Agentic Ransomware, Russian Router Threat, Joomla Zero-Days

Agentic Ransomware JadePuffer Exposes Autonomous Threat Evolution

The JadePuffer operation, documented by Sysdig on July 1, 2026, demonstrated the first known use of agentic ransomware driven by a large language model in a ReAct loop. The AI autonomously generated over 600 payloads, diagnosed and corrected failures in seconds, and left verbose commentary inside each payload. Critically, the AES encryption key was generated from random UUID4 calls, printed once to the agent’s log, and never stored or transmitted, making the malware functionally a wiper with no recovery possible except immutable backups. The initial access vector was CVE-2025-3248, a critical unauthenticated RCE in Langflow (CVSS 9.8), which was patched in March 2025 but left unpatched on the compromised server. From Langflow, the agent pivoted to a MySQL database and Alibaba Nacos using a default JWT key from 2020. The ransom note featured a Bitcoin address from a well-known documentation example, suggesting the model hallucinated it from training data. Open-weight models running on commodity hardware can now replicate this architecture without a frontier AI provider, and Five Eyes agencies warned in late June that such attacks could appear within months. Defenders are urged to patch Langflow, harden Nacos and MinIO, enforce egress controls, and shift to behavioral detection.

Agentic Ransomware Is Real and Getting Cheaper: What Comes After JadePuffer →

Defenders Weaponize Prompt Injections Against AI Hackers

Researchers at Tracebit have shown that placing carefully crafted prompt injections alongside secrets stored in cloud environments can effectively disable AI hacking agents. In a simulated AWS environment, the technique — called context bombing — reduced the rate at which agents seized full admin access from 57% to 5% and complete compromise from 36% to 1%. The most capable agent tested, Opus 4.8, went from achieving admin access in 93% of runs to failing every single time when confronted with a context bomb. The injections include instructions that trigger guardrails, such as developing inhalable Anthrax spores or referencing politically sensitive images. Tracebit CEO Andy Smith noted that once the forbidden command enters the agent’s context, it keeps refusing to proceed, making recovery difficult for the attacker.

Now, defenders are embracing the prompt injection, too - Ars Technica →

CISA Warns of Russian Hacking Campaign Targeting Routers via SNMP

The Cybersecurity and Infrastructure Security Agency warned Monday that Russian FSB Center 16 cyber actors are exploiting poorly configured networking devices worldwide using SNMP with common or default credentials. The hacking groups, tracked under names like Berserk Bear and Dragonfly, scan IP ranges for active SNMP agents and enroll devices into botnets to launch further attacks. The advisory was co-issued by Australia, Denmark, New Zealand, and the UK. The primary method involves sending malicious traffic from spoofed addresses to leverage the SNMP agent on routers, enabling malware execution. Organizations are advised to disable SNMP if not needed, or to use strong SNMP community strings and restrict access to trusted IPs.

The US government warns that Russia state hackers are coming after your router →

The Gentlemen Ransomware Group Accounts for 17% of June Attacks

According to Check Point research, global cyber attacks rose over 10% in June, with a new ransomware operator called The Gentlemen accounting for 17% of published ransomware attacks, overtaking Qilin as the most active group. LockBit also resurged, climbing from 1% to 7% of published attacks. Check Point security engineer Mark Mitchell noted that the rapid rise of The Gentlemen shows new operators can become major global threats quickly. NTT researchers observed the group using advanced tooling and proxy infrastructure, suggesting ties to experienced threat actors. Education remained the most targeted sector, with an average of 4,816 weekly attacks. The report also highlighted that one in every 26 enterprise AI prompts carried a high risk of sensitive data leakage, with healthcare having the highest exposure rate at 5.7%. Personal data was accessed at 80% of affected organizations.

This one cyber crime group accounted for nearly a fifth of all ransomware attacks in June →

CISA Adds Two Critical Joomla Zero-Days to Exploited Vulnerabilities Catalog

CISA added CVE-2026-48939 and CVE-2026-56291 to its Known Exploited Vulnerabilities catalog following confirmed zero-day attacks against the iCagenda and Balbooa Forms extensions for Joomla. Both flaws carry a CVSS severity score of 10.0 and allow unauthenticated remote code execution via malicious file uploads. CVE-2026-48939 affects iCagenda versions 4.0.7 and earlier, as well as legacy 3.x releases, and has been exploited in automated attacks since June 15, 2026. The vulnerability in the Submit an Event feature allows attackers to upload arbitrary PHP files. CVE-2026-56291 affects Balbooa Forms up to version 2.4.0 and was discovered on July 8 during an attack against a customer of mySites.guru. Patches are available in iCagenda 4.0.8 and 3.9.15 and Balbooa Forms 2.4.1. Federal agencies must apply updates by July 13. The Australian Cyber Security Centre warned that AI is accelerating the speed of exploitation in a global campaign targeting vulnerable CMS plugins.

CISA Warns of Actively Exploited Joomla Zero-Day Vulnerabilities →