Cl0p claims over 40 organizations fell victim to attacks exploiting a PTC Windchill and FlexPLM vulnerability. Cl0p is using a familiar strategy again: exploit one flaw in enterprise software to attack many companies, then publish the victims’ names if they refuse to pay. The group claims it has targeted more than 40 organizations through a vulnerability in PTC’s Windchill and FlexPLM platforms, which manufacturers and engineering companies use to manage product and design data. CVE-2026-12569 (CVSS score of 9.3) is a critical remote code execution (RCE) vulnerability in PTC Windchill PDMlink and PTC FlexPLM. An attacker can exploit this vulnerability through the deserialization of untrusted data. The flaw impacts all CPS versions and Windchill and FlexPLM releases prior to 11.0 M030. In June, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog. German police reportedly warned organizations directly that attacks were coming, which tells you the exploitation window here wasn’t exactly subtle to security researchers watching it unfold. Cl0p group’s tooling for this campaign goes well beyond a basic web shell. Security firm ReliaQuest found the group deployed a custom implant built for full data theft on its own, no additional tools required to actually pull data out once inside. A class loader like that turns a single web shell into an open-ended backdoor, useful for lateral movement, ransomware deployment, or just quietly sitting there for months. “ReliaQuest identified the web shell as a fully equipped extortion platform: it maps sensitive vault data, decrypts every credential in the Windchill keystore, and includes a custom Java class loader that lets Clop execute any additional code inside the application process, extending the shell into an unlimited backdoor for follow-on activity such as lateral movement, ransomware, or persistence.” reads the report published by ReliaQuest. “The web shell gives attackers a direct path to credential theft and large-scale data exfiltration, with no additional tooling required. Unlike generic command shells, this implant decrypts credentials, delivers malware, and maps stored files for exfiltration.” Cl0p’s naming strategy followed its usual slow build. The group initially posted partial company names on its leak site, then switched to full names starting August 12, and the victim count has climbed steadily since. For each organization, the listing includes what type of data got stolen and roughly how much, ranging anywhere from a single gigabyte up to multiple terabytes depending on the target. The stolen data includes databases, project files, backups, engineering documents, blueprints, diagrams and corporate files, as well as images. The victim list reads like a cross-section of major manufacturing and industrial names: Shell, Philips, Fiserv, Zebra Technologies, Ingersoll Rand, Toast, Mindray, and Largan Precision, the company that supplies camera lenses for Apple’s devices. Researchers noticed that GE was on the list briefly before quietly disappearing from Cl0p’s site, a move that usually signals either a ransom payment or at least resumed negotiations behind closed doors. Shell, Philips, Fiserv, and GE have all publicly acknowledged awareness of the claims and said they’re investigating, though none has confirmed a significant breach so far. None of this is a new pattern for Cl0p specifically; it’s the same mass-exploitation-then-extortion model the group has run repeatedly against Oracle E-Business Suite, MOVEit, Cleo, and GoAnywhere over the past few years. What’s different this time is the target: enterprise PLM software sits deep inside manufacturing supply chains, holding the exact kind of engineering data that competitors and nation-states alike would pay real money to see. If your organization runs Windchill or FlexPLM and hasn’t checked for this specific CVE yet, that’s the item to move to the top of today’s list. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Cl0p )
Check Point Research has disclosed a technique that uses Microsoft Defender's own legitimately signed boot-time remediation driver to perform arbitrary kernel-level file and registry operations on Windows systems ranging from Windows 7 through Windows 11 25H2, with no software flaw exploited and no driver imported from outside the machine. The driver, BTR.sys (Boot Time Removal Tool), is a
Artificial Intelligence (AI) has become one of this decade's defining technologies. From healthcare and finance to manufacturing and education, organizations increasingly rely on AI to automate repetitive tasks, uncover patterns hidden within large datasets, and support faster decision-making. Cybersecurity has experienced a similar transformation. While attackers employ AI to automate
A newly disclosed security flaw in GitLab has come under active exploitation within days of public disclosure, according to watchTowr. The vulnerability in question is CVE-2026-19478 (CVSS score: 9.4), a case of code injection that allows an unauthenticated attacker to modify or delete publicly accessible GitLab projects and rewrite their data under certain conditions without requiring
Manic Android malware combines banking fraud and spyware, using a Bluetooth relay to steal data even when devices are offline. ThreatFabric’s Mobile Threat Intelligence team has identified a new Android malware, dubbed Manic, which has been active in the wild since at least February 2026. The researchers state that the malware is still under development as of July. “Manic sits at the intersection of Android banking malware and mobile spyware, combining financial-fraud capabilities with broader surveillance and device-control features.” reads the report published by the ThreatFabric’s Mobile Threat Intelligence team. “Its targeting is strongly focused on Ukraine, covering Ukrainian banks, government and identity services, and messaging applications, while also extending to Russian and European financial institutions, global fintech and cryptocurrency services, and military-focused communications.” The malware monitors 169 different Android apps, including banking and payment apps across several European countries, government and eID services, crypto exchanges and wallets, 2FA tools, messaging apps, browsers and email clients. This wide coverage appears deliberate. By targeting both financial and communication apps, the attackers can track a victim’s money, messages, location and files from the same device. ThreatFabric traces the first infrastructure registrations back to February 2026, with development and production services appearing in late March and April. By July, an updated build had added stronger anti-analysis checks, in-memory DEX loading, and a technique the researchers call lock-secret phishing, which extracts the device PIN or pattern by presenting a fake prompt before the victim reaches the real lock screen. Once installed, Manic requests Accessibility and notification access, then uses the Accessibility service as a UI keylogger. It classifies everything it captures before logging it: lock-screen input, recovery phrase candidates, four-to-six-digit SMS codes, passwords, long messages, email logins, and ordinary text. “Manic uses its Accessibility service as a UI keylogger. It classifies captured text before recording it, distinguishing lock-screen input, recovery-phrase candidates, four- to six-digit SMS codes, passwords, long messages, email logins, and ordinary text.” continues the report. “Each key log record includes the app and package, captured text, timestamp, whether the input came from Autofill or manual entry, and whether the app is on Manic’s target list “ Each log record includes the app name and package, the captured text, a timestamp, whether input came from autofill or manual entry, and whether the app is on Manic’s target list. The PIN theft technique works differently from a typical banking overlay. When Manic detects a numeric keypad in a targeted app, it places an invisible layer over the keys and records each tap. It then briefly passes the tap to the real keypad using Android’s Accessibility features, so the banking app works normally while Manic captures the PIN. Another function, called autoEnterPin, can try to enter a stored PIN or pattern on the Android lock screen. This gives attackers two options: capture a PIN during a banking session and later use it to unlock the device without the victim being present. According to the researchers, Manic stands out for its offline relay. “Manic uses a store-and-forward relay mechanism to exfiltrate data even when the infected device cannot reach the C2 server directly.” continues the report. “Collected files and command results are encrypted with AES-GCM and placed in a local queue, allowing the source device to remain offline while the malware searches for another infected device that can provide a route to the C2 infrastructure.” Manic searches for nearby infected devices over Wi-Fi Direct, Bluetooth RFCOMM, or BLE GATT, and supports chains of up to four relay hops. Cutting an infected phone off from the Internet doesn’t cut it off from exfiltration, as long as another infected device is within radio range. It’s a store-and-forward mesh built out of other people’s compromised phones. Manic gives attackers remote control of the device through WebRTC, allowing them to view the screen and interact with it using Android’s Accessibility features. It can hide its activity with black screens, fake screens or fake update messages, while also covering permission requests. The July version goes a step further by removing itself from the device’s app launcher. This keeps it out of the normal app list and lets attackers activate it through its wrapper or a deep link. For defenders, the combination here is complete in an uncomfortable way: credential theft, live screen monitoring, authentication interception, device takeover, and an exfiltration path that doesn’t require the infected device to have Internet access at all. Monitoring for unusual Accessibility service grants and unexpected Bluetooth or Wi-Fi Direct connections from phones that aren’t actively transferring files are the most practical detection starting points. “Manic is an evolving Android fraud platform designed for Device Takeover (DTO), combining credential and authentication theft with live screen monitoring and remote control. Its targeting spans banks, payment and cryptocurrency services, eID applications, and messengers, with a strong focus on Ukraine.” concludes the report. “A particularly distinctive capability is its offline mesh relay, which allows collected data to move through nearby infected devices over Wi-Fi Direct or Bluetooth when direct C2 access is unavailable. “ Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Android Malware)
Hackers compromised the maintainer account behind the widely used Rust crate arrayref to introduce malware that executed on developers’ systems during compilation. Within a 23-minute window, the attacker also poisoned two other crates, append-only-vec and internment, in the same supply-chain attack. The arrayref crate is a popular Rust library with more than 53 million downloads over the past 90 days that is used by cryptography, graphics, and blockchain tools. A report from application security company StepSecurity notes that the malicious Rust crate releases were arrayref 0.3.10, append-only-vec 0.1.9, and internment 0.8.7, all maintained by the same account. The hacker injected a dependency on a package called proc-macro1, a typosquat impersonating the popular proc-macro2 crate, while retaining the rest of the upstream source code completely unchanged.
A critical vulnerability in the Elementor Pro WordPress plugin could allow attackers to upload executable files for remote code execution on the server. Identified as CVE-2026-32475, the flaw affects Elementor Pro versions before 4.2.2 and stems from the File Upload module, which uses separate loops for file validation and processing that handle empty filename uploads differently. “The problem is that these two loops disagree about what to do with an empty file entry (an upload part whose filename is blank, which PHP reports as UPLOAD_ERR_NO_FILE),” clarifies a report from Patchstack, a cybersecurity company focused on the WordPress ecosystem. “The validation loop and the processing loop have different early-exit logic for these empty entries, so a carefully shaped multi-part upload can be seen one way by the validator and another way by the mover.”
Official websites use .gov A .gov website belongs to an official government organization in the United States. Secure .gov websites use HTTPS A lock (LockA locked padlock) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. Staying Secure at Eventsno-cost Cyber ServicesCybersecurity Awareness MonthKnown Exploited Vulnerabilities CatalogReport A Cyber Issue WASHINGTON – Today, the Cybersecurity and Infrastructure Security Agency (CISA) published the Logging Reference Architecture, an outcome-driven guide for federal civilian executive branch (FCEB) agencies to establish logging, visibility and operational standards in an Agency Logging Plan, as required in Office of Management and Budget (OMB) Memorandum M-26-14. Developed in collaboration with OMB and the Chief Information Security Officers (CISO) Council, this guidance implements a practical, risk-based, prioritized logging approach that improves agency network monitoring.
A new Android malware named Manic targeting users in multiple European countries has a fallback mechanism for exfiltrating data through nearby infected devices. The malware has been active since at least February and combines spyware, banking fraud, and remote control capabilities. It targets at least 169 banking, government/eID, payment, crypto wallet, messaging, and authenticator/2FA apps, with users in Ukraine being the primary focus. Mobile security company ThreatFabric analyzed the Manic malware and found that it uses transparent overlays on the numeric keypads of legitimate applications to capture victims' taps and reproduce them through Android Accessibility, allowing the legitimate applications to continue functioning normally. After obtaining Accessibility and notification access permissions, the malware can capture the lock PIN/password, intercept notifications and SMS messages, collect files and location data, monitor the screen, and provide remote control to operators via WebRTC sessions.
CERT Polska, the Polish Computer Emergency Response Team (CERT), warned that attackers have begun exploiting a critical vulnerability in Zimbra Collaboration Suite (ZCS). ZCS is a popular email and collaboration software suite used by hundreds of millions of people and organizations worldwide, including thousands of businesses and hundreds of government agencies. The Zimbra security team released version 10.1.20 on July 20 to patch the vulnerability (tracked as CVE-2026-73570), which allows unauthenticated attackers to gain remote code execution by exploiting a command injection weakness in the SNMP monitoring component when SNMP notifications are enabled. "Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user," it explained.
Confirm this action.
Leaving now will discard your changes.