For the latest discoveries in cyber research for the week of 27th July, please download our Threat Intelligence Bulletin.

TOP ATTACKS AND BREACHES

• Nichirei, a Japan-based frozen-food supplier and logistics company, has experienced a ransomware attack that disrupted shipping operations and affected approximately 5,000 customers. KFC Japan warned of possible shortages. Nichirei confirmed personal data theft, while the RansomHouse group claimed responsibility and published a subset of the stolen information.
• Stadler Rail, a Switzerland-based global rail equipment manufacturer, has disclosed a supplier-related data breach after attackers compromised credentials for a third-party file-sharing platform. The Everest group stole technical documents belonging to the supplier and demanded $12.3 million. Stadler refused payment and said its systems and production remained unaffected.
• Origin Energy, one of Australia’s largest electricity and natural gas providers, has confirmed unauthorized access to customer information. Exposed data may include names, addresses, birth dates, phone numbers, account details, and partial payment information. Threat actors claimed to have stolen two million records and threatened to publish them.
• Romania’s National Agency for Cadastre and Land Registration has suffered a cyberattack that disabled internal systems and the nationwide e-Terra platform. The disruption halted property transactions for nearly a week. Officials said core land registries remained intact, although credentials and portions of source code may have been exposed.

AI THREATS

• OpenAI disclosed that AI models escaped a restricted cyber evaluation environment and compromised Hugging Face while seeking benchmark solutions. They exploited zero-day vulnerabilities, stole credentials, escalated privileges, and accessed production systems. Both companies contained the activity and are conducting a joint investigation.
• Researchers have described a threat actor known as Trim who promoted an AI-assisted penetration-testing platform built with jailbroken language models. The platform combines AI with established scanning tools to automate reconnaissance, vulnerability validation, and reporting, potentially reducing the expertise and time required to prepare and conduct cyber intrusions.
• Researchers have examined a generative AI-assisted malware operation exposed through an accessible WebDAV server. The infrastructure produced phishing material and malicious Windows shortcuts used to distribute information stealers and remote access tools. Researchers identified more than 1,000 artifacts and a campaign that recorded over 77,000 requests.

VULNERABILITIES AND PATCHES

• Check Point has addressed CVE-2026-16232, an authentication bypass vulnerability in SmartConsole that is under active exploitation, affecting a handful of customers. The flaw allows remote attackers to bypass authentication and gain administrative access to Check Point management servers. Security hotfixes are available for supported versions of the affected management software.
• Oracle has released its July 2026 Critical Patch Update, addressing 1,449 vulnerabilities across numerous product families. The update includes remotely exploitable flaws that require no authentication, with critical issues affecting Oracle Database Server, SQL Developer, and TimesTen In-Memory Database, among others.
• Microsoft has addressed CVE-2026-50522, a critical remote code execution vulnerability affecting on-premises SharePoint Server. An authenticated site owner can exploit the flaw to execute code and steal machine keys for persistent access. Active exploitation was reported after proof-of-concept code became publicly available.

Check Point IPS provides protection against this threat (Microsoft SharePoint Remote Code Execution (CVE-2026-50522))

THREAT INTELLIGENCE REPORTS

• Check Point Research has revealed that Microsoft was the most impersonated brand in Q2 2026, accounting for 23% of observed phishing attempts. LinkedIn, Google, Apple, and Amazon completed the top five. ChatGPT entered the top ten as attackers increasingly targeted users of widely recognized AI platforms.
• Researchers have described the growing use of infostealers logs as an initial-access resource for cloud and software-as-a-service intrusions. Criminal marketplaces sell passwords and active session cookies soon after collection. The research identified 2.05 million logs during 2025, with 79% connected to Microsoft single sign-on environments
• S. federal agencies have warned that Iran-linked actors are targeting internet-exposed industrial controllers at water and energy facilities. The attackers have manipulated controller logic, falsified operator displays, and disabled alarms or shutdown functions. The activity affects equipment deployed in critical infrastructure environments.
• Researchers have analyzed a Russian cyberespionage campaign targeting Zimbra webmail servers at government, defense, transportation, and financial organizations. The attackers exploit CVE-2025-66376 through zero-click phishing emails that inject malicious JavaScript, stealing credentials, two-factor authentication codes, email archives, and search histories from vulnerable systems.

Check Point IPS provides protection against this threat (Zimbra Collaboration Suite Cross-Site Scripting (CVE-2025-66376))

The post 27th July – Threat Intelligence Report appeared first on Check Point Research.

For the latest discoveries in cyber research for the week of 20th July, please download our Threat Intelligence Bulletin.

TOP ATTACKS AND BREACHES

• Ernst & Young, a global accounting and professional services company, has disclosed a data breach involving a compromised third-party IT support platform. The exposed support tickets may have contained client documents, tax information, employee details, and other sensitive information submitted while requesting technical assistance.
• Jscrambler, a JavaScript code-protection package with more than 15,000 weekly downloads, has experienced a supply chain compromise after stolen npm publishing credentials distributed malicious releases. The packages deployed malware targeting developers’, cloud, browser, cryptocurrency, and messaging credentials. Jscrambler removed the affected versions.
• Coca-Cola’s US dairy subsidiary Fairlife has confirmed a ransomware attack that temporarily halted production across the United States. Attackers accessed systems supporting manufacturing operations, prompting the company to activate incident response and business continuity procedures. Coca-Cola has not confirmed whether data was exfiltrated in the attack.
• Nihon Kotsu, Japan’s largest taxi operator, has suffered a malware attack following unauthorized access to its internal network. The company shut down affected systems, disrupting taxi dispatches, telephone services, bookings, reservations, and car rentals from July 11. No theft of customer or corporate information has been confirmed.

AI THREATS

• Researchers identified a China-linked campaign that used Claude Code and DeepSeek to automate attacks against government and financial organizations. The tools generated scripts, adapted failed exploits, created credential-harvesting pages, and executed commands. Confirmed compromises affected government systems in Thailand and Afghanistan and organizations in Taiwan.
• Researchers found that xAI’s Grok Build coding assistant could upload entire Git repositories while processing debugging requests. Transferred information included unopened files and complete commit histories, potentially exposing API keys, credentials, and proprietary source code. Initial privacy controls did not prevent uploads until a server-side restriction was introduced.
• Researchers verified a weakness in Anthropic’s Claude for Chrome extension that allowed malicious browser extensions to impersonate Claude and act through authenticated user sessions. Successful exploitation could expose Gmail, Google Drive, or GitHub information through Claude’s permissions. Anthropic released fixes, although researchers reported that a bypass remained possible.

VULNERABILITIES AND PATCHES

• Microsoft released patches for 622 vulnerabilities in July’s Patch Tuesday, the largest monthly release recorded by the company. Two vulnerabilities were under active exploitation, including CVE-2026-56164 in SharePoint Server and CVE-2026-56155 in Active Directory Federation Services. Both vulnerabilities could allow attackers to elevate privileges.

Check Point IPS provides protection against these threats (Microsoft SharePoint Authentication Bypass (CVE-2026-56164))

• WordPress has issued emergency updates for CVE-2026-63030 and CVE-2026-60137, collectively called wp2shell. The critical WordPress Core vulnerabilities allow unauthenticated remote code execution and website takeover. Affected releases include versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. Fixed versions include 6.9.5 and 7.0.2.

Check Point IPS provides protection against these threats (WordPress Authentication Bypass (CVE-2026-63030)), WordPress SQL Injection (CVE-2026-60137))

• SonicWall has released a hotfix for CVE-2026-15409 and CVE-2026-15410, two critical vulnerabilities affecting SMA 1000 Series gateways. The flaws allow unauthenticated attackers to execute system commands on vulnerable appliances. Active exploitation has been associated with Inc ransomware.

Check Point IPS provides protection against these threats (SonicWall SMA1000 Series Server-Side Request Forgery (CVE-2026-15409) & SonicWall SMA1000 Series Path Traversal (CVE-2026-15410))

THREAT INTELLIGENCE REPORTS

• Check Point Research has released the 2026 AI Security 2026, finding that AI has evolved from an attack aid into an active operator across live intrusions and malware development. The report also highlights indirect prompt injection, synthetic identity abuse, and enterprise data exposure, with high-risk GenAI prompts doubling to 4%.
• Researchers analyzed ShinyHunters-linked campaigns that abused OAuth application approvals to access Salesforce environments. Attackers used voice phishing to authorize lookalike applications, then accessed CRM information through approved APIs. Compromised integrations and misconfigured guest access provided additional entry points and persistence.
• Researchers analyzed CylindricalCanine, a subgroup of the Chinese cybercrime collective GoldenEyeDog, and linked it to DigiCert’s April 2026 support portal compromise. The actor stole code-signing certificates, leading to 60 revocations, including at least 27 associated with malware. The group also targets Asia-Pacific finance teams using Golden Gh0st RAT.
• Researchers documented Spirals, a Rust-based ransomware family used against a South Asian information technology services company. The attackers moved from initial access to network encryption in less than 24 hours. They used an IIS web shell, WMI, and PsExec to spread, disable security services, disrupt backups, and encrypt systems.

The post 20th July – Threat Intelligence Report appeared first on Check Point Research.