Threat Intelligence Brief - Monday, August 10, 2026

Operational threat reporting for defenders who need signal, not noise.

By DevSecOpsDad
Posted on August 10, 2026

Threat Radar

  • IMMEDIATE: CISA confirms ransomware gangs are actively exploiting patched SonicWall SMA1000 flaws — including a maximum-severity SSRF — making unpatched edge appliances a live ransomware entry point today.

  • Researchers have demonstrated three distinct techniques to bypass passkey-based phishing-resistant MFA on Windows by reusing exposed signed authentication material, undermining a control many organizations are actively deploying.

  • North Korean group Kimsuky has stood up an offline AI infrastructure stack to scale phishing campaigns and automate malware development — removing reliance on public AI services and evading content controls.

  • Cisco ClamAV carries high-severity DoS vulnerabilities with public proof-of-concept code available, raising exploitation probability for organizations using ClamAV in mail security pipelines.

  • A new attack class called “Ghostjacking” demonstrates that AI agents can be manipulated by injecting malicious instructions into logs and alerts, turning automated security workflows against defenders.



Immediate Action Required

SonicWall SMA1000 — Active Ransomware Exploitation (T1190)

Patches exist. CISA has confirmed active exploitation. Any organization running SonicWall SMA1000 appliances must verify patch status immediately. If patching cannot be completed within hours, isolate or take the appliance offline until remediation is confirmed. Incident response teams should review recent SMA1000 access logs for anomalous SSRF activity and lateral movement indicators.



High-Impact Developments

Ransomware Gangs Actively Exploiting SonicWall SMA1000 SSRF Flaws

  • What happened: CISA confirmed that ransomware actors are actively exploiting two recently patched vulnerabilities in SonicWall SMA1000 secure remote access appliances. One flaw is rated maximum severity and involves server-side request forgery, enabling attackers to pivot from the edge device into internal network resources.

  • Why it matters: Edge appliances are a preferred ransomware initial access vector. Confirmed exploitation means the patch window has already closed — unpatched organizations are at active risk of network compromise and data extortion.

  • Who should care: Security leadership, infrastructure and IT operations, incident response, and vulnerability management leads responsible for network edge inventory.

  • Recommended action: Immediately audit SonicWall SMA1000 deployment inventory and confirm patch status. Escalate unpatched instances to emergency remediation. Review access logs for SSRF indicators and anomalous internal traffic originating from the appliance.

  • Confidence: High — CISA confirmation of active exploitation.

  • Search metadata: T1190, SonicWall SMA1000, ransomware, SSRF, server-side request forgery

Intelligence Context



Passkey and Phishing-Resistant MFA Bypass Techniques Demonstrated on Windows

  • What happened: Three independent research efforts published techniques that defeat passkey protections on Windows without breaking the underlying cryptography. The attacks exploit signed authentication material that Windows exposes, allowing adversaries to reuse it and bypass phishing-resistant MFA controls.

  • Why it matters: Passkeys are positioned as the successor to passwords and a reliable phishing-resistant control. These findings show that implementation-level weaknesses — specifically in how Windows handles and exposes authentication material — can undermine that guarantee. Organizations that have communicated passkeys as a solved problem to leadership or auditors have a credibility and control gap to manage. AI-amplified credential theft is simultaneously eroding the reliability of traditional trust signals — passwords, MFA codes, IP reputation, geolocation — reinforcing the case for device-level trust as a complementary layer.

  • Who should care: IAM teams, endpoint engineering, security architects evaluating or deploying passkeys, and risk management leads who have accepted passkeys as a compensating control.

  • Recommended action: Do not treat passkeys as a fully mature, risk-free control on Windows at this time. Engage IAM and endpoint teams to assess exposure. Evaluate device trust enforcement as a complementary layer within Zero Trust architecture. Monitor Microsoft for guidance or patches addressing the authentication material exposure.

  • Confidence: Medium — research demonstrated, not yet confirmed in active exploitation.

  • Search metadata: T1187, T1110, T1598, passkeys, Windows, authentication bypass, MFA, Microsoft, credential theft, Zero Trust

Intelligence Context



Kimsuky Deploys Offline AI Stack to Scale Phishing and Malware Development

  • What happened: North Korean state-sponsored group Kimsuky has built and deployed an offline AI infrastructure running on internal servers. The capability connects document-search tooling to files in their possession and is being used to improve phishing lure quality and automate malware development — without relying on public AI services that could be monitored or restricted.

  • Why it matters: Running AI offline removes the guardrails and logging that public AI providers impose. Kimsuky can now generate higher-volume, higher-quality phishing lures and accelerate malware iteration at a pace that outstrips traditional threat intelligence cycles. Organizations in Kimsuky’s known target verticals — defense, government, financial, and technology — should expect more convincing and more frequent spearphishing attempts.

  • Who should care: Threat intelligence teams, email security leads, incident response, and security leadership at organizations in Kimsuky’s known target verticals.

  • Recommended action: Brief email security and awareness teams on the likelihood of increased phishing sophistication from North Korean actors. Tune email security controls toward content-based detection rather than sender reputation alone. Update Kimsuky TTPs to reflect AI-assisted lure generation.

  • Confidence: High — based on reported technical findings about Kimsuky’s infrastructure.

  • Search metadata: T1598, T1566, Kimsuky, North Korea, phishing, malware development, AI-driven attacks

Intelligence Context

  • Kimsuky Builds Offline AI Stack to Boost Phishing and Automate Malware Development — https://thehackernews.com/2026/08/kimsuky-builds-offline-ai-stack-that.html
    • Context: Reports on Kimsuky’s deployment of self-hosted AI infrastructure with document-search integration, used to enhance phishing and automate malware development without exposure to public AI service monitoring.



Cisco ClamAV High-Severity DoS Vulnerabilities — Public PoC Available

  • What happened: Cisco disclosed high-severity vulnerabilities in ClamAV that allow remote, unauthenticated attackers to trigger denial-of-service conditions. Public proof-of-concept exploit code is already available, materially compressing the time organizations have to patch before opportunistic exploitation begins.

  • Why it matters: ClamAV is widely deployed in mail security gateways and endpoint scanning pipelines. A successful DoS attack disrupts mail scanning availability, creating a window where malicious content passes uninspected. The public PoC makes this an elevated, near-term risk for unpatched deployments.

  • Who should care: IT operations, email security teams, and security leadership responsible for mail gateway availability and scanning continuity.

  • Recommended action: Apply Cisco’s ClamAV patches this week. Prioritize deployments integrated into mail security pipelines. Confirm patch status across all ClamAV instances, including those embedded in third-party products.

  • Confidence: High — vendor-confirmed vulnerabilities with public PoC.

  • Search metadata: T1499, ClamAV, Cisco, denial-of-service, DoS

Intelligence Context



Monitor Only

  • Ghostjacking is a newly documented technique in which attackers inject malicious instructions into logs or security alerts, causing AI agents that ingest that telemetry to execute attacker-controlled commands. No confirmed exploitation in the wild; relevant to any organization deploying AI-driven SOC automation or agentic security workflows. Source: ‘Ghostjacking’ Attack Uses Poisoned Logs to Turn AI Agents Bad — https://www.securityweek.com/ghostjacking-attack-uses-poisoned-logs-to-turn-ai-agents-bad/



Analyst Observation

Today’s brief reflects a threat environment where the attack surface is expanding faster than most patch cycles and identity architectures can absorb. The SonicWall situation is the clearest operational priority — CISA confirmation of ransomware exploitation makes this an incident response posture question, not a planning item, for anyone running SMA1000. The passkey research is more strategically significant than it may appear: organizations that have accepted passkeys as a solved identity problem and communicated that to boards or auditors now have a credibility and control gap to manage. Kimsuky’s offline AI development is a leading indicator, not a current crisis — but it signals that the volume and quality ceiling on state-sponsored phishing is rising, and email security controls calibrated for today’s threat will underperform against next quarter’s campaigns. The Ghostjacking technique warrants attention from any team deploying AI agents in security operations; the attack surface for agentic tooling is not well understood, and log integrity is not a control most SOCs have hardened against adversarial manipulation.





Generated by DevSecOpsDadAttack cyber threat intelligence.

Tags:  Cyber-Security-News  T1190  T1499  T1598  T1110  T1566  T1562  T1187  Cisco  Microsoft  Windows  SonicWall
DevSecOpsDadAttack!
Share: X (Twitter) LinkedIn