A Russian state-sponsored threat actor found a way to steal three months of email — including two-factor authentication codes — without the victim clicking a single link. That campaign anchors today’s brief, alongside Clop expanding its extortion playbook into manufacturing PLM systems, an actively exploited Check Point firewall admin bypass, and a novel C2 technique that hides inside the victim’s own browser.

In the News

Laundry Bear Exploits Zimbra Zero-Click Flaw to Steal Email and 2FA Codes

A joint CISA/NSA advisory attributes a zero-click Zimbra exploitation campaign to Russian threat actor Laundry Bear, targeting U.S. and Ukrainian organizations. The attack requires no user interaction beyond opening — not clicking, not downloading — a crafted email message. Malicious JavaScript injected during message rendering silently exfiltrates up to 90 days of mailbox contents, including stored two-factor authentication codes.

The mechanism is notable for what it bypasses. User awareness training is irrelevant — there is nothing for the user to avoid clicking. Traditional email security gateways that focus on attachment scanning and URL reputation may not catch a payload embedded in the message rendering pipeline. The exfiltration of stored 2FA codes is particularly consequential: it means the attacker gains not just email content but the ability to bypass MFA on other accounts where the victim stores backup codes in their mailbox.

A patch is available from Zimbra. Detection requires reviewing Zimbra server logs for JavaScript injection patterns in rendered messages — a log source most organizations are not actively monitoring. Organizations running Zimbra should patch immediately and conduct a retroactive log review covering at least the past 90 days. This campaign reinforces why phishing-resistant MFA — FIDO2 keys that cannot be exfiltrated as stored codes — remains the only authentication method that withstands both phishing and post-compromise credential theft.

What defenders should do: Patch Zimbra immediately. Review Zimbra server logs for JavaScript injection artifacts. Migrate from stored 2FA codes to FIDO2-based phishing-resistant MFA. Ensure email security controls inspect message rendering behavior, not just attachments and URLs.

Clop Ransomware Gang Pivots to PTC Windchill PLM Data Theft

Clop has expanded its data-theft extortion model to target Internet-exposed PTC Windchill and FlexPLM instances. These product lifecycle management platforms are used across aerospace, automotive, and pharmaceutical manufacturing to manage CAD files, bill-of-materials data, regulatory documentation, and engineering specifications — the kind of intellectual property that commands premium extortion payments.

The attack pattern is familiar. Clop’s playbook — scan for Internet-exposed enterprise collaboration surfaces, exploit them for bulk data exfiltration, then extort — is the same one that hit MOVEit and GoAnywhere. PTC Windchill instances were never designed for direct Internet exposure, but remote engineering workflows and third-party supplier access pushed many deployments onto the public Internet without compensating controls.

For organizations in manufacturing verticals, the immediate action is an Internet-facing asset inventory. Can your security team enumerate every Windchill and FlexPLM instance reachable from the Internet? If the answer is no, that is the first gap to close. Then enforce zero-trust network access for remote PLM users — authenticated, authorized, segmented — and monitor for anomalous bulk data exports from PLM servers. This is a network segmentation and exposure management problem, not a malware detection problem.

What defenders should do: Inventory all Internet-exposed PLM instances. Remove direct Internet exposure and replace with zero-trust network access. Monitor PLM servers for anomalous bulk data export activity. Brief manufacturing and engineering leadership on the Clop threat to PLM infrastructure.

Check Point SmartConsole Authentication Bypass Actively Exploited (CVE-2026-16232)

CVE-2026-16232 is an authentication bypass in Check Point SmartConsole — the administrative GUI used to manage Check Point firewall policies, objects, and configurations. The vulnerability carries a CVSS score of 9.3 and grants an unauthenticated attacker full administrative control over the firewall management plane. Check Point has confirmed active exploitation and released an emergency hotfix.

The severity here is straightforward: if an attacker bypasses authentication on the firewall management console, they control the firewall. They can modify rules, create VPN tunnels, disable logging, or deploy backdoor policies. The management plane is the single highest-privilege surface in any firewall architecture, and an authentication bypass on it is a complete compromise. MITRE ATT&CK maps this to T1190 (Exploit Public-Facing Application) for initial access and T1562.001 (Impair Defenses: Disable or Modify Tools) for the post-exploitation impact.

Organizations running Check Point SmartConsole should apply the hotfix immediately. If patching cannot be completed within hours, restrict SmartConsole access to a dedicated management VLAN with no Internet exposure and enforce privileged access management controls on all admin sessions. This is also a reminder that management-plane isolation — regardless of firewall vendor — is not optional. Admin interfaces should never be reachable from untrusted networks.

What defenders should do: Apply Check Point emergency hotfix for CVE-2026-16232 immediately. Restrict SmartConsole access to management-only network segments. Audit firewall policies for unauthorized changes. Review admin session logs for anomalous access patterns.

Chaos Ransomware msaRAT Hides C2 Inside the Victim’s Own Browser

Cisco Talos has documented a novel command-and-control evasion technique used by Chaos ransomware’s msaRAT implant. Instead of opening outbound network connections that NDR, proxy logs, or DNS monitoring would flag, msaRAT hijacks the victim’s installed Chrome or Edge browser through the Chrome DevTools Protocol (CDP). It then tunnels C2 communications through WebRTC sessions that are indistinguishable from legitimate browser traffic.

This is a “living-off-the-browser” technique — conceptually similar to living-off-the-land binaries (LOLBins) but applied to network evasion. The malware never creates its own network socket. From the perspective of network security controls, the traffic is Chrome talking to a WebRTC endpoint — entirely normal. NDR tools, web proxies, and even TLS-inspecting firewalls will not flag it because the traffic envelope is legitimate.

Detection must happen at the endpoint. The key signals are: processes spawning headless browser instances, unauthorized invocations of Chrome DevTools Protocol (typically on port 9222 or adjacent ports), and anomalous browser process trees where a non-interactive session initiates WebRTC connections. EDR tools that monitor process parent-child relationships and command-line arguments are the primary detection surface. This technique maps to MITRE ATT&CK T1071.001 (Application Layer Protocol: Web Protocols) and T1218 (System Binary Proxy Execution).

What defenders should do: Deploy EDR rules to detect unauthorized CDP invocations and headless browser spawning. Monitor for processes listening on port 9222. Do not rely solely on network-based detection for C2 — this technique evades it by design.

Defender Action Items

  • Zimbra: Patch immediately. Conduct 90-day retroactive log review for JavaScript injection in message rendering. Migrate to FIDO2-based MFA.
  • PTC Windchill/FlexPLM: Inventory all Internet-exposed instances. Remove direct exposure. Enforce ZTNA for remote access.
  • Check Point SmartConsole: Apply CVE-2026-16232 hotfix now. Isolate management plane. Audit policies for unauthorized changes.
  • msaRAT/CDP evasion: Add EDR detection for unauthorized Chrome DevTools Protocol usage. Monitor port 9222. Review endpoint process tree anomalies.
  • Linux XFS (CVE-2026-64600): Patch RHEL, Fedora, and Amazon Linux hosts. Prioritize multi-tenant and container infrastructure where local privilege escalation enables escape scenarios.

Detection Queries

The following Splunk SPL query detects unauthorized Chrome DevTools Protocol listeners — a key indicator of msaRAT’s living-off-the-browser C2 technique. It identifies processes listening on CDP’s default port range that were not spawned by a user-initiated browser session.

index=edr sourcetype=process_creation
  (process_name="chrome.exe" OR process_name="msedge.exe" OR process_name="chrome" OR process_name="msedge")
  (command_line="*--remote-debugging-port*" OR command_line="*--headless*")
| eval suspicious=if(match(parent_process_name, "(?i)(explorer|userinit|winlogon|svchost|cmd|powershell|bash|python)"), "true", "false")
| where suspicious="true"
| stats count by host, user, parent_process_name, process_name, command_line, _time
| sort -_time

This query will surface browser instances launched with debugging flags by non-browser parent processes. Expect low false positive rates in environments where developers do not routinely use headless Chrome — tune by excluding known CI/CD or testing hosts. In development-heavy environments, add a lookup table of authorized automation hosts to reduce noise.

References

Subscribe to the it-learn Brief

Get the daily cybersecurity brief in your inbox every weekday morning — news, SE angles, and detection queries.