Check Point Research Details Diverse Cyber Threats in August Threat Intelligence Report
Check Point Research's latest bulletin highlights a range of cyber incidents, including attacks on ports, data breaches, and vulnerabilities in AI tools and network devices.
Check Point Research's latest Threat Intelligence Bulletin, published on August 24th, 2026, provides a comprehensive overview of the cyber threat landscape, detailing significant breaches, emerging AI-driven attacks, and critical vulnerabilities across various sectors.
The report highlights several major data breaches, including an incident at Latvia's Road Traffic Safety Directorate (CSDD) that exposed payment records of over 1.2 million individuals and 200,000 organizations. The attackers exploited a vulnerability in an internet-facing system to steal identification numbers, license plates, and payment details. In Japan, cloud provider Sakura Internet disclosed unauthorized access to rental server environments and a sales management system, potentially exposing up to 1.36 million customer accounts and installing malware on compromised servers. Additionally, The Hospital for Sick Children in Canada reported data theft from a third-party application affecting its careers website, though clinical systems and patient data remained unaffected.
AI is increasingly becoming a tool for both offense and defense in the cyber realm. Researchers demonstrated an autonomous AI agent exploiting a GitHub Actions flaw in Snowflake's public repository to gain read access to internal Jira systems and exfiltrate tokens within seconds, prompting Snowflake to patch the workflow and rotate credentials. US authorities have also issued warnings about active AI-assisted attacks targeting Siemens S7 industrial controllers, where attackers use AI-generated scripts disguised as monitoring tools to probe internet-exposed systems for unauthorized configuration changes or operational disruption. The report also analyzes 'Kriminal,' an AI platform offering cybercrime assistance, including social engineering and exploit generation, through cryptocurrency subscriptions.
Several critical vulnerabilities were disclosed and patched this week. GitLab released out-of-band fixes for CVE-2026-19478, a critical unauthenticated code injection flaw in its self-managed Community and Enterprise editions, rated CVSS 9.4, which could allow remote attackers to alter or delete public projects and user data. Cisco addressed nine critical vulnerabilities in its Crosswork platforms and Secure Workload software, including six rated CVSS 10.0, addressing authentication, access-control, and file-system weaknesses. Citrix has published patches for CVE-2026-19489 and CVE-2026-19490 affecting NetScaler ADC and Gateway, including a critical authentication bypass flaw and a denial-of-service vulnerability. NASA/JPL has also fixed a critical vulnerability in its AMMOS Instrument Toolkit AIT-GUI, enabling unauthenticated command execution through its web console.
The report also delves into specific threat intelligence findings. The 'StopAndProtect' campaign was detailed, which abuses compromised WordPress sites to distribute malware and steal data, employing a ClickFix technique and inadvertently exposing operational logs. Researchers also analyzed the Windows Defender Boot-Time Removal driver (BTR.sys), showing how this Microsoft-signed component can be repurposed for privileged file and registry changes during startup, with multiple versions sharing a hard-coded RC4 key.
Check Point Research noted an increased targeting of the education sector ahead of the school year, with organizations averaging 4,696 weekly attacks from January to July 2026, an 8% increase. Attackers are using education-themed domains and seasonal phishing lures to steal credentials. Furthermore, a Cl0p extortion campaign exploiting CVE-2026-12569 in PTC Windchill and FlexPLM was analyzed, with over 40 organizations identified as victims. The campaign utilizes a custom implant capable of decrypting credentials and supporting bulk data theft from compromised product lifecycle management environments.
The bulletin also touches upon the repurposing of Microsoft's BTR.sys driver, which, despite being Microsoft-signed, can be exploited to perform privileged file and registry modifications during system startup. Researchers found that multiple versions of this driver share a hard-coded RC4 key, potentially allowing for the decryption of malicious tasks.
Overall, the report underscores the dynamic and evolving nature of cyber threats, from large-scale data breaches and critical infrastructure attacks to the sophisticated use of AI and the exploitation of widely used software vulnerabilities. The findings emphasize the need for continuous vigilance and robust security measures across all sectors.