INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Lazarus Group Deploys New Kaolin RAT via Spear-Phishing Campaign

| 2026-09-07 14:54 CRITICAL MEDIUM DATA BREACH
JSON
Executive Summary
AI-generated
Thomson Reuters disclosed a breach of its C-Track court case-management platform on September 7, affecting courts across 11 US states and Canada. Researchers have mapped an Iran-linked Mirage Kitten campaign using fake LinkedIn coding tests to deliver NodeRabbit and PollCat malware. A data breach at Baylor Genetics in June affected approximately 2.8 million patients and employees after unauthorized access to part of its IT environment. Global cloud storage provider Dropbox disclosed unauthorized access to about 5,000 accounts following an attack that exploited Lenovo's email verification process. An AI-assisted ransomware intrusion compromised an enterprise network in under 10 hours by mapping internal systems, mining code repositories, and abusing build pipelines and cloud resources.
Technical Mitigations AI-generated
• Patch SMA 1000 remote access gateways with SonicWall's update to address CVE-2026-83548 and CVE-2026-83549. • Use Check Point IPS protection against the JFrog Artifactory Authentication Bypass (CVE-2026-82329) vulnerability. • Apply FalconFlank zero-day privilege escalation technique mitigation on Windows 11 25H2 and Windows Server 2025 systems.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 1 IoCs Create Free Account
No•••••.js
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Ke3changKe3changContagious InterviewContagious Interview CVE-2026-83548CVE-2026-83548 CVE-2026-82329CVE-2026-82329 CVE-2026-83549CVE-2026-83549
Target & Sectors
NORTH_AMERICA NORTH_AMERICA aviationaviation technologytechnology healthhealth hospitalityhospitality
Incident Timeline
‎2026/09/07
Threat actors used AI-assisted ransomware to target an enterprise network in under 10 hours.
organisation C-Track
TOP ATTACKS AND BREACHES Thomson Reuters, a global information and technology company, has disclosed a breach of its C-Track court case-management platform affecting courts across 11 US states and Canada.
threat_actor Ke3chang
Check Point Threat Emulation and Harmony Endpoint provide protection against this threat Researchers have  mapped a campaign by Iran-linked Mirage Kitten that uses fake LinkedIn coding tests to deliver NodeRabbit and PollCat malware.
organisation NodeRabbit
Check Point Threat Emulation and Harmony Endpoint provide protection against this threat Researchers have  mapped a campaign by Iran-linked Mirage Kitten that uses fake LinkedIn coding tests to deliver NodeRabbit and PollCat malware.
infrastructure Macos
Researchers have  analyzed new macOS delivery activity linked to North Korea’s Contagious Interview campaign.
Researchers developed a static deobfuscation pipeline that recovered readable code, revealing keylogging, browser credential theft, HTTPS interception, additional encryption, and newer variants targeting macOS systems.
threat_actor Contagious Interview
Researchers have  analyzed new macOS delivery activity linked to North Korea’s Contagious Interview campaign.
infrastructure Windows
Security researcher have  unveiled  FalconFlank, a zero-day privilege escalation technique affecting CrowdStrike Falcon on Windows 11 25H2 and Windows Server 2025.
infrastructure Cursor
Security researchers have  disclosed GitSpawn, a vulnerability class affecting AI coding agents including Claude Code, Codex, Cursor, Goose, Qwen Code, Grok Build, and Hermes.
organisation SonicWall
VULNERABILITIES AND PATCHES SonicWall has  addressed CVE-2026-83548 and CVE-2026-83549, critical vulnerabilities affecting SMA 1000 remote access gateways.
organisation SMA
VULNERABILITIES AND PATCHES SonicWall has  addressed CVE-2026-83548 and CVE-2026-83549, critical vulnerabilities affecting SMA 1000 remote access gateways.
organisation CVSS 10.0
CVE-2026-83548 is a pre-authentication SSRF flaw rated CVSS 10.0, while CVE-2026-83549 enables post-authentication remote code execution.
organisation CVE-2026
CVE-2026-83548 is a pre-authentication SSRF flaw rated CVSS 10.0, while CVE-2026-83549 enables post-authentication remote code execution.
organisation JFrog
JFrog has  addressed CVE-2026-82329, a critical CVSS 9.8 authentication bypass affecting self-hosted Artifactory deployments.
organisation CVSS
JFrog has  addressed CVE-2026-82329, a critical CVSS 9.8 authentication bypass affecting self-hosted Artifactory deployments.
organisation Check Point
Check Point IPS provides protection against this threat (JFrog Artifactory Authentication Bypass (CVE-2026-82329))
organisation Microsoft Office
The proof-of-concept abuses Falcon’s Microsoft Office macro-removal remediation behavior, allowing a low-privileged local user to obtain elevated access on affected systems THREAT INTELLIGENCE REPORTS Check Point Research has  uncovered a Chinese-speaking cybercrime cluster, dubbed Gambling Goblin, that compromises Brazilian government and education websites.
organisation Falcon
The proof-of-concept abuses Falcon’s Microsoft Office macro-removal remediation behavior, allowing a low-privileged local user to obtain elevated access on affected systems THREAT INTELLIGENCE REPORTS Check Point Research has  uncovered a Chinese-speaking cybercrime cluster, dubbed Gambling Goblin, that compromises Brazilian government and education websites.
organisation Check Point Research
The proof-of-concept abuses Falcon’s Microsoft Office macro-removal remediation behavior, allowing a low-privileged local user to obtain elevated access on affected systems THREAT INTELLIGENCE REPORTS Check Point Research has  uncovered a Chinese-speaking cybercrime cluster, dubbed Gambling Goblin, that compromises Brazilian government and education websites.
organisation Check Point Threat Emulation
Check Point Threat Emulation and Harmony Endpoint provide protection against this threat Check Point Research has  analyzed JSCeal, a cryptocurrency-focused information stealer compiled into V8 bytecode and executed through a bundled Node.js runtime.
infrastructure Vs Code
The samples connect to infrastructure previously associated with malicious Git hooks and VS Code task files.
organisation Social Security
Stolen data included names, birth dates, medical testing and laboratory results, health insurance information, and some Social Security numbers.
organisation Lenovo
Global cloud storage provider Dropbox has disclosed unauthorized access to about 5,000 accounts after attackers exploited Lenovo’s email verification process.
organisation Dropbox
Fraudulent Lenovo IDs created with victims’ email addresses enabled access without Dropbox passwords, while files were viewed or downloaded from affected accounts.
organisation PLC
Researchers have  showcased how an AI coding assistant can be used to port a known PLC exploit to a different controller model, producing working payloads after guided analysis.
organisation SMA 6210
Both were exploited as zero-days and affect SMA 6210, 7210, and 8200v appliances.
Tactical Metrics
Metrics
infrastructure
‎Macos
Affected Product
Researchers have  analyzed new macOS delivery activity linked to North Korea’s Contagious Interview campaign.
Researchers developed a static deobfuscation pipeline that recovered readable code, revealing keylogging, browser credential theft, HTTPS interception, additional encryption, and newer variants targeting macOS systems.
Metrics
infrastructure
‎Windows
Affected Product
Security researcher have  unveiled  FalconFlank, a zero-day privilege escalation technique affecting CrowdStrike Falcon on Windows 11 25H2 and Windows Server 2025.
Metrics
infrastructure
‎Cursor
Affected Product
Security researchers have  disclosed GitSpawn, a vulnerability class affecting AI coding agents including Claude Code, Codex, Cursor, Goose, Qwen Code, Grok Build, and Hermes.
Metrics
infrastructure
‎Microsoft Office
Affected Product
The proof-of-concept abuses Falcon’s Microsoft Office macro-removal remediation behavior, allowing a low-privileged local user to obtain elevated access on affected systems THREAT INTELLIGENCE REPORTS Check Point Research has  uncovered a Chinese-speaking cybercrime cluster, dubbed Gambling Goblin, that compromises Brazilian government and education websites.
Metrics
infrastructure
‎Vs Code
Affected Product
The samples connect to infrastructure previously associated with malicious Git hooks and VS Code task files.
Intelligence Sources
Check Point Research 2026-09-07