Clop, Medusa, and AWS Keys: Daily Cybersecurity Briefing

The Clop ransomware group's exploitation of CVE-2026-12569 is now confirmed as an unauthenticated remote code execution (RCE) flaw stemming from unsafe deserialization. Security researchers believe Clop began exploiting this zero-day vulnerability in early June, weeks before PTC's public disclosure and patch release on June 17. The reported data exfiltration from General Electric has been updated to 391GB, significantly higher than previously known. Shell has acknowledged the claims and initiated an investigation, confirming that its core business operations remain unaffected by the data theft.

The updated CISA/FBI/HHS advisory details new Medusa ransomware TTPs, significantly expanding on previous intelligence. Key additions include the active exploitation of CVE-2024-1709 in ConnectWise ScreenConnect and vulnerabilities in Fortinet FortiClient EMS. The advisory also explicitly lists new MITRE ATT&CK techniques like T1133 (External Remote Services) and T1490 (Inhibit System Recovery), alongside new hunting hints such as the '/api/config' URL pattern for BeyondTrust exploitation and the 'bomgar-scc.exe' process name. This update provides critical, actionable intelligence for defenders.

Microsoft has issued a clarification regarding CVE-2026-69836, the critical RCE in Entra ID. While initial reports, including Microsoft's own, indicated active zero-day exploitation, the company later amended its advisory to state that the vulnerability was not actively exploited in the wild. This correction significantly alters the understanding of the immediate threat posed by the flaw, although its technical severity remains high. The vulnerability was discovered by a Microsoft Principal Security Engineer and has been fully mitigated server-side.