CISA Deadline August 25: Lazarus Zero-Day, AnMed Ransomware, Cl0p Shell

CVE-2026-68820 is a use-after-free vulnerability in afd.sys, the Windows kernel-mode Ancillary Function Driver that manages network socket operations. Lazarus Group exploited the flaw for five weeks against defense, aerospace, and aviation organizations in Europe and India as part of Operation Dream Job before Microsoft patched it on August 11, 2026. Two competing threads race to access socket state without proper synchronization; when timed precisely, the race corrupts freed memory and yields a kernel read/write primitive that produces full SYSTEM-level privileges without any user interaction required.

The exploitation chain begins with a fake job offer delivered via LinkedIn or email, using Operation Dream Job's established social engineering lure targeting defense and aerospace employees. That lure installs a dropper granting Lazarus initial code execution as a standard user. CVE-2026-68820 then elevates that foothold to SYSTEM, enabling deployment of FudModule 3.1, a kernel-mode rootkit that unlinks malicious processes from the Windows active process list, hides malicious drivers, and filters network connections from all monitoring tools. North Korea's Lazarus Group ran this attack chain against defense-sector targets undetected for five weeks because FudModule 3.1 defeats endpoint detection and response tools operating in user space. The full Lazarus FudModule 3.1 attack chain with IOCs and detection guidance is in the dedicated CVE-2026-68820 deep dive.

CISA added CVE-2026-68820 to its Known Exploited Vulnerabilities catalog following the August 11 patch release and set a federal remediation deadline of August 25 under Binding Operational Directive 26-04. Federal civilian executive branch agencies that have not applied the August 2026 cumulative update are out of compliance as of end of business today. Apply the August 2026 cumulative update via the Microsoft Security Update Guide through Windows Update, WSUS, or direct MSU deployment. Prioritize endpoints used by employees in defense, aerospace, manufacturing, or government contracting roles.

AnMed Health, a nonprofit healthcare system operating across upstate South Carolina and northeast Georgia, disclosed a ransomware attack over the weekend that forced the temporary closure of more than 30 medical offices and facilities. The attack disrupted email, phone systems, and patient portal access across the organization, the same operational disruption pattern documented in the Change Healthcare and Ascension Health ransomware incidents of 2024 and 2025.

Ransomware operators target healthcare for compounding reasons: patient care urgency creates payment pressure, mixed operational technology and legacy IT environments extend attacker dwell time before detection, and patient records command premium prices on dark web markets. AnMed operates dozens of physician offices, specialty clinics, and outpatient facilities, giving an attacker broad lateral movement opportunities once inside the network. Patients requiring urgent care during a ransomware-driven outage face real physical risk when clinical systems are unavailable.

No specific threat actor has claimed responsibility as of August 24 or released patient data. The operational disruption pattern without an immediate public data extortion claim is consistent with ransomware families that encrypt first and negotiate second, rather than pure data theft groups like Cl0p.

Defenders in healthcare and other critical sectors should audit backup accessibility today. Confirm backup systems operate on an isolated network segment with no direct path from primary IT infrastructure. Test backup restoration to a clean environment. Verify that out-of-band communication plans are current and that clinical staff have non-digital escalation paths for urgent care decisions. Healthcare ransomware follows a documented playbook: phishing or exposed remote desktop as initial access, flat-network lateral movement to file servers, then encryption. Segment clinical networks from administrative IT as a durable control.

The Cl0p ransomware syndicate claimed on August 19, 2026 to have exfiltrated highly sensitive internal datasets from Shell, the multinational oil and energy company operating across more than 70 countries. Cl0p issued the claim without publishing a data sample or a payment countdown, consistent with the group's tactic of asserting a breach before entering the active extortion negotiation phase.

Cl0p is a Russian-speaking ransomware group active since 2020, responsible for mass data exfiltration campaigns exploiting zero-days in Accellion FTA in 2021, GoAnywhere MFT in 2023, MOVEit Transfer in 2023, and PTC Windchill and FlexPLM in 2026. The group specializes in bulk exploitation of file transfer and document sharing platforms used by large enterprises, exfiltrating data without encrypting systems, then threatening public disclosure to extort payment. Our Cl0p Windchill campaign analysis details the group's 2026 exploitation methods and IOCs.

Shell has not publicly confirmed a breach or specified what categories of data may have been accessed. Energy sector organizations hold data across multiple high-value categories: operational technology network schematics, supply chain contracts, drilling and exploration data, financial trading positions, and employee personal records. Any of these represent significant extortion leverage for a group with Cl0p's track record of mass public disclosure.

Organizations in the energy sector should audit file transfer platform logs for large outbound data transfers to unexpected destinations in the past 90 days. Cl0p gains access through vulnerable managed file transfer and secure document sharing infrastructure, not typically through direct network intrusion. Apply all vendor-issued patches to any internet-facing file transfer platform immediately and review the patch history of those systems against Cl0p's known target CVE list.

SynkLoader is a previously unknown malware family disclosed this week, distributed through Microsoft Teams phishing campaigns that present users with a fake Windows lock screen to capture domain credentials. The malware spreads using compromised Microsoft 365 accounts or external Teams guest invitations, bypassing email security controls that most organizations apply stringently to inbound SMTP traffic.

SynkLoader is a credential-stealing malware that overlays a fake Windows lock screen, visually identical to the genuine Windows lock screen, over the user's display to harvest username and password when the user attempts to unlock their computer. Once credentials are captured, SynkLoader exfiltrates them to an attacker-controlled server and accesses the Microsoft Teams local LevelDB database to steal authentication tokens. Those tokens provide full access to the victim's Teams account without requiring the password, enabling the attacker to read message history, access shared files, and continue the phishing campaign from a trusted internal account.

The Teams delivery mechanism exploits a gap many organizations have not closed. Email filtering is mature and widely deployed; Teams external access controls are frequently left at default, allowing any external Microsoft 365 tenant to message internal users. Attackers exploit this by sending phishing messages through compromised external tenant accounts that appear trustworthy inside Teams.

Block Teams external messaging from unmanaged accounts unless your organization has a specific business need. In the Microsoft Teams admin center navigate to Org-wide settings and restrict External access to only known, trusted federated tenants. Enable Windows Defender Credential Guard on workstations to prevent credential theft from user-mode processes. The Sigma rule in the detection section targets unauthorized access to the Teams credential store.

Security researchers confirmed this week that more than 9,300 Amazon Web Services access keys publicly exposed in code repositories, cloud storage buckets, and other internet-accessible locations between August 2022 and August 2026 remain active and valid. The four-year exposure window means organizations that have never audited their public repositories could have live credentials indexed by search engines, available to any attacker who searches for them.

An AWS access key exposed publicly is a direct path to cloud infrastructure compromise. An attacker with a valid key can enumerate the associated IAM user's permissions, escalate privileges if the key has overly broad rights, exfiltrate data from S3 buckets, spin up compute resources for cryptomining, or create additional IAM users and access keys to establish persistence before the original credential is rotated. Many organizations rotate secrets only when an incident prompts them, leaving keys exposed for the full duration of the leakage window.

AWS provides Git Secrets, Amazon CodeGuru Reviewer secret detection, and IAM Access Analyzer for detecting exposed keys prospectively, but none of these tools retroactively find keys exposed before the tools were adopted. The risk is concentrated in organizations that began using AWS between 2020 and 2023 when key hygiene practices and secrets management tooling were less mature.

Run "aws iam list-access-keys" for every user in your AWS organization and "aws iam get-access-key-last-used" to identify stale or unused keys for immediate rotation or deletion. Scan all public and private repositories with GitHub secret scanning or truffleHog. Enable CloudTrail in all regions and review 90 days of access logs for any key older than 90 days that you have not previously audited.

No Sigma rule targeting SynkLoader by name exists yet. The malware was disclosed this week, and community rule authors require days to weeks to publish and validate new signatures. Two behavior-based rules cover the core techniques SynkLoader uses: unauthorized access to the Teams authentication token store (Windows Security Event ID 4663 on the LevelDB directory) and PowerShell invoking a credential prompt (which a fake lock screen credential capture implementation uses via the PromptForCredential API).

The Teams object access rule requires Windows Security event logging and Object Access auditing enabled on the Teams local storage directory. Any process other than Teams.exe accessing the path fires the alert. The PowerShell credential prompt rule requires Script Block Logging enabled through Group Policy under Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Detailed Tracking. Deploy both rules in your SIEM and set to alert. Tune against baseline before enabling blocking.

WAF rules are not applicable to the five threats in this Intel Drop. CVE-2026-68820 is a host-based local privilege escalation with no HTTP request signature for a WAF to intercept. The AnMed ransomware, Cl0p Shell breach, and SynkLoader Teams phishing all operate through host-level or social engineering channels. The individual CVE deep-dive posts for exploits with web-facing attack surfaces carry their own dedicated WAF rule sets.

Rank your remediation by this order today. The first item resolves CVE-2026-68820 and 420 additional August Patch Tuesday CVEs with a single deployment, making it the highest-leverage action on the list.