Image: research.checkpoint.com · rights & removal

5th October

Reporting by Check Point ResearchRead the original at research.checkpoint.com

Executive Summary

Recent security incidents involved data exposure from state court systems and car-sharing services, where personal and identity information was compromised in some instances. A ransomware attack affected South Africa’s air navigation provider’s operational technology supporting weather services, with subsequent reports indicating possible data theft. Furthermore, an online invoicing platform disclosed account details, password hashes, and financial information for businesses. AI threats involved autonomous agents attempting to gather public information from government websites using SQL injection attempts against US government domains. Malicious Custom GPTs were used in a campaign to deliver remote access malware, and an AI-enabled threat actor utilized compromised cloud service principals to automate reconnaissance and destructive actions within Azure environments. Vulnerabilities were addressed through patches for Citrix NetScaler flaws, Cisco Catalyst SD-WAN Manager vulnerabilities, Apple's CoreGraphics issues, and GitLab’s AI Gateway vulnerability. Various threat intelligence reports tracked ransomware campaigns exploiting SharePoint vulnerabilities, China-nexus espionage targeting US policy experts using spear-phishing methods, and Russia-linked phishing campaigns deploying backdoors against various organizations.

Facts Only

* Arizona’s state court system suffered a phishing-led cyberattack.
* Attackers copied backup files containing protective-order records and over 150,000 Foster Care Review Board reports dating from 2010.
* Times Car disclosed a data breach affecting approximately 6.6 million accounts in the Japanese car-sharing service.
* Identity-verification documents, including driver’s-license images, were exposed for about 1.6 million accounts at Times Car.
* South Africa’s air navigation provider suffered a ransomware attack on operational technology supporting aviation weather services.
* Fakturownia disclosed a data breach after an attacker exploited a system vulnerability on the Polish invoicing platform.
* Copied information from Fakturownia included account and company data, password hashes, bank account details, authentication tokens, contractor information, and invoice portions.
* Researchers observed autonomous AI agents attempting rudimentary hacking against US and Canadian government websites via failed SQL injection attempts against the US Department of Education and Library and Archives Canada.
* Malicious Custom GPTs were used in a ClickFix campaign to deliver remote access malware.
* JadePuffer, an AI-enabled threat actor tracked as Storm-3168, used compromised Azure service principals for cloud reconnaissance and destructive actions.
* Citrix issued fixes for NetScaler vulnerabilities CVE-2026-88771-2 and CVE-2026-88772.
* Cisco alerted about CVE-2026-76504 in Catalyst SD-WAN Manager, allowing unauthenticated remote access.
* Apple patched CVE-2026-86950, a CoreGraphics memory corruption vulnerability affecting mobile and desktop devices.
* GitLab released patches for CVE-2026-90970, an AI Gateway vulnerability.
* Warlock ransomware attacks exploited SharePoint ToolShell vulnerabilities across utilities, telecom, government, and education sectors.
* A China-nexus espionage campaign tracked as UAT-11587 deployed the Antino backdoor via spear-phishing using Microsoft 365 services for command and control.
* TA419 targeted US AI policy experts by impersonating policymakers to steal Microsoft 365 credentials and session cookies.
* Russia-linked Star Blizzard phishing campaigns installed the CosmicPulse backdoor via scheduled tasks targeting U.S. and U.K. organizations.

Full Take

The information reveals a convergence of data exposure, sophisticated AI-driven threats, and state-aligned espionage operating simultaneously across various sectors. The exposure of sensitive personal and financial records in data breaches highlights persistent vulnerabilities in data governance, even when specific systems are patched. Simultaneously, the deployment of autonomous AI agents and malicious Custom GPTs demonstrates an escalation from traditional human-operated attacks to agentic operations that seek automation in reconnaissance and destructive actions within cloud environments. This suggests a paradigm shift where the speed and scope of compromise are increasing due to the integration of automated capabilities into cyber conflict. Furthermore, the documented espionage campaigns, such as those involving Antino and TA419, demonstrate a consistent focus on leveraging social engineering (spear-phishing) layered with access through legitimate enterprise services (M365) to achieve long-term intelligence goals against both policy experts and operational infrastructure. The presence of zero-day vulnerabilities being exploited, alongside the documented retrospective tracking of sophisticated threat actors across geopolitical lines, implies that defense must move beyond patching known flaws to anticipate systemic infiltration techniques and the automation of reconnaissance. What does this pattern suggest about the tension between centralized security measures and decentralized, adaptive adversarial tactics? How can institutions account for vulnerabilities that emerge not from software bugs but from the very interaction layer of human decision-making amplified by AI agents?

From the original · Check Point Research

For the latest discoveries in cyber research for the week of 5th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES - Arizona’s state court system has suffered a phishing-led cyberattack after an employee clicked a malicious link.

Read the full story at research.checkpoint.com

Sentinel — Human

Confidence

The text functions as a highly dense compilation of disparate cybersecurity news items. The mechanical structure and the inclusion of highly specific, potentially future-dated technical references suggest significant AI assistance or automated aggregation rather than original journalistic writing.

Signals Detected

Uniform rhythm and reliance on bulleted, telegraphic reporting style.

Highly structured, list-based presentation lacking narrative flow or human emphasis.

Dense, tightly packed factual statements citing numerous unrelated incidents and technical details without connective tissue.

The presence of highly specific, near-future CVE numbers (e.g., CVE-2026-88771-2) and named, yet unverified, threat actors/campaigns suggests LLM generation or heavy aggregation.

Human Indicators

The core structure and specific technical names (CVEs, threat actor tracking numbers like Storm-3168) appear grounded in real security reporting formats.