INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Lazarus Group Exploits Vulnerability in Microsoft Office to Steal Data

| 2026-10-26 16:12 CRITICAL MEDIUM DATA BREACH
JSON
Executive Summary
AI-generated
On October 26, 2026, a data breach was disclosed by India's State Bank of India after 3,897 customer records appeared online. The exposed information included contact details, residential addresses, birth dates, bank profiles, loan records, and identity-verification documents. Researchers observed affiliates of IN using AI agents to conduct human-approved cyberattacks targeting 62 organizations in the manufacturing, energy, healthcare, and pharmaceutical sectors primarily in the United States. Attackers exploited remote-access systems and compromised credentials, utilizing AI-generated scripts and reconnaissance reports to develop attack capabilities. The current status indicates that no disruption was reported by the bank, but the incident highlights a potential vulnerability with PHP versions CVE-2026-109618 and CVE-2026-109619, which have been widely exploited in recent attempts.
Technical Mitigations AI-generated
• Apply the vendor fix for CVE-2026-110264, CVE-2026-109618 and treat internet-facing systems that were not patched in time as potentially compromised until verified. • Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
ShinyHuntersShinyHuntersThe GentlemenThe Gentlemen CVE-2026-110264CVE-2026-110264 CVE-2026-109618CVE-2026-109618 CVE-2026-114625CVE-2026-114625 CVE-2026-115560CVE-2026-115560 CVE-2026-109619CVE-2026-109619
Target & Sectors
NORTH_AMERICA NORTH_AMERICA energyenergy manufacturingmanufacturing healthhealth technologytechnology telecommunicationstelecommunications pharmaceuticalpharmaceutical
Incident Timeline
‎October 18 and 19
Attackers used compromised UpdraftCentral keys to install backdoors on WordPress websites during an 18-hour campaign spanning October 18 and 19.
organisation UpdraftCentral
Attackers subsequently abused compromised UpdraftCentral keys to install backdoors on WordPress websites during an 18-hour campaign on October 18 and 19.
general_metric 18 hour
Attackers subsequently abused compromised UpdraftCentral keys to install backdoors on WordPress websites during an 18-hour campaign on October 18 and 19.
‎October 21
Threat actors used stolen developer tokens to publish malicious packages and Docker images on October 21.
‎October 23
Approximately 97.5% of publicly visible PHP instances did not indicate patched versions as of October 23.
infrastructure 97.5
As of October 23, approximately 97.5% of publicly visible PHP instances did not indicate patched versions.
organisation PHP
As of October 23, approximately 97.5% of publicly visible PHP instances did not indicate patched versions.
general_metric 97.5 %
As of October 23, approximately 97.5% of publicly visible PHP instances did not indicate patched versions.
‎the week of 26th October
Threat actors released a Threat Intelligence Bulletin for the week of 26th October.
‎between May and October 2026
Threat actors published a list of nearly 100 organizations between May and October 2026.
victims 100 organizations
The site reportedly listed nearly 100 organizations between May and October 2026.
‎2026/10/26
Threat actors exploited Critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 to target 62 organizations, including manufacturing, energy, healthcare, and pharmaceutical sectors in the United States.
organisation State Bank of India
India’s state-run State Bank of India, serving more than 500 million customers, disclosed a data breach after 3,897 customer records appeared online.
victims 500 customers
India’s state-run State Bank of India, serving more than 500 million customers, disclosed a data breach after 3,897 customer records appeared online.
data_breach 3,897 customer records
India’s state-run State Bank of India, serving more than 500 million customers, disclosed a data breach after 3,897 customer records appeared online.
organisation INC
Researchers observed affiliates of INC and The Gentlemen ransomware groups using AI agents to conduct human-approved cyberattacks.
threat_actor The Gentlemen
Researchers observed affiliates of INC and The Gentlemen ransomware groups using AI agents to conduct human-approved cyberattacks.
infrastructure 1.107.0
The compromised version 1.107.0 was designed to steal cloud credentials and AI service secrets, with attackers subsequently testing stolen AWS credentials.
organisation Critical PHP
VULNERABILITIES AND PATCHES Critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 have been used in widespread exploitation attempts that could enable remote code execution.
organisation CVE-2026
VULNERABILITIES AND PATCHES Critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 have been used in widespread exploitation attempts that could enable remote code execution.
organisation Onamae Desktop Cloud
TOP ATTACKS AND BREACHES Japanese cloud hosting provider Onamae Desktop Cloud has confirmed a cyberattack in which intruders compromised its infrastructure and installed malware on customer servers.
organisation WordPress
WordPress backup developer TeamUpdraft has suffered a cyberattack after intruders accessed its website and potentially exposed customer information and management-service connection keys.
organisation TeamUpdraft
WordPress backup developer TeamUpdraft has suffered a cyberattack after intruders accessed its website and potentially exposed customer information and management-service connection keys.
organisation Check Point Research
AI THREATS Check Point Research uncovered how AI-enabled antidetect browsers allow operators to manage thousands of deceptive accounts while evading platform safeguards.
organisation Kameleo
Tools including Kameleo, AdsPower, and MultiLogin facilitate account takeovers, financial fraud, and automated distribution of AI-generated content, supporting large-scale influence operations across social media platforms.
organisation AdsPower
Tools including Kameleo, AdsPower, and MultiLogin facilitate account takeovers, financial fraud, and automated distribution of AI-generated content, supporting large-scale influence operations across social media platforms.
organisation MultiLogin
Tools including Kameleo, AdsPower, and MultiLogin facilitate account takeovers, financial fraud, and automated distribution of AI-generated content, supporting large-scale influence operations across social media platforms.
infrastructure 26,000 servers
More than 26,000 servers were potentially affected.
victims 62 organizations
The operation targeted 62 organizations by exploiting remote-access systems and compromised credentials.
‎October 2026
Threat actors used tailored phishing messages and fraudulent portfolio websites to deliver malware.
vulnerability CVE-2026-109618
Check Point IPS provides protection against this threat (PHP Remote Code Execution (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560(( Oracle has released its October 2026 Critical Patch Update, addressing 1,209 unique vulnerabilities through 1,295 security patches across 33 product families.
vulnerability CVE-2026-109619
Check Point IPS provides protection against this threat (PHP Remote Code Execution (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560(( Oracle has released its October 2026 Critical Patch Update, addressing 1,209 unique vulnerabilities through 1,295 security patches across 33 product families.
tactic Remote Code Execution
Check Point IPS provides protection against this threat (PHP Remote Code Execution (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560(( Oracle has released its October 2026 Critical Patch Update, addressing 1,209 unique vulnerabilities through 1,295 security patches across 33 product families.
vulnerability CVE-2026-115560
Check Point IPS provides protection against this threat (PHP Remote Code Execution (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560(( Oracle has released its October 2026 Critical Patch Update, addressing 1,209 unique vulnerabilities through 1,295 security patches across 33 product families.
organisation Check Point
Check Point IPS provides protection against this threat (PHP Remote Code Execution (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560(( Oracle has released its October 2026 Critical Patch Update, addressing 1,209 unique vulnerabilities through 1,295 security patches across 33 product families.
organisation Patch Update
Check Point IPS provides protection against this threat (PHP Remote Code Execution (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560(( Oracle has released its October 2026 Critical Patch Update, addressing 1,209 unique vulnerabilities through 1,295 security patches across 33 product families.
general_metric 1,209 unique vulnerabilities
Check Point IPS provides protection against this threat (PHP Remote Code Execution (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560(( Oracle has released its October 2026 Critical Patch Update, addressing 1,209 unique vulnerabilities through 1,295 security patches across 33 product families.
general_metric 1,295 security patches
Check Point IPS provides protection against this threat (PHP Remote Code Execution (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560(( Oracle has released its October 2026 Critical Patch Update, addressing 1,209 unique vulnerabilities through 1,295 security patches across 33 product families.
general_metric 33 product families
Check Point IPS provides protection against this threat (PHP Remote Code Execution (CVE-2026-109618, CVE-2026-109619, CVE-2026-115560(( Oracle has released its October 2026 Critical Patch Update, addressing 1,209 unique vulnerabilities through 1,295 security patches across 33 product families.
threat_actor ShinyHunters
Researchers revealed that U.S. federal investigators suspect an executive at a ransomware negotiation company assisted the ShinyHunters extortion group in operating its victim disclosure website.
data_breach 70,000 credentials
The operation exposed more than 70,000 credentials and showed possible connections to ransomware groups.
infrastructure 10.0
GitLab has fixed CVE-2026-110264, a critical vulnerability with a CVSS score of 10.0 affecting Community and Enterprise Editions.
organisation GitLab
GitLab has fixed CVE-2026-110264, a critical vulnerability with a CVSS score of 10.0 affecting Community and Enterprise Editions.
organisation CVSS
GitLab has fixed CVE-2026-110264, a critical vulnerability with a CVSS score of 10.0 affecting Community and Enterprise Editions.
organisation Community and Enterprise Editions
GitLab has fixed CVE-2026-110264, a critical vulnerability with a CVSS score of 10.0 affecting Community and Enterprise Editions.
infrastructure 18.11.13
The vulnerability affects versions before 18.11.13 and several 19.x releases.
infrastructure Cursor
Targeted applications include Claude, ChatGPT Desktop, Cursor, and GitHub Copilot.
organisation Claude
Targeted applications include Claude, ChatGPT Desktop, Cursor, and GitHub Copilot.
organisation GitHub Copilot
Targeted applications include Claude, ChatGPT Desktop, Cursor, and GitHub Copilot.
infrastructure Fortigate
Researchers have uncovered a large-scale campaign by threat actor k0t targeting Fortinet FortiGate, FortiWeb, and Palo Alto Networks GlobalProtect devices.
organisation Fortinet FortiGate
Researchers have uncovered a large-scale campaign by threat actor k0t targeting Fortinet FortiGate, FortiWeb, and Palo Alto Networks GlobalProtect devices.
organisation FortiWeb
Researchers have uncovered a large-scale campaign by threat actor k0t targeting Fortinet FortiGate, FortiWeb, and Palo Alto Networks GlobalProtect devices.
organisation Palo Alto Networks GlobalProtect
Researchers have uncovered a large-scale campaign by threat actor k0t targeting Fortinet FortiGate, FortiWeb, and Palo Alto Networks GlobalProtect devices.
organisation Fusion Middleware
The update includes 95 critical CVEs and affects widely deployed enterprise products, including Fusion Middleware, E-Business Suite, MySQL, and Java SE.
Tactical Metrics
Metrics
victims
500,000,000
Customers
India’s state-run State Bank of India, serving more than 500 million customers, disclosed a data breach after 3,897 customer records appeared online.
Metrics
data_breach
3,897
Customer Records
India’s state-run State Bank of India, serving more than 500 million customers, disclosed a data breach after 3,897 customer records appeared online.
Metrics
data_breach
70,000
Credentials
The operation exposed more than 70,000 credentials and showed possible connections to ransomware groups.
Metrics
infrastructure
‎1.107.0
Software Version
The compromised version 1.107.0 was designed to steal cloud credentials and AI service secrets, with attackers subsequently testing stolen AWS credentials.
Metrics
infrastructure
‎97.5
Software Version
As of October 23, approximately 97.5% of publicly visible PHP instances did not indicate patched versions.
Metrics
infrastructure
‎10.0
Software Version
GitLab has fixed CVE-2026-110264, a critical vulnerability with a CVSS score of 10.0 affecting Community and Enterprise Editions.
Metrics
infrastructure
‎18.11.13
Software Version
The vulnerability affects versions before 18.11.13 and several 19.x releases.
Metrics
infrastructure
‎Cursor
Affected Product
Targeted applications include Claude, ChatGPT Desktop, Cursor, and GitHub Copilot.
Metrics
infrastructure
‎Fortigate
Affected Product
Researchers have uncovered a large-scale campaign by threat actor k0t targeting Fortinet FortiGate, FortiWeb, and Palo Alto Networks GlobalProtect devices.
Metrics
victims
100
Organizations
The site reportedly listed nearly 100 organizations between May and October 2026.
Metrics
infrastructure
26,000
Servers
More than 26,000 servers were potentially affected.
Metrics
victims
62
Organizations
The operation targeted 62 organizations by exploiting remote-access systems and compromised credentials.
Intelligence Sources
Check Point Research 2026-10-26