// Supply Chain
Supply Chains, RCE Chains, and Ransomware Gains: Defending Against July 27's Threat Wave
By NeoShield AI Threat Desk · Published 2026-07-27 · 5 min read
#supply chain#ransomware#Active Directory#PKI#BlueNoroff#Cl0p#PyPI#GitHub
From a new Active Directory certificate exploit to Cl0p ransomware targeting industrial platforms and North Korean crypto phishing, today's threat landscape demands immediate action across patching, PKI hygiene, and software supply chain controls.
Starting with the software supply chain, GitHub and PyPI have rolled out time-based defenses within the Dependabot dependency management tooling. The mechanism is designed to slow or limit the blast radius of supply chain attacks by introducing temporal controls around dependency updates — a direct response to the class of attacks where adversaries publish malicious packages or hijack existing ones and rely on automated tooling to propagate them instantly across thousands of projects. This is a meaningful platform-level control, but it does not replace organizational hygiene. Teams should audit which repositories have Dependabot enabled, ensure that auto-merge policies require human review for any dependency touching sensitive code paths, and maintain an internal approved-package registry or allowlist for production dependencies. Monitoring for unexpected new transitive dependencies introduced in pull requests remains essential.
On the ransomware front, Cl0p affiliates are actively exploiting unauthenticated remote code execution vulnerabilities in internet-exposed PTC Windchill and FlexPLM deployments. These are product lifecycle management and supply chain platforms widely used in manufacturing and engineering environments — sectors that often lag in patch cadence and may not subject OT-adjacent systems to the same scrutiny as core IT infrastructure. The attack chain reportedly combines a pre-authentication information disclosure flaw with an RCE, meaning no credentials are required to achieve initial access. Any organization running Windchill or FlexPLM should treat this as an emergency: immediately verify whether these systems are reachable from the internet, apply available vendor patches without delay, and if patching cannot happen immediately, place these systems behind a VPN or application-layer gateway and restrict access to known IP ranges. Network detection teams should look for anomalous outbound connections from PLM servers and unexpected process execution from web application worker processes.
Complementing the Cl0p campaign is the emergence of DevMan RaaS, tracked as Funky Mantis, which operates a mature affiliate portal offering payload customization, victim management dashboards, and automated affiliate payouts. The sophistication of this infrastructure signals that ransomware operations are continuing to industrialize. Defenders should not assume that a ransomware group's tooling is unsophisticated just because it is newly tracked. Behavioral detections for ransomware precursors — credential dumping, lateral movement via legitimate admin tools, large-scale file enumeration, and shadow copy deletion — remain the most reliable defense layer regardless of which RaaS brand is behind an intrusion.
Perhaps the most technically urgent item today is Certighost, a publicly available exploit targeting misconfigured Active Directory Certificate Services. The exploit allows any low-privileged domain user to obtain a certificate that impersonates a Domain Controller, which then enables a DCSync attack to extract the krbtgt hash and achieve full domain compromise. This is not a theoretical risk — the exploit is public, the technique is well understood, and misconfigured ADCS environments are extremely common. Every organization running Active Directory should run the following checks immediately:
- Use tools such as Certify or PKIAudit to enumerate certificate templates for dangerous configurations, particularly those allowing Subject Alternative Name specification by the requester
- Disable or restrict enrollment on any template that grants low-privileged users the ability to specify arbitrary SANs
- Enable the EDITF_ATTRIBUTESUBJECTALTNAME2 flag audit and remove it if present on CA configurations
- Monitor for unusual certificate enrollment events in the Certificate Authority logs and correlate with identity activity
- Treat any DCSync activity from a non-DC account as a critical incident requiring immediate response
Finally, BlueNoroff, the North Korean APT with a long history of targeting financial and cryptocurrency entities, is running a phishing kit that impersonates Zoom and Microsoft Teams through typosquatted domains. The campaign uses ClickFix-style social engineering — tricking users into manually executing commands under the guise of fixing a technical problem — to deliver malware capable of profiling and exfiltrating cryptocurrency wallet data. Organizations in the financial services, crypto, and Web3 sectors should brief users on this specific lure pattern, enforce application allowlisting to prevent ad-hoc script execution, and monitor for DNS lookups to lookalike conferencing domains. Browser isolation for high-risk users is worth considering.
Defensive priorities for today:
- Emergency: Audit and patch or isolate internet-facing PTC Windchill and FlexPLM instances
- Emergency: Run ADCS misconfiguration audits and remediate templates exploitable by Certighost
- High: Review Dependabot and dependency update policies across all repositories
- High: Ensure ransomware behavioral detections cover credential dumping, shadow copy deletion, and mass file operations
- High: Brief crypto and finance teams on BlueNoroff Zoom and Teams phishing lures and enforce script execution controls
This briefing is informational and synthesized from public reporting; always consult official vendor advisories and your own threat intelligence sources before making remediation decisions.
Related articles
Supply Chains, Stolen Tokens, and Shattered Networks: August 5 Threat Briefing
Today's threat landscape is dominated by cascading npm supply-chain compromises, a sophisticated MFA-bypass phishing platform…
Supply ChainSupply Chain Siege: RATs, RMM Takeovers, and AI Model Risks Dominate August 4 Threat Landscape
Today's threat landscape is defined by cascading supply chain attacks spanning npm packages, RMM infrastructure, AI model…
Supply ChainSupply Chain Siege: RATs, RMM Takeovers, and AI Model Risks Dominate August 4 Threat Landscape
Today's threat landscape is defined by cascading supply chain attacks spanning npm packages, AI model repositories, and a…
NeoShield Security publishes defensive cybersecurity guides for developers, small teams, SOC learners, and MSPs. AI-assisted content is reviewed for safety, defensive purpose, and practical security value.