SECURITYINTEL DAILY BRIEF ■ ThreatIntel BriefWednesday, August 19, 2026 INTEL CONFIDENCE 100% | THREAT LEVEL CRITICAL |
|
THREAT OF THE DAY Ransomware Gangs Actively Exploit Windows Task Host | CRITICAL |
|
5 C2 IPs | 40 OTX IOCs | 35 ARTICLES |
|
■ ANALYST TLDR Today's threat landscape is dominated by active exploitation of critical enterprise software, including a WordPress form plugin flaw (CVE-2026-15748) and a Windows Task Host vulnerability targeted by ransomware groups. Additionally, threat actors like Clop are deploying custom Java web shells targeting PTC Windchill and FlexPLM servers, while new techniques like TWINLOOT abuse SharePoint and Teams for lateral movement. Emerging security research also highlights critical flaws in AI environments, including "mind viruses" in AI agents and data exfiltration vulnerabilities in Microsoft Copilot Personal. |
|
■ CRITICAL STORIES Clop created custom web shell for Windchill data theft attacks The Clop ransomware gang has developed a custom Java web shell specifically designed to target PTC Windchill and FlexPLM servers. This specialized tool allows attackers to decrypt credentials, enumerate file repositories, and exfiltrate sensitive files directly from enterprise PLM systems. |
300,000 WordPress Sites Potentially Exposed to Hacking Due to Form Plugin Flaw Tracked as CVE-2026-15748, a critical arbitrary file upload vulnerability in a popular WordPress form plugin allows unauthenticated attackers to upload executable files, potentially leading to complete site takeover across hundreds of thousands of websites. |
TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks A newly discovered PyArmor-hardened Python implant framework, TWINLOOT, leverages legitimate Microsoft SharePoint and Teams infrastructure to host its command-and-control (C2) operations, enabling stealthy credential theft and lateral movement. |
CISA: Windows Task Host flaw now exploited by ransomware gangs CISA has confirmed that ransomware groups are actively exploiting a high-severity Windows Task Host vulnerability, which was first flagged in April, to escalate privileges and facilitate network-wide compromise. |
|
■ CVEs IDENTIFIED CVE-2026-15748 WordPress Form Plugin — Arbitrary file upload allowing unauthenticated execution of malicious files |
[CVE-TBD] Microsoft Windows Task Host — Privilege escalation exploited actively by ransomware gangs |
[CVE-TBD] Microsoft Copilot Personal — One-click data exfiltration from connected applications via crafted links |
[CVE-TBD] MLflow — Server-Side Request Forgery (SSRF) allowing cloud credential and secret theft |
|
■ THREAT ACTORS Stealing large volumes of credentials from Microsoft Entra tenants |
Targeting over 500 victims globally, prompting updated CISA/FBI advisories |
Deploying custom Java web shells on PTC Windchill and FlexPLM servers |
|
|
|
■ ATT&CK TTPs | T1505.003 | | Server Software Component: Web Shell | Clop deploying custom Java web shell on PTC Windchill/FlexPLM |
| T1102 | | Web Service | TWINLOOT utilizing SharePoint and Teams for C2 infrastructure |
| T1133 | | External Remote Services | Attackers scraping Salesforce and ServiceNow portals |
| T1078 | | Valid Accounts | TheHatman stealing credentials from Microsoft Entra tenants |
| T1566.002 | | Phishing: Spearphishing Link | Microsoft Copilot Personal one-click data exfiltration via crafted links |
| T1190 | | Exploit Public-Facing Application | Active exploitation of MLflow SSRF and WordPress CVE-2026-15748 |
|
■ PATCH PRIORITY WordPress — CVE-2026-15748 allows unauthenticated arbitrary file upload and RCE — [SW] |
Microsoft — Windows Task Host privilege escalation flaw actively exploited by ransomware — [BC] |
GitLab — Critical code injection vulnerability allows unauthenticated data modification — [SW] |
MLflow — SSRF vulnerability being actively exploited to steal cloud credentials — [THN] |
|
|
|
■ RECOMMENDED ACTIONS TODAY | 1 | [P1] Patch the critical arbitrary file upload vulnerability (CVE-2026-15748) in affected WordPress Form Plugins immediately. |
| 2 | [P1] Apply the security update for the Windows Task Host vulnerability to prevent active privilege escalation by ransomware groups. |
| 3 | [P1] Apply the critical security patch released by GitLab to remediate the unauthenticated code injection vulnerability. |
| 4 | [P2] Audit PTC Windchill and FlexPLM servers for unauthorized Java web shells and review file repository access logs. |
| 5 | [P2] Update Apple devices to the latest versions of iOS, iPadOS, and macOS Tahoe to resolve the critical image-processing code execution flaw. |
|
|
|
C2 IP BLOCKLIST · AbuseCH Feodo · Showing 5 of 5 IP ADDRESS 162.243.103.246 | PORT 8080 | STATUS OFFLINE | MALWARE Emotet | COUNTRY US |
IP ADDRESS 50.16.16.211 | PORT 443 | STATUS ONLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 34.204.119.63 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY US |
IP ADDRESS 178.62.3.223 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY GB |
IP ADDRESS 27.133.154.218 | PORT 443 | STATUS OFFLINE | MALWARE QakBot | COUNTRY JP |
|
FULL IOC EXPORT — GOOGLE SHEET All live IOCs with full SHA256 hashes (OTX), IPs, and domains. 2 tabs: C2 IPs · OTX IOCs
Updated daily · Export as CSV to import directly into your tools ■ Open Full IOC Sheet → |
|
IOC SOURCES: AbuseCH Feodo · AlienVault OTX
NEWS: THN · KRB · SANS · REC · BC · SW · AWS · GCP · MSFT · U42 · SCH · MWB |