A critical Windows VPN stack vulnerability is now confirmed exploited in the wild, Cl0p is naming victims from a targeted supply-chain campaign against engineering firms, and the DOJ just put names and bounties on 17 Iranian hackers. Three stories that will come up in customer conversations today — the IKE flaw is the one to lead with.

In the News

Windows IKE Extension RCE Exploited in the Wild

CISA added CVE-2026-65xxx to the Known Exploited Vulnerabilities catalog, confirming active exploitation of a critical remote code execution flaw in the Windows Internet Key Exchange Extension. The vulnerability sits in the IKE negotiation stack — the protocol component responsible for establishing IPsec security associations for site-to-site VPN tunnels and Always On VPN connections.

The attack surface is significant. Any Windows Server exposing IKE services on UDP ports 500 and 4500 is a candidate for unauthenticated remote code execution. That includes domain controllers running RRAS, branch office VPN concentrators, and cloud-hosted Windows VPN gateways. The vulnerability is pre-authentication, meaning an attacker needs only network reachability to the IKE listener — no credentials, no prior access.

This is the kind of flaw that collapses the perimeter model entirely. Organizations that built their remote access architecture on Windows-native IPsec VPN are now running initial access infrastructure that is itself the vulnerability. The compensating control while patching is straightforward but operationally disruptive: restrict UDP 500/4500 source IPs to known IKE peers via host firewall or upstream ACL. That breaks dynamic VPN configurations, which is why patching is the real answer.

MITRE ATT&CK mapping: T1190 — Exploit Public-Facing Application.

Cl0p Names 40+ Victims in PTC Windchill Supply-Chain Attack

The Cl0p ransomware group published over 40 victim organizations from a campaign exploiting PTC Windchill, the product lifecycle management platform used across aerospace, automotive, healthcare manufacturing, and defense supply chains. Named victims reportedly include Shell, Philips, and Fiserv.

This is not opportunistic ransomware. Cl0p deployed a custom web shell specifically designed for Windchill’s vault architecture — the component that stores CAD files, engineering bills of materials, and product configuration data. The web shell was tailored to navigate Windchill’s internal file structure and exfiltrate engineering intellectual property at scale. This follows the same playbook Cl0p used in the MOVEit and GoAnywhere campaigns: find a widely deployed enterprise application, develop exploit tooling specific to its data model, and execute mass exfiltration before defenders detect the activity.

Customers running PTC Windchill — or whose suppliers run it — should treat this as an active supply-chain compromise. Audit Windchill server logs for anomalous file access patterns, deploy web application firewalls in front of Windchill instances, and enforce application allowlisting on PLM servers to prevent custom web shell execution.

MITRE ATT&CK mapping: T1190 — Exploit Public-Facing Application, T1505.003 — Server Software Component: Web Shell, T1567 — Exfiltration Over Web Service.

DOJ Charges 17 Iranian Hackers, Posts $10M Bounties

The U.S. Department of Justice indicted 17 individuals associated with Iran’s Mabna Institute for a multi-year campaign targeting hundreds of universities and enterprises. Five of the named actors now carry $10 million Rewards for Justice bounties.

The Mabna Institute’s documented tactics are not sophisticated — they relied on spear-phishing and brute-force attacks against web-facing authentication portals. The campaign succeeded because their targets had weak authentication controls: single-factor passwords on externally accessible systems. The lesson for defenders is not new, but the indictment reinforces it with government attribution weight. Any organization in higher education, research, or critical infrastructure should treat this as a reminder to audit external authentication surfaces for phishing-resistant MFA coverage. The specific TTPs here — credential harvesting and password spraying — are exactly what FIDO2-based authentication is designed to defeat.

MITRE ATT&CK mapping: T1110 — Brute Force, T1566 — Phishing.

TWINLOOT: Living Off the Cloud Inside Microsoft 365

Researchers at Ontinue published analysis of TWINLOOT, a Python-based post-compromise framework that operates entirely within Microsoft 365 services. Command and control instructions are stored in SharePoint document libraries. Exfiltrated data leaves the environment via Teams messages. No external C2 infrastructure is involved — every communication channel is a legitimate Microsoft cloud service.

This is the operational reality of “living off the cloud.” Network-layer detection — firewall logs, IDS signatures, DNS monitoring — sees only TLS connections to Microsoft domains. The malicious activity is indistinguishable from normal SharePoint and Teams usage at the network layer. Detection requires API-level inspection of Microsoft 365 activity: anomalous document creation patterns in SharePoint, unusual Teams message volumes to external tenants, and Graph API calls that do not match the user’s baseline behavior.

Organizations with heavy Microsoft 365 adoption should evaluate their CASB and cloud DLP capabilities specifically against this threat model. If your cloud security stack inspects only network traffic and not API-layer activity, TWINLOOT-style implants will operate undetected.

MITRE ATT&CK mapping: T1102 — Web Service, T1567 — Exfiltration Over Web Service.

Defender Action Items

  • Patch CVE-2026-65xxx immediately on all Windows Servers running IKE/IPsec services. As a compensating control, restrict UDP 500/4500 to known peer IPs via host firewall or upstream ACL.
  • Patch CVE-2026-65400 on all enterprise macOS endpoints. Prioritize executive, developer, and creative team devices where Mac adoption is highest.
  • Audit PTC Windchill deployments (including supplier instances) for custom web shells and anomalous vault file access. Deploy application allowlisting on Windchill servers.
  • Enforce phishing-resistant MFA on all externally facing authentication portals — particularly in higher education and research environments where Mabna Institute TTPs have historically succeeded.
  • Evaluate Microsoft 365 security posture against TWINLOOT-style living-off-the-cloud C2. Confirm that CASB or cloud-native security tooling inspects Graph API activity, not just network traffic.
  • Audit self-hosted Ray and MLflow instances — both have CISA KEV-listed vulnerabilities under active exploitation. Isolate or patch AI/ML framework deployments running on self-managed infrastructure.

Detection Spotlight

TWINLOOT’s reliance on SharePoint for C2 creates a detectable pattern: programmatic document creation in libraries that do not match normal user behavior. The following KQL query for Microsoft Sentinel identifies SharePoint file operations performed via the Graph API by service principals or applications — not interactive users — which is the mechanism TWINLOOT uses to read C2 instructions.

OfficeActivity
| where OfficeWorkload == "SharePoint"
| where Operation in ("FileUploaded", "FileModified", "FileAccessed")
| where UserAgent has_any ("python-requests", "axios", "aiohttp", "ms-graph")
| where UserId !has "@" // service principal, not interactive user
| summarize FileOps = count(), DistinctFiles = dcount(SourceFileName) by UserId, Site_Url, bin(TimeGenerated, 1h)
| where FileOps > 20 and DistinctFiles > 5

This query flags service principals performing high-volume file operations on SharePoint sites using programmatic user agents. Expect false positives from legitimate automation (Power Automate flows, backup integrations) — baseline known automation accounts and exclude them. True positives will show novel service principals accessing document libraries that were not previously targets of automated workflows.

References

Subscribe to the it-learn Brief

Get the daily cybersecurity brief in your inbox every weekday morning — news, SE angles, and detection queries.