INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

5th October – Threat Intelligence Report

| 2026-10-05 13:57 CRITICAL MEDIUM DATA BREACH
JSON
Executive Summary
AI-generated
On October 5, 2026, South Africa's air navigation provider suffered a ransomware attack affecting operational technology supporting aviation weather services. The attackers exploited the vulnerabilities in Citrix NetScaler to gain remote access and deploy malware, compromising sensitive information including personal data of current and former participants in the Foster Care Review Board dating back to 2010. Meanwhile, Japanese car-sharing service Times Car disclosed a data breach exposing approximately 6.6 million accounts' personal data, while identity-verification documents were exposed for about 1.6 million accounts. The attackers also attempted rudimentary hacking techniques using autonomous AI agents attempting to gather public information from US and Canadian government websites, including failed SQL injection attempts against the US Department of Education and Library and Archives Canada.
Technical Mitigations AI-generated
• Check Point IPS can protect against Citrix NetScaler Multiple Products Buffer Overflow (CVE-2026-88772) and Citrix NetScaler Multiple Products Command Injection (CVE-2026-88771). • Use Check Point IPS to block or hunt for Cisco Catalyst SD-WAN Manager Authentication Bypass (CVE-2026-76504). • Patch CVE-2026-86950, a CoreGraphics memory corruption vulnerability affecting iPhones, iPads, and Macs. • Hunt for malicious Custom GPTs hosted on ChatGPT used in ClickFix campaigns to deliver remote access malware.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2026-88771CVE-2026-88771 CVE-2026-76504CVE-2026-76504 CVE-2026-88772CVE-2026-88772 CVE-2026-90970CVE-2026-90970 CVE-2026-86950CVE-2026-86950
Target & Sectors
NORTH_AMERICA NORTH_AMERICA educationeducation governmentgovernment energyenergy telecommunicationstelecommunications financefinance
Incident Timeline
‎the week of 5th October
Threat actors released a Threat Intelligence Bulletin for the week of 5th October.
‎2026/10/05
Researchers documented Warlock ransomware attacks exploiting SharePoint ToolShell vulnerabilities against organizations in the utilities, telecom, government and education sectors.
organisation SharePoint ToolShell
THREAT INTELLIGENCE REPORTS Researchers documented Warlock ransomware attacks exploiting SharePoint ToolShell vulnerabilities against organizations in the utilities, telecom, government and education sectors.
organisation SharePoint
The group used compromised SharePoint servers for initial access, disabled endpoint protection on dozens of systems, and deployed ransomware across at least 33 hosts during one intrusion.
infrastructure 33 hosts
The group used compromised SharePoint servers for initial access, disabled endpoint protection on dozens of systems, and deployed ransomware across at least 33 hosts during one intrusion.
organisation SQL
Activity included failed SQL injection attempts against the US Department of Education and Library and Archives Canada.
organisation the US Department of Education
Activity included failed SQL injection attempts against the US Department of Education and Library and Archives Canada.
organisation Archives Canada
Activity included failed SQL injection attempts against the US Department of Education and Library and Archives Canada.
organisation RedFlick
The actor uses a new RedFlick delivery technique to install the CosmicPulse backdoor through scheduled tasks, supporting espionage activity against governments, NGOs, think tanks, and organizations connected to Ukraine.
organisation CosmicPulse
The actor uses a new RedFlick delivery technique to install the CosmicPulse backdoor through scheduled tasks, supporting espionage activity against governments, NGOs, think tanks, and organizations connected to Ukraine.
threat_actor Star Blizzard
Researchers mapped Russia-linked Star Blizzard phishing campaigns targeting more than 100 organizations, primarily in the United States and United Kingdom.
victims 100 organizations
Researchers mapped Russia-linked Star Blizzard phishing campaigns targeting more than 100 organizations, primarily in the United States and United Kingdom.
organisation Antino
The group deployed the Antino backdoor through spear-phishing and tailored decoy documents.
infrastructure Microsoft 365
The group impersonates prominent economists and AI policymakers, builds rapport through benign emails, then redirects targets to phishing pages designed to steal Microsoft 365 credentials and session cookies.
Antino uses Microsoft 365 services for command and control, file transfer, system reconnaissance, command execution, and persistence.
data_breach 365 credentials
The group impersonates prominent economists and AI policymakers, builds rapport through benign emails, then redirects targets to phishing pages designed to steal Microsoft 365 credentials and session cookies.
organisation JadePuffer
Researchers outlined how JadePuffer, an AI-enabled threat actor tracked as Storm-3168, used compromised Azure service principals to automate cloud reconnaissance and destructive actions.
organisation Storm-3168
Researchers outlined how JadePuffer, an AI-enabled threat actor tracked as Storm-3168, used compromised Azure service principals to automate cloud reconnaissance and destructive actions.
organisation NetScaler
The activity included deleting storage and application resources, targeting backup-related assets, and attempting to retrieve access keys, reflecting agent-driven post-compromise operations in cloud environments. VULNERABILITIES AND PATCHES Citrix has issued fixes for critical NetScaler vulnerabilities CVE-2026-88771-2, affecting NetScaler ADC and Gateway.
organisation CVE-2026
The activity included deleting storage and application resources, targeting backup-related assets, and attempting to retrieve access keys, reflecting agent-driven post-compromise operations in cloud environments. VULNERABILITIES AND PATCHES Citrix has issued fixes for critical NetScaler vulnerabilities CVE-2026-88771-2, affecting NetScaler ADC and Gateway.
organisation NetScaler ADC
The activity included deleting storage and application resources, targeting backup-related assets, and attempting to retrieve access keys, reflecting agent-driven post-compromise operations in cloud environments. VULNERABILITIES AND PATCHES Citrix has issued fixes for critical NetScaler vulnerabilities CVE-2026-88771-2, affecting NetScaler ADC and Gateway.
organisation CVE-2026-76504
Check Point IPS provides protection against these threats (Citrix NetScaler Multiple Products Buffer Overflow (CVE-2026-88772), Citrix NetScaler Multiple Products Command Injection (CVE-2026-88771)) Cisco has alerted about CVE-2026-76504, a critical (CVSS 9.8) vulnerability in Catalyst SD-WAN Manager.
organisation Check Point
Check Point IPS provides protection against these threats (Citrix NetScaler Multiple Products Buffer Overflow (CVE-2026-88772), Citrix NetScaler Multiple Products Command Injection (CVE-2026-88771)) Cisco has alerted about CVE-2026-76504, a critical (CVSS 9.8) vulnerability in Catalyst SD-WAN Manager.
organisation Catalyst SD-WAN
Check Point IPS provides protection against these threats (Citrix NetScaler Multiple Products Buffer Overflow (CVE-2026-88772), Citrix NetScaler Multiple Products Command Injection (CVE-2026-88771)) Cisco has alerted about CVE-2026-76504, a critical (CVSS 9.8) vulnerability in Catalyst SD-WAN Manager.
organisation Cisco Catalyst SD-WAN
Check Point IPS provides protection against this threat (Cisco Catalyst SD-WAN Manager Authentication Bypass (CVE-2026-76504))
organisation Apple
Apple has patched CVE-2026-86950, a CoreGraphics memory corruption vulnerability affecting iPhones, iPads, and Macs.
organisation CoreGraphics
Apple has patched CVE-2026-86950, a CoreGraphics memory corruption vulnerability affecting iPhones, iPads, and Macs.
organisation iPhones
Apple has patched CVE-2026-86950, a CoreGraphics memory corruption vulnerability affecting iPhones, iPads, and Macs.
organisation Macs
Apple has patched CVE-2026-86950, a CoreGraphics memory corruption vulnerability affecting iPhones, iPads, and Macs.
infrastructure Ios
Apple reported exploitation in highly targeted attacks and addressed the flaw through improved bounds checking across affected iOS, iPadOS, and macOS releases.
infrastructure Macos
Apple reported exploitation in highly targeted attacks and addressed the flaw through improved bounds checking across affected iOS, iPadOS, and macOS releases.
organisation CVE-2026-90970
GitLab has released patches for CVE-2026-90970, a critical AI Gateway vulnerability rated CVSS 9.9.
infrastructure 9.9
GitLab has released patches for CVE-2026-90970, a critical AI Gateway vulnerability rated CVSS 9.9.
organisation GitLab
GitLab has released patches for CVE-2026-90970, a critical AI Gateway vulnerability rated CVSS 9.9.
organisation Foster Care Review Board
Attackers copied backup files containing protective-order records and more than 150,000 Foster Care Review Board reports dating back to 2010, exposing personal and case-related information belonging to current and former participants.
organisation ClickFix
Researchers demonstrated that malicious Custom GPTs hosted on ChatGPT were used in a ClickFix campaign to deliver remote access malware.
organisation PDF
Processing a malicious image or PDF can allow arbitrary code execution.
Tactical Metrics
Metrics
victims
100
Organizations
Researchers mapped Russia-linked Star Blizzard phishing campaigns targeting more than 100 organizations, primarily in the United States and United Kingdom.
Metrics
infrastructure
33
Hosts
The group used compromised SharePoint servers for initial access, disabled endpoint protection on dozens of systems, and deployed ransomware across at least 33 hosts during one intrusion.
Metrics
infrastructure
‎Microsoft 365
Affected Product
Antino uses Microsoft 365 services for command and control, file transfer, system reconnaissance, command execution, and persistence.
The group impersonates prominent economists and AI policymakers, builds rapport through benign emails, then redirects targets to phishing pages designed to steal Microsoft 365 credentials and session cookies.
Metrics
data_breach
365
Credentials
The group impersonates prominent economists and AI policymakers, builds rapport through benign emails, then redirects targets to phishing pages designed to steal Microsoft 365 credentials and session cookies.
Metrics
infrastructure
‎Ios
Affected Product
Apple reported exploitation in highly targeted attacks and addressed the flaw through improved bounds checking across affected iOS, iPadOS, and macOS releases.
Metrics
infrastructure
‎Macos
Affected Product
Apple reported exploitation in highly targeted attacks and addressed the flaw through improved bounds checking across affected iOS, iPadOS, and macOS releases.
Metrics
infrastructure
‎9.9
Software Version
GitLab has released patches for CVE-2026-90970, a critical AI Gateway vulnerability rated CVSS 9.9.
Intelligence Sources
Check Point Research 2026-10-05