July 27, 2026 brings a convergence of threats that touch nearly every layer of the enterprise stack: software supply chains, industrial platforms, Active Directory certificate infrastructure, ransomware-as-a-service operations, and cryptocurrency-targeting nation-state actors. No single team owns all of these risks, which is exactly why today's briefing matters — defenders need a unified picture to prioritize effectively.

Starting with the software supply chain, GitHub and PyPI have rolled out time-based defenses within the Dependabot dependency management tooling. The mechanism is designed to slow or limit the blast radius of supply chain attacks by introducing temporal controls around dependency updates — a direct response to the class of attacks where adversaries publish malicious packages or hijack existing ones and rely on automated tooling to propagate them instantly across thousands of projects. This is a meaningful platform-level control, but it does not replace organizational hygiene. Teams should audit which repositories have Dependabot enabled, ensure that auto-merge policies require human review for any dependency touching sensitive code paths, and maintain an internal approved-package registry or allowlist for production dependencies. Monitoring for unexpected new transitive dependencies introduced in pull requests remains essential.

On the ransomware front, Cl0p affiliates are actively exploiting unauthenticated remote code execution vulnerabilities in internet-exposed PTC Windchill and FlexPLM deployments. These are product lifecycle management and supply chain platforms widely used in manufacturing and engineering environments — sectors that often lag in patch cadence and may not subject OT-adjacent systems to the same scrutiny as core IT infrastructure. The attack chain reportedly combines a pre-authentication information disclosure flaw with an RCE, meaning no credentials are required to achieve initial access. Any organization running Windchill or FlexPLM should treat this as an emergency: immediately verify whether these systems are reachable from the internet, apply available vendor patches without delay, and if patching cannot happen immediately, place these systems behind a VPN or application-layer gateway and restrict access to known IP ranges. Network detection teams should look for anomalous outbound connections from PLM servers and unexpected process execution from web application worker processes.

Complementing the Cl0p campaign is the emergence of DevMan RaaS, tracked as Funky Mantis, which operates a mature affiliate portal offering payload customization, victim management dashboards, and automated affiliate payouts. The sophistication of this infrastructure signals that ransomware operations are continuing to industrialize. Defenders should not assume that a ransomware group's tooling is unsophisticated just because it is newly tracked. Behavioral detections for ransomware precursors — credential dumping, lateral movement via legitimate admin tools, large-scale file enumeration, and shadow copy deletion — remain the most reliable defense layer regardless of which RaaS brand is behind an intrusion.

Perhaps the most technically urgent item today is Certighost, a publicly available exploit targeting misconfigured Active Directory Certificate Services. The exploit allows any low-privileged domain user to obtain a certificate that impersonates a Domain Controller, which then enables a DCSync attack to extract the krbtgt hash and achieve full domain compromise. This is not a theoretical risk — the exploit is public, the technique is well understood, and misconfigured ADCS environments are extremely common. Every organization running Active Directory should run the following checks immediately:
- Use tools such as Certify or PKIAudit to enumerate certificate templates for dangerous configurations, particularly those allowing Subject Alternative Name specification by the requester
- Disable or restrict enrollment on any template that grants low-privileged users the ability to specify arbitrary SANs
- Enable the EDITF_ATTRIBUTESUBJECTALTNAME2 flag audit and remove it if present on CA configurations
- Monitor for unusual certificate enrollment events in the Certificate Authority logs and correlate with identity activity
- Treat any DCSync activity from a non-DC account as a critical incident requiring immediate response

Finally, BlueNoroff, the North Korean APT with a long history of targeting financial and cryptocurrency entities, is running a phishing kit that impersonates Zoom and Microsoft Teams through typosquatted domains. The campaign uses ClickFix-style social engineering — tricking users into manually executing commands under the guise of fixing a technical problem — to deliver malware capable of profiling and exfiltrating cryptocurrency wallet data. Organizations in the financial services, crypto, and Web3 sectors should brief users on this specific lure pattern, enforce application allowlisting to prevent ad-hoc script execution, and monitor for DNS lookups to lookalike conferencing domains. Browser isolation for high-risk users is worth considering.

Defensive priorities for today:
- Emergency: Audit and patch or isolate internet-facing PTC Windchill and FlexPLM instances
- Emergency: Run ADCS misconfiguration audits and remediate templates exploitable by Certighost
- High: Review Dependabot and dependency update policies across all repositories
- High: Ensure ransomware behavioral detections cover credential dumping, shadow copy deletion, and mass file operations
- High: Brief crypto and finance teams on BlueNoroff Zoom and Teams phishing lures and enforce script execution controls

This briefing is informational and synthesized from public reporting; always consult official vendor advisories and your own threat intelligence sources before making remediation decisions.