ZeroFox Daily Intelligence Brief

ZeroFox Daily Intelligence Brief - August 24, 2026

ZeroFox Intelligence collects, curates, and analyzes information derived from open and proprietary sources. Here is today’s daily roundup to give you and your clients an advantage over the adversary.

Brief Highlights

ZeroFox Intelligence Flash Report - Cl0p Shifts from Personal Data to Intellectual Property Theft
Suspected Iran-Linked Cyber Activity Behind UK Power Generator Attack
Geopolitical Focus: U.S.-China Tensions Ahead of Summit, U.S. Threatens Sanctions Against Iran, and More

ZeroFox Intelligence Flash Report - Cl0p Shifts from Personal Data to Intellectual Property Theft

Source: https://www.zerofox.com/advisories/41616/

What we know: ZeroFox has observed ransomware group Cl0p claiming to have targeted 43 organizations between August 14 and 19, 2026. The group has issued extortion demands tied to data allegedly stolen from internet-exposed instances of product lifecycle management platforms Windchill and FlexPLM.

Context: The stolen data in this campaign comprises engineering-focused intellectual property (IP), including engineering drawings, facility testing reports, blueprints, and project plans. Organizations listed include Shell, Philips, General Electric, and Fiserv.

Analyst note: Cl0p has shifted its operations twice before—from single extortion to double extortion in 2020, and to mass data exfiltration in 2021—with each prior shift signaling a sustained new campaign phase. The group’s current targeting of a relatively small and less protected victim population is likely an effort to test new operational methods before scaling and very likely signals a similarly sustained new campaign phase targeting engineering-focused intellectual property on vulnerable servers.

Suspected Iran-Linked Cyber Activity Behind UK Power Generator Attack

Source: https://www.bbc.com/news/articles/ce9793g34yvo

What we know: Iran-linked group “CyberAv3ngers” is reportedly suspected behind the cyberattack on a small British power generator in July 2026 that disrupted operations for four days. The threat group has not claimed responsibility.

Context: UK authorities said the incident did not threaten wider energy supply. The incident occurred around the same period as that of CyberAv3ngers and “APT IRAN” targeting U.S. water and wastewater facilities, causing operational disruptions.

Analyst note: The incident comes as U.S.-Iran tensions remain elevated and Iran-linked actors increasingly target Western critical infrastructure. The UK incident suggests Iranian cyber operations are likely to target U.S.-allied countries’ critical infrastructure organizations.

Geopolitical Focus: U.S.-China Tensions Ahead of Summit, U.S. Threatens Sanctions Against Iran, and More

The United States and China have imposed new trade restrictions on each other ahead of a September 2026 summit. However, the measures are unlikely to disrupt the October 2025 truce. The restrictions indicate areas where the two sides may diverge more seriously in the coming years.
The United States is preparing new sanctions targeting Iran and its trade partners, while Tehran has threatened to halt all oil exports from the Gulf if the economic war continues. Oil prices fell more than USD 1 a barrel ahead of Washington’s expected announcement of sanctions, which could further disrupt supplies from the Middle East.
About 42,000 people have been displaced or are in active evacuations as the Hawk Fire approaches northern Reno, Nevada. The fire has burned 13,000 acres and injured three civilians and three first responders amid extreme heat, low humidity, and strong winds.
At least 30 people were killed and six seriously injured after heavy rain triggered a landslide at the Dar Es Salam landfill in Conakry, Guinea. Several homes were destroyed as rescue teams searched for survivors.
Polish authorities detained an individual accused of planning assassination attempt targeting senior politicians. The suspect allegedly discussed targeting figures from Poland’s two largest parties on an online firearms group.

DEEP AND DARK WEB INTELLIGENCE

PwnForums user ZeroBytes: Moderately credible threat actor "ZeroBytes" has leaked data allegedly associated with Sport 2000, a France-based retail cooperative of independent sporting goods and ski rental stores, on dark web forum PwnForums. The actor claimed the compromised dataset contains approximately 17,581 records, including personally identifiable information (PII) such as full names, physical addresses, and email addresses, as well as reservation metadata, equipment details, and financial transaction records.

VULNERABILITY AND EXPLOIT INTELLIGENCE

TrueConf vulnerabilities: CISA has flagged two actively exploited vulnerabilities in the Russian-built TrueConf Server self-hosted communications platform. CVE-2026-72529 could enable unauthenticated attackers to execute arbitrary scripts via TCP port 4307, while CVE-2026-72530 could enable sandbox escape and arbitrary command execution on the underlying system. Suspected Ukrainian threat group Head Mare has reportedly exploited the flaws to replace legitimate client installers with malicious versions carrying backdoor malware.

Affected products: Affected products are listed in this advisory.