spring, Anthropic’s Claude Mythos Preview combed through more than 23,000 open-source code paths and routed verified findings to the projects that own them. Tuskira studied what happens to those findings once they reach human hands. The program reported 1,596 verified vulnerabilities, spread across hundreds of projects over a window of about nine weeks. Six external security research firms triaged the findings before they reached maintainers."
    https://www.helpnetsecurity.com/2026/07/02/open-source-ai-patch-gap/
  • Cybercrime In Australia 2025
    "In 2025, 10,593 online Australians participated in the Australian Cybercrime Survey. Nearly half of all respondents reported having been a victim of some form of cybercrime in the 12 months prior to the survey. This included online abuse and harassment (24.9% of respondents), followed by malware (21.5%), identity crime and misuse (20.6%) and fraud and scams (11.4%). One in five respondents experienced multiple types of cybercrime. Between 2024 and 2025, the proportion of respondents who had been a victim of online fraud and scams increased."
    https://www.aic.gov.au/publications/sr/sr59
    https://www.darkreading.com/cybersecurity-analytics/aussies-face-reduced-cybercrime-risk-pressure-shifts-smbs
  • Apple Reverses Age-Old Patch Policy To Keep Up With AI
    "Apple is changing its approach to security patching, in response to the growing threat of accelerated artificial intelligence (AI) attacks. The company has historically saved big, bundled sets of bug fixes for new versions of its operating system (OS). That's set to change. The company released a variety of security updates June 29 for iPhones, iPads, Macbooks, and the Safari browser, untethered to any major version releases. It's hardly the first time it's released security updates out-of-band, but the motivation was different this time. According to Reuters, the company said "it was adapting to the reality that, given the ability of artificial intelligence to speed the development of malicious hacking tools, it ⁠needed to reduce the time between when updates were first made public and when they were put into customers' hands.""
    https://www.darkreading.com/cybersecurity-operations/apple-patch-policy-ai
  • When Too Much Security Data Became The Risk
    "For years, conventional wisdom in security operations was simple: collect everything. Logs were cheap. Storage was plentiful. And the more data a team had, the more confident it could feel about detection and forensics. That assumption quietly broke as organizations scaled. At Vensure Employer Solutions, a privately held HR services and payroll provider supporting more than 95,000 businesses, telemetry volume did not just grow; it exploded. Rapid acquisitions, expanding infrastructure, and a growing customer base turned routine firewall traffic into a relentless stream of raw data flowing into the company's security information and event management (SIEM) environment."
    https://www.darkreading.com/cyber-risk/too-much-security-data-risk
  • Researcher Behind 'Exploitarium' Explains Release Of Undisclosed Zero-Day Exploits
    "A pseudonymous security researcher has released over 30 proof-of-concept exploits for zero-day vulnerabilities in open-source projects without disclosing them to the maintainers first. The dump, called ‘Exploitarium,’ was shared publicly on GitHub by an individual going by name ‘bikini’ and ‘ashdfrkl’ on Discord. First published on June 27, the repository initially included around 15 exploits, before the researcher updated it over the next few days with new entries."
    https://www.infosecurity-magazine.com/news/researcher-exploitarium-exploits/
  • Missed Incidents, Persistent Threats, And Response Gaps: Insights From Compromise Assessment Projects
    "The following analysis presents the key findings from Kaspersky Compromise Assessment engagements performed in 2025. A compromise assessment is an independent, expert-driven service that examines whether a target network has been compromised. The service combines threat intelligence analysis (including darknet sources), tool-aided endpoint scanning, a systematic review of security event logs and network traffic, and, when necessary, an initial incident response and digital forensic investigation. This report focuses on missed incidents – threats that remained undetected for weeks, months, or even years."
    https://securelist.com/compromise-assessment-findings-2025/120542/
  • How To Conduct a Successful Audit Of AI-Driven Software Development
    "Traditionally, an audit independently examines records, processes and controls to verify compliance and assess financial and operational integrity. In the modern world, such an approach should extend to the software development lifecycle (SDLC) – especially in the age of artificial intelligence (AI) or large language model (LLM)-assisted code. Chief Information Security Officers (CISOs) and their teams need proof that developers are producing protected products, because one in five organizations has experienced a serious security incident directly tied to AI-generated code. Getting to the root of the problems requires visibility into who is leveraging AI, what tools they are using and where AI-generated code is introduced into the SDLC. This is considered the ADLC: the agentic development lifecycle."
    https://www.securityweek.com/how-to-conduct-a-successful-audit-of-ai-driven-software-development/
  • Google’s Continued Disruption Of Malicious Residential Proxy Networks
    "Today, in coordination with the FBI, Lumen, and others, Google took action against the NetNut residential proxy network, also known as Popa. This action builds on our disruption of the IPIDEA proxy network that took place in January 2026, and is a continuation of Google’s objective to dismantle malicious residential proxy networks."
    https://cloud.google.com/blog/topics/threat-intelligence/google-continued-disruption-residential-proxy-networks
    https://thehackernews.com/2026/07/google-disrupts-netnut-residential.html

อ้างอิง

Electronic Transactions Development Agency (ETDA) 820e18b2-6258-4b01-aaf0-f765073f98dc-image.png

]]>https://webboard-nsoc.ncsa.or.th/topic/3055/etda-cyber-threat-intelligence-03-july-2026RSS for NodeFri, 03 Jul 2026 10:05:42 GMTFri, 03 Jul 2026 06:51:20 GMT60