Image: research.checkpoint.com · rights & removal

12th October

Reporting by Check Point ResearchRead the original at research.checkpoint.com

Executive Summary

Recent events highlight significant cybersecurity incidents involving governmental data exposure, corporate credential theft, and ransomware attacks across various sectors. Specific incidents include the disclosure of personal information from Denmark’s Central Register of Persons following a breach involving a private supplier, and an attack against ATB, Ukraine’s grocery retailer, which involved extortion demands and the theft of customer records including passport information. Additionally, ASOS experienced a breach involving stolen employee credentials leading to unauthorized notifications. In the realm of AI threats, research documented an intrusion campaign using the ARTEX toolkit against South Korean financial institutions, and a phishing campaign targeting employees and AI assistants that combined conventional lures with prompt injections. Vulnerabilities were noted in systems like Veeam backup software, Citrix appliances, Cisco NX-OS, and Atlassian products, with specific flaws detailed by CVEs such as CVE-2025-64393 and CVE-2026-88779. Threat intelligence reports indicate a year-over-year increase in global cyberattacks, with ransomware attacks also increasing, alongside concerns about sensitive data exposure from GenAI prompts.

Facts Only

* Denmark's government disclosed a breach of the Central Register of Persons following unauthorized access through a private supplier.
* The breach exposed personal information, including names, addresses, and identification numbers, for approximately 8.8 million individuals in the national registry.
* ASOS experienced a cyberattack involving stolen employee credentials that allowed unauthorized access to third-party platforms, resulting in the exposure of customer names and contact details.
* ATB, Ukraine’s largest grocery retailer, faced a cyberattack disrupting online services after an extortion demand, with the DataSuckers group claiming theft of records for 7.9 million customers including names, addresses, passport information, and order records.
* Osaka Metropolitan University suspected a ransomware attack that disrupted systems, affecting approximately 500 servers and potentially exposing personal information for at least 130,000 individuals.
* Researchers documented an AI-assisted intrusion campaign using the ARTEX toolkit against South Korean financial institutions, revealing Claude Code session histories and prompts.
* A phishing campaign targeted employees and AI assistants by embedding prompt injections in emails to solicit fraudulent requests or disclosure of information.
* CyberXero was profiled as an initial access broker targeting Ukrainian energy infrastructure, obtaining information belonging to over 628,000 individuals through automated attacks.
* Veeam released updates for Backup & Replication version 12 addressing CVE-2025-64393 (RCE flaw).
* Citrix NetScaler ADC and Gateway appliances are affected by CVE-2026-88779 (memory overflow).
* Cisco released updates for NX-OS addressing CVE-2026-76455 (improper access control).
* Atlassian released patches for CVE-2026-21589 (arbitrary file access).

Full Take

The data reveals a complex interplay between large-scale state-sponsored and organized criminal activities, sophisticated AI tooling, and systemic software vulnerabilities. A salient pattern emerges around the monetization of identity and operational data: breaches expose massive citizen registries, while attacks on infrastructure focus on extortion and system disruption. The use of AI is not merely for defense evasion but actively assists in reconnaissance, execution, and social engineering, blurring the line between legitimate research and offensive operations. Furthermore, the combination of credential theft (FortiBleed), vulnerability exploitation (CVEs), and data exfiltration demonstrates a coordinated strategy where low-level weaknesses are leveraged to achieve high-value outcomes, often targeting critical infrastructure or sensitive personal data pools. The tension lies between the documented technical failures (vulnerabilities) and the sophisticated, adaptive nature of the threats leveraging artificial intelligence. This suggests that resilience is not just about patching known flaws but understanding how new generative capabilities can be integrated into adversarial workflows against both humans and automated systems. The costs are distributed across public trust, corporate stability, and individual privacy. What systems exist to govern the provenance and accountability when AI assists in exploiting systemic vulnerabilities? How does the asymmetry of AI-assisted offense shift the cost burden onto those seeking defense, and who benefits from this dynamic?

From the original · Check Point Research

For the latest discoveries in cyber research for the week of 12th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES - Denmark’s government has disclosed a breach involving its Central Register of Persons after unauthorized individuals exploited access provided to a private supplier.

Read the full story at research.checkpoint.com

Sentinel — Human

Confidence

The text reads like a curated summary of technical threat intelligence, exhibiting the structure of journalistic reporting but relying heavily on externally sourced technical facts.

Signals Detected

Varied sentence structure and direct report style typical of bulletin summaries.

Consistent reporting structure; factual data is presented without overt emotional framing.

The structure closely mimics a formal intelligence bulletin, suggesting pre-defined reporting templates.

Presence of specific CVE numbers and named threat groups suggests sourcing from verifiable technical feeds, even if aggregated.

Human Indicators

The integration of specific, time-sensitive data (CVEs, threat group names) points toward reporting based on actual intelligence streams rather than pure LLM fabrication.