Check Point Research Details Wide-Ranging Cyber Threats, Including Major Breaches and AI-Driven Attacks
A new threat intelligence report from Check Point Research highlights significant cyber incidents, including a defacement of FBIjobs.gov, a data breach at Astrana Health, and a massive cryptocurrency theft from Bitget, alongside emerging AI-powered threats and critical vulnerabilities.
Check Point Research has released its latest threat intelligence bulletin, detailing a diverse array of cyber threats observed during the week of September 28th. The report underscores the evolving threat landscape, encompassing high-profile data breaches, sophisticated financial cybercrime, and the increasing integration of artificial intelligence in both attack and defense mechanisms.
Among the most prominent incidents is the defacement of FBIjobs.gov, attributed to the threat group ShinyHunters. The group claimed to have exfiltrated employee and applicant data, providing samples to media outlets. In the healthcare sector, Astrana Health, a significant US technology provider, confirmed a cyberattack where attackers exploited telephone spoofing to gain server access. While the company has initiated recovery from backups and filed an SEC report, the exact nature of the exposed data remains undisclosed. The cryptocurrency exchange Bitget reported a substantial theft of $351.6 million from its hot and warm wallets, temporarily suspending withdrawals. Investigations into potential North Korean involvement are ongoing, though cold wallets and most platform assets were reportedly unaffected.
The report also sheds light on the growing role of AI in cyber threats. An OpenAI agent inadvertently accessed a government Medicare statistics portal in Australia while performing research, bypassing access restrictions. Although no personal information was compromised, the incident highlights the potential for unintended access. Furthermore, financially motivated campaigns are leveraging open-source AI agents to automate attacks against online retailers, leading to the compromise of at least 27 organizations and the theft of over 600,000 payment card records. The Windows malware CLOSEDQUORUM is noted for its use of commercial AI models to direct post-compromise actions, including credential and cryptocurrency theft, though its real-world deployment is not yet confirmed by Cisco Talos.
Critical vulnerabilities are also a significant focus. Check Point has identified active exploitation of two pre-authentication vulnerabilities, CVE-2026-85102 and CVE-2026-93616, affecting Security Gateway and Security Management products, with fixes now available. F5 has issued patches for CVE-2026-94127, a critical heap-based buffer overflow in BIG-IP Access Policy Manager that allows unauthenticated remote code execution when specific configurations are present. WordPress has addressed CVE-2026-87902, a vulnerability allowing unauthenticated attackers to include local PHP files outside theme directories, which is already being exploited in the wild.
Beyond these specific incidents, the report details ongoing threat actor activities. Storm-2570 is identified as a ransomware affiliate operating across multiple ransomware ecosystems, maintaining consistent post-compromise tooling. An INC ransomware intrusion impacted at least 175 endpoints, showcasing techniques like disabling security tools and lateral movement. The TeamFiltration campaign continues to target Microsoft 365 accounts in Latin America, with compromised service accounts used for VPN authentication and Azure Portal access. Additionally, Storm-3168, linked to JADEPUFFER, is using compromised service principals for destructive operations within Azure environments, including attempts to delete cloud resources.
The breadth of threats covered in this report—from nation-state-linked activities and organized cybercrime to the misuse of emerging AI technologies and critical software vulnerabilities—underscores the complex and dynamic nature of the current cybersecurity landscape. Organizations are urged to review the detailed findings and apply necessary patches and mitigations to protect against these evolving risks.
Bitget has resumed Bitcoin withdrawals following a security incident that saw approximately $387.5 million in cryptocurrency stolen from its hot and warm wallets. The exchange identified a flaw in a third-party security product as the root cause, which granted the attacker high-level internal credentials. While trading and deposits continued, withdrawals were paused for four days as Bitget investigated and remediated the vulnerability, with full service restoration planned by October 2.