The Week AI Attacked on Its Own

This past week had one clear theme, artificial intelligence in the hands of attackers. Someone set an autonomous AI agent loose on Thailand's Ministry of Finance, researchers documented the first fully autonomous ransomware case, and a new trojan started using AI to profile victims by value. Because of that, defense is shifting from blocking known indicators to detecting behavior.

Alongside it, a varied mix of classic threats. A Russian group is reading other people's mail through a zero-click flaw in Zimbra, where simply viewing the message is enough. Clop returned with a mass campaign against exposed PTC Windchill and FlexPLM. The Certighost flaw hands a normal Active Directory account the keys to the entire domain. And on the road, attackers are changing DNS on hotel Wi-Fi to steal Microsoft 365 logins.

AI That Attacks on Its Own

The strongest theme of the whole week was artificial intelligence deployed on the attacker's side. This is not theory. Someone rented a server, installed the popular open-source AI agent Hermes, switched off the setting that asks for permission before risky commands, and pointed it at Thailand's Ministry of Finance, which runs the country's treasury and tax collection.

The agent then worked through the ministry's network on its own. It probed individual hosts for ways to gain root, searched file systems, and collected whatever it found. The classic post-exploitation work a human used to do was here handled by a script with a language model at the wheel.

And it did not stop there. In the same week, researchers documented the first fully autonomous ransomware case, where an AI agent ran the entire intrusion by itself, from break-in to data destruction. A new trojan called Dolphin X uses AI to score and rank victims by value, so cybercrime can point its effort straight at the biggest payoff. For defenders that means one essential thing. Defense is shifting from blocking known indicators to detecting behavior, because an autonomous agent has no fixed signature and changes its approach on the fly.

What to do:

• Treat offensive AI as a real scenario, not the future. Focus detection on behavior, not just known indicators.
• Watch for anomalous activity from service and machine accounts, bulk enumeration, and lateral movement outside business hours.
• Add a scenario to your response plan where the attacker moves fast and unpredictably because automation is driving.

Zimbra Zero-Click: Just Viewing the Email Is Enough

The second story is textbook espionage. A Russian state-sponsored group, tracked as LAUNDRY BEAR, spent months reading Western mailboxes through a then-unknown flaw in the Zimbra webmail client. The vulnerability was assigned CVE-2025-66376, and a joint advisory was issued by the NSA, CISA, and partner agencies.

Here is the worst part. It is zero-click. The malicious JavaScript runs the moment the victim merely views the email in a vulnerable version of the webmail. No link click, no opened attachment, no further interaction. The group's tool, codenamed Ulej, then tries to steal the last 90 days of mail, the entire corporate email directory, the password saved in the browser, and the two-factor recovery codes.

Those 2FA recovery codes are the treacherous part. Once an attacker has them, they bypass the second factor and log in as the victim even where MFA appears to protect. The targets were in the West and Ukraine, a typical espionage pattern. And because simply viewing the message is enough, the classic advice to not click anything suspicious does not help here.

What to do:

• Identify your Zimbra version and deploy the fix for CVE-2025-66376 as a priority. For zero-click, the patch is the only reliable defense.
• Review webmail logs for unusual data exfiltration and access from before the fix.
• After patching, invalidate sessions and consider resetting passwords and 2FA recovery codes for exposed mailboxes.

Clop Is Hunting Again: PTC Windchill and FlexPLM

The Clop group (also Cl0p, FIN11, Graceful Spider, or Lace Tempest) is known for mass campaigns against a single exposed technology, as it did with MOVEit. This time it targeted internet-exposed installations of PTC Windchill and FlexPLM, systems for product data and product lifecycle management common in industry and manufacturing.

Technically, the attackers chain two flaws. First they exploit a pre-authentication information disclosure in the FlexPLM WSDL endpoint, and combine it with a server-side flaw in the Windchill login servlet. The result is unauthenticated code execution, meaning an attacker without a single credential reaches the point of running their own code on the server.

This is not classic encryption but data theft followed by extortion through publication, which is Clop's standard today. For defenders the lesson is the same as in previous Clop campaigns. What matters is what you have exposed to the internet. Once such a system appears in public reach, it is only a matter of time before a mass scan finds it.

What to do:

• Determine whether Windchill or FlexPLM is reachable from the internet, and place it behind a VPN or reverse proxy.
• Deploy PTC's fixes and follow the vendor's bulletins, the campaign is active.
• Review access logs for anonymous requests to the WSDL endpoint and the login servlet.

Certighost: A Normal AD Account Becomes a Domain Controller

This one is squarely for anyone who runs Active Directory. Researchers H0j3n and Aniq Fakhrul published a working exploit on July 24, which they codenamed Certighost (CVE-2026-54121). It lets a low-privileged user request a certificate for a Domain Controller and then authenticate as that machine.

And here is the core of the problem. Domain Controller accounts carry directory replication rights. Once an attacker poses as a Domain Controller, they can use the DCSync technique to pull the krbtgt secret, the master key from which Kerberos tickets are derived. Whoever holds krbtgt can forge a so-called Golden Ticket and control the domain with practically no limits.

The path from a normal account to full domain control uses no exotic permission, just a weakness in how certificates are issued. That is exactly why AD Certificate Services is a repeated target. It is a quiet but exceptionally powerful escalation that standard monitoring often misses.

What to do:

• Restrict who may request certificates, and review AD CS certificate templates for dangerous settings.
• Monitor and alert on DCSync activity from accounts that are not Domain Controllers.
• Consider a krbtgt rotation plan and have a procedure ready in case of suspected Golden Ticket abuse.

A Small One From the Road: Hotel Wi-Fi Steals Microsoft 365

Finally, a practical one for anyone who travels. Attackers are changing the DNS settings on Wi-Fi devices in hotels and conference centers. When a guest connects and opens a login, the network redirects them, instead of the real server, to a fake Microsoft 365 login page.

The page looks indistinguishable from the original, and its goal is to lure corporate credentials, and possibly a second factor in real time. The dangerous part is that the victim does nothing obviously wrong. They do not download a file or open an attachment, they just connect to Wi-Fi and try to sign in to work.

It is a reminder that a public network is not a trusted environment and that how a login page looks guarantees nothing. The defense is to not rely on how a page looks, but to verify the domain and use phishing-resistant sign-in.

What to do:

• On the road, verify the domain of the login page and do not enter credentials when something is off.
• Deploy phishing-resistant MFA (for example FIDO2 keys or passkeys) that a fake page cannot bypass.
• For work from hotels, prefer a corporate VPN or mobile data over open Wi-Fi.

Key Takeaways From This Week

• Offensive AI is here. Move detection from static indicators to behavior, an autonomous agent has no fixed signature.
• For zero-click flaws like Zimbra, the patch is the only defense. Do not click advice fails when merely viewing is enough.
• 2FA recovery codes and session tokens can bypass MFA. Invalidate them after an incident, a password reset alone is not enough.
• What matters is what you have exposed to the internet. Put Windchill, webmail, and AI tools behind a VPN and keep an inventory.
• Active Directory Certificate Services is a repeated target. Watch who may request certificates and alert on DCSync.
• Deploy phishing-resistant MFA. It protects against fake login pages and second-factor theft alike.
• Do not rely on your size or sector. Mass campaigns and AI both attack broadly and by opportunity, not by company name.

What We Would Do at Cyber Rangers

In practice we tackle these things together. We test, from an attacker's point of view, what your company exposes to the internet, whether that is webmail, apps like Windchill, or experimental AI tools. We probe Active Directory for paths like Certighost before someone else finds them. And we rehearse with your team a response to a fast, partly automated attack, so the first real incident is not the first drill.