Saturday, 25 July 2026

Swiss autism-support foundation Stiftung Autismuslink confirms data-theft cyberattack; INC Ransom claims it

Stiftung Autismuslink (a Bern-based foundation providing school, coaching and vocational-integration services to adolescents and young adults with autism) published a signed victim notice confirming a cyberattack: "Ende Juni wurde unsere IT-Infrastruktur Opfer eines Cyberangriffs. Nach aktueller Erkenntnis wurden grössere Datenmengen durch die Angreifer abgezogen und unser Server vorübergehend verschlüsselt" (end of June our IT infrastructure fell victim to a cyberattack; larger volumes of data were exfiltrated and our server temporarily encrypted) (Stiftung Autismuslink, 2026-07). The foundation states the irregularity was detected Monday 2026-06-29, the system was immediately isolated from the internet, an external IT provider (Infoguard) was engaged for forensics the same day, the relevant authorities were notified and a criminal complaint filed with the police. Backups were verified unaffected. The INC Ransom (Incransom) double-extortion group posted a leak-site claim against autismuslink.ch on 2026-07-24 consistent in victim identity and timeline (Ransomware.live, 2026-07-24), a relatively rare case of same-day victim self-disclosure and leak-site claim converging.

The disclosure event (site notice plus leak-site claim) is what falls in this window; the underlying intrusion dates to late June. What makes it relevant beyond a single victim is the data class: per the foundation, affected material includes service agreements with the Swiss disability insurance (IV) and a cantonal education/culture directorate (BKD), teacher contracts, doctors' certificates and the complete client dossier archive 2016-2023 for minors and young adults.

Unattended AI agent in 'YOLO mode' automated post-exploitation against Thailand's Finance Ministry, a transferable government-network TTP

Hunt.io (with researcher Bob Diachenko) found three simultaneously-exposed open directories (585 files, ~470 MB of exploit code, webshells, stolen credentials and operator logs) tied to an intrusion against Thailand's Ministry of Finance, published 2026-07-23 (Hunt.io, 2026-07-23). The distinguishing feature is the automation layer: the operator ran Hermes, an open-source autonomous AI agent, and, per Hunt.io; "the operator ran the agent in unattended or YOLO mode, bypassing approval prompts for commands that could be considered dangerous." Recovered agent logs show it autonomously enumerating ministry hosts, traversing the filesystem, running a custom LinPEAS privilege-escalation script (probing several 2026 Linux-kernel LPE flaws and older sudo/polkit bugs), enumerating SUID/SGID binaries and running services, and recursively harvesting documents from a target office, each step executed without a human approving it. This is the second AI-agent-driven autonomous-attack disclosure this pipeline has tracked in roughly a week, marking a shift from AI-assisted to AI-unattended post-exploitation where an off-the-shelf agent framework, not bespoke attacker code, is the orchestration layer.

The hands-on tradecraft leaned on default-configuration weaknesses rather than zero-days: a script abusing Apache HiveServer2's default no-validation SASL PLAIN authentication on its service port to register a malicious Java UDF and run shell commands; an Ambari REST-API payload against the Hadoop management layer; and headless-browser automation logging into a GlassFish admin console with default credentials to deploy a JSP webshell via WAR upload (Hunt.io, 2026-07-23). A previously-unreported Go implant, "Hades," provided cross-platform persistence (Registry Run key and scheduled task on Windows, cron on Linux) and beaconed over HTTPS using request paths designed to blend with static JavaScript-asset traffic, with AES-256-GCM-encrypted payloads carried in HTTP bodies and built-in kill-dates and working-hours scheduling to blunt detection. Critically, "the Ministry of Finance has not confirmed that its systems were breached, and some of the recovered artifacts only show that particular systems were targeted rather than successfully compromised" (BleepingComputer, 2026-07-24); ThaiCERT and NCSA were notified 2026-07-15.

CVE-2026-54121, Windows Server AD CS 'Certighost': low-priv domain user forges a DC certificate to DCSync, full PoC public (CVSS 8.8)

Researchers H0j3n and aniqfakhrul published a full technical write-up and working proof-of-concept on 2026-07-24 for a flaw they call "Certighost" (CVE-2026-54121, CVSS 8.8), an Active Directory Certificate Services vulnerability Microsoft describes as "improper authorization in Active Directory Certificate Services (AD CS) [that] allows an authorized attacker to elevate privileges over a network" and fixed in the July 2026 Patch Tuesday cycle (Microsoft MSRC, 2026-07-14). Per the researchers' disclosure, the vulnerable logic sits in the Enterprise CA's enrollment "chase" fallback: when a certificate request carries the cdc (client DC) and rmd (remote domain) attributes, the CA opened connections to the requester-supplied cdc host and trusted the identity data it returned without first proving that host was actually the Domain Controller it claimed to be (CybersecurityNews, 2026-07-24).

A low-privileged domain user (using only a machine account it can self-register under the default ms-DS-MachineAccountQuota) stands up rogue LDAP/LSA services, points the chase at itself, and receives a CA-issued certificate carrying a target Domain Controller's identity. That certificate authenticates via PKINIT as the DC, and the resulting Kerberos ticket grants directory-replication rights; the PoC demonstrates a DCSync pull of the krbtgt secret, making the flaw a single-hop path from an ordinary domain foothold to full domain compromise (CybersecurityNews, 2026-07-24). Microsoft rates it "Exploitation Less Likely" and reports no public disclosure at patch time and no in-the-wild exploitation (Microsoft MSRC, 2026-07-14); the value of the 2026-07-24 disclosure is that it ships the exploitation chain publicly, collapsing the weaponization bar for any estate that skipped or deferred the July cumulative update.

The Microsoft fix adds a CA-side validation step that rejects the chase target unless it resolves to a real computer object whose userAccountControl carries the SERVER_TRUST_ACCOUNT bit (8192), with a follow-on SID comparison (CybersecurityNews, 2026-07-24).

Microsoft Email Threat Landscape Q2 2026: phishing moves off email into Teams vishing, and attachment lures drift PDF → DOCX

Microsoft's quarterly email-threat report for Q2 2026 carries two findings that matter for any M365-heavy public-sector or enterprise tenant, and both are about where attacks land rather than raw volume. First, social engineering is migrating out of the inbox into trusted collaboration tooling: "weekly malicious call attempts reaching nearly ten times the mid-2025 baseline by the end of the quarter" in Microsoft Teams-based voice-phishing, concentrated in weekday business hours (roughly 14:00–20:00 UTC, near-zero at weekends) and trading on the implicit trust users place in an internal tool (Microsoft Threat Intelligence, 2026-07-23). Second, attachment-based phishing drifted from PDF toward DOC/DOCX delivery across the quarter and email-embedded QR codes collapsed to near-zero; a delivery-mechanism shift that is itself an evasion tell, following the disruption of the Tycoon2FA adversary-in-the-middle kit. Credential theft remained the dominant objective, "accounting for 94–96% of all payload-based attacks each month," with traditional malware delivery down to 4–6%.

Two illustrative campaigns show the current tradecraft. An automated business-email-compromise operation generated messages with Python's email-MIME library and dispatched them through the Amazon SES API from a DKIM-configured domain, reaching tens of thousands of role-based mailboxes (ar, payroll, hr) across many organizations in under three hours with open-tracking pixels for follow-up prioritization. A second campaign nested an EML attachment posing as a Teams voicemail; its action button ran a silent sign-in against an attacker-registered multi-tenant Entra application, and the OAuth redirect chain obscured the true destination from scanners and recipients before ultimately delivering a BAT dropper that pulled and ran a hidden second-stage payload (Microsoft Threat Intelligence, 2026-07-23).

TA458 / Operation RoundPress: a running supply of half-click webmail zero-days adds a fresh SOGo flaw (CVE-2026-8496)

Background. ESET first documented Operation RoundPress in 2025 as a Russia-aligned campaign abusing cross-site-scripting flaws in self-hosted webmail (initially Roundcube, later broadened) to steal mail from Ukrainian and Eastern-European government targets (ESET Research, 2025-05-15). It sits in a longer lineage of GRU-linked webmail-XSS espionage, the same tradecraft class CERT-UA, ANSSI and multiple vendors have tracked across APT28/Sofacy and WinterVivern operations against Roundcube and Zimbra since 2023. Proofpoint's 2026-07-23 report is the first to consolidate the current actor (which it tracks as TA458) as running a standing supply of such zero-days across five distinct webmail products at once, and to disclose a previously-unknown SOGo flaw within it.

TA458 runs "half-click" exploits: the target "must only open the malicious email in their webmail viewer to be compromised", no link, attachment, or click (Proofpoint, 2026-07-23). The mechanism is an event-handler injection into content the webmail client fails to sanitize, executing attacker JavaScript in the victim's authenticated session the moment the message renders. The active set spans Zimbra (CVE-2025-27915), mDaemon (CVE-2025-3929), Roundcube (n-day CVE-2023-43770 and CVE-2024-42009), Kerio Connect (a flaw found March 2026, no CVE assigned to the end-of-life product), and (newly disclosed) SOGo, where Proofpoint "reported to the vendor, Alinto; it was patched as CVE-2026-8496 in version 5.12.8" (Proofpoint, 2026-07-23). Each intrusion drops SpyPress, a per-client-customized obfuscated JavaScript payload whose consistent objective across variants is "theft of credentials, contacts, and emails."

On Roundcube targets the operation has shifted from smash-and-grab theft to durable access: SpyPress chains a second Roundcube flaw (CVE-2025-49113) that abuses the file-upload handler to trigger unsafe PHP deserialization, using the mail server's own GPG engine as a deserialization gadget to execute code, then plants PHP webshells inside Roundcube's program and plugin directories and multiple reverse-shell fallbacks (Proofpoint, 2026-07-23). Targeting concentrates on Ukrainian government and Eastern-European military and government entities across Albania, Greece, Moldova and Türkiye, with occasional chemical, telecom and technology victims. Proofpoint "assesses that TA458 is likely a Russian military intelligence operation directed by the Russian GRU" and reports no telemetry overlap between TA458 and TA422 (APT28/Sofacy) (a distinct GRU cluster) with the specific unit unconfirmed. Attribution here is not settled across vendors: ESET's original Operation RoundPress reporting associated the activity with Sednit (APT28), so the TA458 and RoundPress labels should be treated as overlapping tracking rather than a single confirmed actor.

Builds on: 2026-07-24/laundry-bear-zimbra-zero-click-cve-2025-66376