- within Strategy topic(s)
Malware Activity
AI-Powered Threats Exploit Cloud Services and Target Critical AI Assets
Recent research highlights a concerning shift in cyber threats as attackers are increasingly leveraging artificial intelligence and trusted cloud platforms to conduct sophisticated operations with minimal human involvement. The JADEPUFFER threat actor demonstrated this evolution by autonomously exploiting vulnerable systems, adapting to obstacles in real time, harvesting cloud credentials, and deploying a specialized ransomware strain known as EncForge. EncForge targets valuable AI assets such as training datasets, model checkpoints, vector databases, and embeddings. At the same time, researchers uncovered HollowGraph, a stealthy malware component that abuses legitimate Microsoft 365 and Microsoft Graph services to communicate with attackers through hidden calendar events. This allowed commands and stolen data to blend in with normal business activity. Both threats rely on strong encryption techniques, automated decision-making, and the abuse of trusted environments to evade detection and maintain persistence. Together, these campaigns illustrate how threat actors are combining AI-driven capabilities, cloud infrastructure abuse, and advanced stealth techniques to increase the speed, scale, and effectiveness of modern cyberattacks against enterprise and AI-focused environments. CTIX analysts will continue to report on the latest malware strains and attack methodologies.
- BleepingComputer: JadePuffer Agentic Attacks Now Target AI Model Data With Ransomware article
- BleepingComputer: New HollowGraph Malware Uses Microsoft Graph For Stealthy C2 Comms article
Threat Actor Activity
Qilin Ransomware Exploits Palo Alto GlobalProtect VPN Flaw
Arctic Wolf Labs reports that Qilin (aka Agenda), a Ransomware-as-a-Service (RaaS) operation, is actively exploiting CVE-2026-0257, a critical authentication bypass in Palo Alto Networks’ PAN-OS GlobalProtect portal and gateway, to gain initial access to victim networks. The flaw, patched on May 13th and added to CISA’s Known Exploited Vulnerability catalog on May 29th, allows unauthenticated attackers to establish VPN sessions without valid credentials under certain certificate and cookie configurations. In multiple intrusions observed in June 2026, exploitation of CVE-2026-0257 against PAN-OS firewalls led to domain-wide Qilin ransomware deployments. Affiliates showed consistent patterns but varied between pure encryption attacks and full double extortion with credential theft and data exfiltration to services like MEGA, Proton Drive, and via Rclone/FileZilla. Observed affiliate tactics included staging payloads in “C:\PerfLogs\”, using PsExec for lateral movement via admin shares, deploying password-protected binaries, and aggressively clearing logs and disabling Microsoft Defender real-time protection. Given extensive scanning and Qilin’s RaaS model, these VPN-based intrusions are likely ongoing and CTIX Analysts recommend that organizations patch GlobalProtect instances and harden PAN-OS devices.
Vulnerabilities
Attackers Begin Exploiting Critical ServiceNow AI Platform RCE Vulnerability
Attackers have begun actively exploiting a critical pre-authentication remote code execution (RCE) vulnerability affecting the ServiceNow AI Platform, just days after patches were released for self-hosted deployments. Originally discovered by Searchlight Cyber, the flaw, tracked as CVE-2026-6875, enables unauthenticated attackers to escape the platform’s sandbox and execute arbitrary code through a high-complexity attack, with exploitation targeting the “/assessment_thanks.do” endpoint using a technique different from the published proof-of-concept. ServiceNow began patching hosted instances in April of 2026 and released updates for self-hosted environments on July 13, but threat intelligence firm Defused confirmed in-the-wild exploitation beginning on July 17. While ServiceNow states it has not observed attacks against its hosted instances and has not officially classified the flaw as actively exploited, it is urging all customers to apply the available security updates immediately. The vulnerability poses significant risk due to the widespread adoption of the ServiceNow AI Platform, which powers more than 100 billion workflows annually and is used by approximately 85% of Fortune 500 companies, making timely patching particularly important for enterprise organizations. CTIX analysts urge any affected administrators to ensure that they are ensuring they are running the most recent patches of ServiceNow to ensure that they are still not vulnerable to exploitation.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]