INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Lazarus Group Deploys Kaolin RAT via Spear-Phishing Campaign

| 2026-10-19 14:54 CRITICAL HIGH DATA BREACH
JSON
Executive Summary
AI-generated
A series of high-profile data breaches and cyberattacks occurred on October 19, 2026. CenterPoint Energy disclosed a breach affecting over 1 million Texas residents, exposing names, addresses, Social Security information, and driver's license numbers. Burger King Japan reported unauthorized access to approximately 11.18 million application members, compromising contact information, birth dates, gender, and regional details. Meanwhile, ConnectWise Cloud Backup suffered a credential compromise allowing attackers to sign in to at least 173 organizations, potentially accessing email, files, and Teams information. Additionally, French supermarkets experienced cyberattacks targeting connected refrigeration controllers, causing operational disruption and losses exceeding $100,000 for one retailer. Autonomous AI agents were also compromised by unauthorized access, exploiting exposed credentials, insecure interfaces, and misconfigured cloud services to retrieve business information.
Technical Mitigations AI-generated
• Patch LiteLLM with CVE-2026-35029 and CVE-2026-59823 to prevent administrative takeover or remote code execution. • Apply the Microsoft October 2026 Patch Tuesday updates, specifically addressing CVE-2026-96951 for Windows Shell vulnerability bypass protection. • Update Ivanti Connect Secure with a patch for CVE-2026-104935 authentication bypass vulnerability.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2026-97229CVE-2026-97229 CVE-2026-96951CVE-2026-96951 CVE-2026-59823CVE-2026-59823 CVE-2026-35029CVE-2026-35029 CVE-2025-8088CVE-2025-8088 CVE-2026-104935CVE-2026-104935 CVE-2026-102764CVE-2026-102764
Target & Sectors
NORTH_AMERICA NORTH_AMERICA financefinance retailretail energyenergy
Incident Timeline
‎October 2
Threat actors gained unauthorized access to sensitive user data between October 2 and 7.
general_metric 7 October
Unauthorized access between October 2 and 7 exposed contact information, birth dates, gender, and regional details.
‎19th October
Threat actors published a threat intelligence report on October 19th.
‎the week of 19th October
Threat actors released a Threat Intelligence Bulletin for the week of 19th October.
‎2026/10/19
Threat actors used compromised application credentials to sign in to at least 173 organizations, potentially accessing email, files, and Teams information.
organisation CenterPoint Energy
TOP ATTACKS AND BREACHES CenterPoint Energy, a US utility company serving Texas and several other states, has disclosed a data breach affecting more than 1 million Texas residents.
organisation Burger King Japan
Burger King Japan, operator of the international fast-food chain in Japan, has disclosed a breach affecting approximately 11.18 million application members.
data_breach 11.18 application members
Burger King Japan, operator of the international fast-food chain in Japan, has disclosed a breach affecting approximately 11.18 million application members.
organisation Microsoft 365
ConnectWise Cloud Backup, a Microsoft 365 backup service used by managed service providers, has suffered a credential compromise enabling unauthorized access to customer environments.
organisation CVE-2026
CVE-2026-35029 and CVE-2026-59823 could allow low-privileged users to change configurations, access sensitive files, redirect requests, and steal credentials.
organisation Social Security
Unauthorized access to an external system exposed names, addresses, Social Security information, and driver’s license numbers, according to regulatory notifications filed by the company.
organisation Teams
Attackers used compromised application credentials to sign in to at least 173 organizations, potentially accessing email, files, and Teams information before access was suspended.
victims 173 organizations
Attackers used compromised application credentials to sign in to at least 173 organizations, potentially accessing email, files, and Teams information before access was suspended.
organisation E. Leclerc
Several French supermarkets, including E. Leclerc stores, have experienced cyberattacks targeting connected refrigeration controllers.
organisation Check Point
Check Point researchers have demonstrated how peer influence can cause AI agents working in teams to violate established rules.
financial $100,000 attacks
Losses from the attacks exceeded $100,000 for one retailer.
‎October 2026
More than 302,000 unique phishing emails targeting over 40,000 organizations were identified during tracked campaigns.
infrastructure Windows
VULNERABILITIES AND PATCHES Microsoft has released its October 2026 Patch Tuesday updates, addressing a record 1,413 vulnerabilities across Windows, Office, SharePoint, and other products.
Among them is CVE-2026-96951, an actively exploited Windows Shell vulnerability that allows attackers to bypass security protections.
Check Point IPS provides protection against this threat (Microsoft Windows Shell Command Injection (CVE-2026-96951))
organisation Microsoft
VULNERABILITIES AND PATCHES Microsoft has released its October 2026 Patch Tuesday updates, addressing a record 1,413 vulnerabilities across Windows, Office, SharePoint, and other products.
organisation Windows, Office
VULNERABILITIES AND PATCHES Microsoft has released its October 2026 Patch Tuesday updates, addressing a record 1,413 vulnerabilities across Windows, Office, SharePoint, and other products.
organisation SharePoint
VULNERABILITIES AND PATCHES Microsoft has released its October 2026 Patch Tuesday updates, addressing a record 1,413 vulnerabilities across Windows, Office, SharePoint, and other products.
general_metric 1,413 vulnerabilities
VULNERABILITIES AND PATCHES Microsoft has released its October 2026 Patch Tuesday updates, addressing a record 1,413 vulnerabilities across Windows, Office, SharePoint, and other products.
victims 40,000 organizations
More than 302,000 unique phishing emails targeting over 40,000 organizations were identified during the tracked campaigns.
organisation Microsoft Windows Shell Command Injection
Check Point IPS provides protection against this threat (Microsoft Windows Shell Command Injection (CVE-2026-96951))
infrastructure Ivanti
Ivanti Connect Secure is affected by CVE-2026-104935, an authentication bypass vulnerability that allows remote attackers to execute commands without valid credentials.
Check Point IPS provides protection against this threat (Ivanti Connect Secure Authentication Bypass (CVE-2026-104935)) GitLab has released security updates addressing CVE-2026-97229, a critical vulnerability affecting Community and Enterprise Editions.
organisation Ivanti Connect Secure
Ivanti Connect Secure is affected by CVE-2026-104935, an authentication bypass vulnerability that allows remote attackers to execute commands without valid credentials.
organisation Ivanti Connect Secure Authentication Bypass
Check Point IPS provides protection against this threat (Ivanti Connect Secure Authentication Bypass (CVE-2026-104935)) GitLab has released security updates addressing CVE-2026-97229, a critical vulnerability affecting Community and Enterprise Editions.
organisation GitLab
Check Point IPS provides protection against this threat (Ivanti Connect Secure Authentication Bypass (CVE-2026-104935)) GitLab has released security updates addressing CVE-2026-97229, a critical vulnerability affecting Community and Enterprise Editions.
organisation Community and Enterprise Editions
Check Point IPS provides protection against this threat (Ivanti Connect Secure Authentication Bypass (CVE-2026-104935)) GitLab has released security updates addressing CVE-2026-97229, a critical vulnerability affecting Community and Enterprise Editions.
organisation CI
Rated CVSS 10.0, the flaw allows unauthenticated attackers to execute code remotely through insufficient validation of CI/CD configurations.
infrastructure 26.2.3
BeyondTrust has addressed CVE-2026-102764, a critical authentication bypass vulnerability affecting Remote Support versions 26.2.3 and earlier.
organisation BeyondTrust
BeyondTrust has addressed CVE-2026-102764, a critical authentication bypass vulnerability affecting Remote Support versions 26.2.3 and earlier.
infrastructure Winrar
Campaign activity also involved exploitation of WinRAR vulnerability CVE-2025-8088.
Check Point IPS provides protection against this threat (RARLAB WinRAR Directory Traversal (CVE-2025-8088)
organisation CVE-2025
Campaign activity also involved exploitation of WinRAR vulnerability CVE-2025-8088.
organisation Check Point IPS
Check Point IPS provides protection against this threat (RARLAB WinRAR Directory Traversal (CVE-2025-8088)
organisation RARLAB WinRAR Directory Traversal
Check Point IPS provides protection against this threat (RARLAB WinRAR Directory Traversal (CVE-2025-8088)
Tactical Metrics
Metrics
data_breach
11,180,000
Application Members
Burger King Japan, operator of the international fast-food chain in Japan, has disclosed a breach affecting approximately 11.18 million application members.
Metrics
victims
40,000
Organizations
More than 302,000 unique phishing emails targeting over 40,000 organizations were identified during the tracked campaigns.
Metrics
infrastructure
‎Microsoft 365
Affected Product
ConnectWise Cloud Backup, a Microsoft 365 backup service used by managed service providers, has suffered a credential compromise enabling unauthorized access to customer environments.
Metrics
infrastructure
‎Windows
Affected Product
VULNERABILITIES AND PATCHES Microsoft has released its October 2026 Patch Tuesday updates, addressing a record 1,413 vulnerabilities across Windows, Office, SharePoint, and other products.
Among them is CVE-2026-96951, an actively exploited Windows Shell vulnerability that allows attackers to bypass security protections.
Check Point IPS provides protection against this threat (Microsoft Windows Shell Command Injection (CVE-2026-96951))
Metrics
infrastructure
‎Ivanti
Affected Product
Ivanti Connect Secure is affected by CVE-2026-104935, an authentication bypass vulnerability that allows remote attackers to execute commands without valid credentials.
Check Point IPS provides protection against this threat (Ivanti Connect Secure Authentication Bypass (CVE-2026-104935)) GitLab has released security updates addressing CVE-2026-97229, a critical vulnerability affecting Community and Enterprise Editions.
Metrics
infrastructure
‎26.2.3
Software Version
BeyondTrust has addressed CVE-2026-102764, a critical authentication bypass vulnerability affecting Remote Support versions 26.2.3 and earlier.
Metrics
infrastructure
‎Winrar
Affected Product
Campaign activity also involved exploitation of WinRAR vulnerability CVE-2025-8088.
Check Point IPS provides protection against this threat (RARLAB WinRAR Directory Traversal (CVE-2025-8088)
Metrics
victims
173
Organizations
Attackers used compromised application credentials to sign in to at least 173 organizations, potentially accessing email, files, and Teams information before access was suspended.
Metrics
financial
100,000
Financial Impact / Stolen Funds
Losses from the attacks exceeded $100,000 for one retailer.
Intelligence Sources
Check Point Research 2026-10-19