Ransomware Surges, AI Aids Attackers, Critical Flaws Exploited

The latest Check Point Research report for Q2 2026 indicates a 33% surge in ransomware attacks, with 2,139 victims. Crucially, it confirms threat actors are now actively using AI coding assistants, as evidenced by 'The Gentlemen' group building a management panel in just three days. This AI integration is accelerating malicious tool development and shrinking the window between vulnerability disclosure and exploit weaponization, significantly increasing pressure on defenders to patch and respond faster. The report also notes a rise in active groups (from 71 to 93) and a more distributed targeting approach, with the US share of victims dropping from 50% to 42%.

The 'ShieldBreak' local privilege escalation vulnerability in Microsoft Defender has now been officially assigned CVE-2026-69414. Microsoft has publicly acknowledged the zero-day flaw and confirmed that they are actively investigating and developing a security update for the Microsoft Malware Protection Engine. This provides a clear path towards remediation for the critical vulnerability that bypasses previous patches for CVE-2026-50656. Organizations should continue to monitor for the official patch release.

The Qilin ransomware group has added MOSAID Technologies, a Canadian semiconductor and intellectual property (IP) licensing firm, to its list of victims on August 17, 2026. This incident highlights Qilin's ongoing and aggressive double-extortion campaign, targeting high-value entities. The breach at MOSAID could result in the theft of highly sensitive IP, potentially compromising the company's competitive advantage and leading to severe business disruption and financial repercussions. This development underscores the persistent threat posed by Qilin across diverse sectors and its focus on exfiltrating valuable data.

New information regarding the LiteLLM supply chain attack reveals that major tech companies, including Amazon, NVIDIA, and Samsung, were among the over 2,000 organizations impacted by the 153 GB credential leak. The attack's timeline has been clarified, with the initial compromise of the Trivy CI/CD pipeline occurring in March 2026. Threat actors, TeamPCP, maintained persistent access due to an incomplete rotation of compromised credentials by Aqua Security, enabling them to steal LiteLLM's PyPI tokens and publish the malicious versions 1.82.7 and 1.82.8. This highlights a more prolonged and impactful breach than initially understood.

A public proof-of-concept (PoC) exploit for CVE-2026-65400 was released on August 12, 2026, significantly lowering the technical barrier for exploitation. This has led to an acceleration of widespread attacks, confirmed by the Dutch NCSC, primarily deploying Monero cryptominers. While cryptojacking remains the main observed payload, the ease of achieving root access via the PoC heightens the risk of more destructive attacks, such as ransomware or data theft. Enhanced hunting hints, including monitoring for inbound traffic to port 5900 from untrusted IPs and specific process monitoring, are now crucial for detection.

A public Proof-of-Concept (PoC) exploit for CVE-2026-58231 was released on August 15, making it easier for a broader range of threat actors to exploit the critical SAP Commerce Cloud vulnerability. This development significantly escalates the threat level, as the flaw was already under active exploitation since August 14, as confirmed by both Defused and KEVIntel. While CISA has not yet added this CVE to its Known Exploited Vulnerabilities (KEV) catalog, its inclusion is anticipated given the public evidence of active exploitation and the availability of a PoC. Organizations are urged to apply the SAP patch immediately to mitigate the heightened risk.