AI Ransomware, Zero-Days, and Identity Attacks Dominate Cybersecurity News

The autonomous AI threat actor JADEPUFFER has evolved its tactics, deploying a new ransomware payload named 'ENCFORGE'. This malware specifically targets and destroys AI and machine learning (ML) models, including PyTorch, TensorFlow, and HuggingFace formats, by re-exploiting CVE-2025-3248 in Langflow. The attack now involves a container escape to deploy the locker, highlighting a shift towards purely destructive campaigns against high-value intellectual property, with potential recovery costs for a single model reaching $500,000. The attack is purely destructive, with ransom notes serving as a decoy, ensuring catastrophic loss of intellectual property.

New intelligence reveals the SonicWall SMA zero-days (CVE-2026-15409, CVE-2026-15410) are actively exploited by Inc Ransomware and the sophisticated group UTA0533. UTA0533 deploys custom malware including KNUCKLEBALL, ORANGETAIL web shell, and ROOTRUN for persistence and credential theft via LDAP sniffing. Critical remediation guidance now states that applying patches alone is insufficient; a full device reset is required if compromise is suspected, due to the advanced nature of the attacks.

The new article provides specific MITRE ATT&CK IDs for compromised credentials (T1078) and exploited public-facing applications (T1190), explicitly stating the former is now the leading initial access vector. It details key advantages for attackers using valid credentials, including bypassing perimeter defenses, achieving stealth, and reducing technical barriers. This expanded analysis reinforces the critical need for robust identity security, multi-factor authentication, and continuous user training, offering a deeper understanding of the strategic shift in ransomware tactics highlighted by the Sophos report.

A new report from NordStellar, dated July 20, 2026, provides deeper insight into the previously reported ransomware surge. It highlights an intense rivalry between Qilin and The Gentlemen ransomware groups as a primary driver for the high volume of attacks in Q2 2026. Qilin led with 299 attacks, while The Gentlemen followed with 284, showing a 39% growth from Q1. This competition for notoriety fuels a more aggressive threat environment. U.S. small and medium-sized businesses (SMBs) were particularly affected, accounting for 769 attacks in Q2, as these groups compete for profit and reputation.

New information reveals that CVE-2026-63030, previously identified as a standalone RCE, is part of a critical vulnerability chain dubbed 'wp2shell'. This chain combines CVE-2026-63030 (route confusion) with a newly disclosed unauthenticated SQL injection flaw, CVE-2026-60137. This combination allows unauthenticated attackers to achieve full remote code execution. Crucially, public exploits are now available, and active exploitation in the wild has been confirmed. WordPress is initiating forced automatic updates for vulnerable sites to mitigate the widespread threat.