Today's threat briefing arrives with an unusually dense cluster of critical-severity items, and the common thread running through all of them is attacker maturity. Whether it is a ransomware group industrializing its affiliate operations, a nation-state refining its social engineering, or a researcher publishing a working Active Directory exploit, defenders are facing adversaries who have done their homework. Here is what your team needs to understand and act on right now.

Cl0p Affiliates Target PTC Windchill and FlexPLM

Cl0p-linked threat actors, tracked under aliases including Lace Tempest and FIN11, are actively chaining pre-authentication vulnerabilities in internet-exposed PTC Windchill and FlexPLM deployments to achieve unauthenticated remote code execution. These are product lifecycle management platforms common in manufacturing, aerospace, and defense supply chains, environments that often lag on patching due to operational continuity concerns. The attack chain reportedly begins with an information disclosure flaw that feeds into a second-stage RCE, meaning no credentials are required at any point. Organizations running either platform should treat any internet-facing instance as compromised until proven otherwise. Immediate steps include pulling those services behind a VPN or zero-trust gateway, applying all available vendor patches, and hunting for anomalous outbound connections or new scheduled tasks on the hosting servers.

Certighost: A Publicly Available Path to Full Domain Compromise

The Certighost exploit is arguably the most structurally dangerous item in today's briefing. A low-privileged Active Directory user, meaning any standard employee account, can abuse misconfigured Active Directory Certificate Services templates to obtain a certificate that impersonates a Domain Controller. From there, a DCSync attack extracts the krbtgt hash, and the domain is fully compromised. The fact that a working public exploit exists removes the luxury of a slow remediation timeline. Security teams should run the Certify or Certipy tooling in audit mode immediately to enumerate vulnerable certificate templates, revoke any suspicious certificates already issued, and enforce the CA Manager Approval and Authorized Signatures requirements on templates that allow Subject Alternative Name specification. Microsoft's guidance on ESC-class misconfigurations should be your primary reference. Monitoring for unusual certificate enrollment events in the Windows Security event log, specifically Event ID 4886 and 4887, is a practical detection starting point.

DevMan RaaS: A Scalable Ransomware Operation Worth Tracking

The DevMan RaaS portal, tracked as Funky Mantis, represents the continued professionalization of the ransomware economy. Its centralized affiliate portal handles payload customization, victim tracking, and financial settlements, lowering the barrier for less-skilled actors to run sophisticated campaigns. Organizations should treat this as a persistent, high-capability threat requiring layered defenses rather than a single patch. Endpoint detection rules tuned to common ransomware behaviors, such as rapid file enumeration, shadow copy deletion via vssadmin, and unusual use of legitimate remote management tools, remain your best operational defense.

BlueNoroff Zoom Phishing Kit Targets Crypto Wallets

North Korean APT BlueNoroff is running a phishing kit that impersonates Zoom and Microsoft Teams through typosquatted domains, using ClickFix-style social engineering to trick cryptocurrency wallet holders into executing malware. The campaign leverages compromised industry contacts to add legitimacy. For organizations in fintech, crypto, or Web3 spaces, this is a direct and active threat. DNS filtering to block known typosquatted domains, browser isolation for high-risk users, and strict policies against running commands pasted from web pages are essential controls. User awareness training should specifically address the ClickFix technique, where victims are instructed to paste content into a Run dialog or terminal under the guise of fixing a technical problem.

ChatGPT AgentForger: Patched but Not Forgotten

OpenAI patched the AgentForger vulnerability on June 8, but organizations using ChatGPT Workspace Agents should audit their deployed agents now. The flaw allowed a single phishing link to silently create and authorize rogue AI agents within a victim's workspace, potentially exfiltrating data or taking automated actions on behalf of the organization. Review your ChatGPT Enterprise or Teams environment for any agents created in the weeks prior to the patch, verify their authorization scopes, and ensure that agent creation requires explicit administrator approval going forward.

SourTrade Malvertising Evades Detection by Assembling Malware in the Browser

The SourTrade malvertising campaign, detailed by Confiant on July 23, takes a novel evasion approach: rather than serving a complete malicious executable, it delivers the payload in fragments that the victim's browser assembles into a final Windows binary using a legitimate Bun runtime as a carrier. This technique is specifically designed to defeat file-based detection at the network perimeter. Web content filtering, browser isolation, and endpoint behavioral detection that flags unusual child processes spawned by browsers are the appropriate countermeasures.

Defensive Priorities for July 26, 2026

- Immediately restrict internet access to PTC Windchill and FlexPLM and apply available patches; treat exposed instances as potentially compromised.
- Run an AD CS audit today using Certipy or equivalent tooling and remediate vulnerable certificate templates before end of business.
- Enable certificate enrollment monitoring in your SIEM and alert on DC-class certificate issuances to non-DC accounts.
- Tune endpoint detection for ransomware precursor behaviors associated with both Cl0p and DevMan RaaS affiliate TTPs.
- Deploy DNS and web filtering to block typosquatted Zoom and Teams domains; brief high-risk users on ClickFix social engineering.
- Audit all ChatGPT Workspace Agents for unauthorized creation and enforce admin-approval workflows for new agent deployments.
- Shift endpoint detection toward behavioral and memory-based analysis to counter fragment-based malware delivery like SourTrade.

This briefing is informational and intended to accelerate your team's awareness; always consult official vendor advisories and your organization's specific risk context before making remediation decisions.