Windows IKE RCE & Clop Threat Analysis Aug 2026 | SBCSG | The Small Business Cybersecurity Guy

This is your Daily Threat Analysis for 19th August 2026.

Hello, Mauven here.

Three items on the board today, and they are not evenly weighted. The first is confirmed active exploitation, CISA has said so in writing. The second is Clop ransomware returning with tooling built specifically for this campaign, not repurposed kit. The third is a phishing-as-a-service platform that has been quietly racking up Microsoft 365 victims while most IT advisories were looking elsewhere. All three have a credible path to UK SMBs. Let me take them in order.

Windows IKE Extension RCE: CISA Has Added It to the KEV. That Is Not a Drill.

CISA added a critical-severity remote code execution vulnerability in the Windows Internet Key Exchange Service Extensions component to its Known Exploited Vulnerabilities catalogue on 19th August. The KEV catalogue exists for one reason: it lists vulnerabilities that are confirmed to be actively exploited in real attacks. Not theoretical. Not proof-of-concept. Actively exploited.

The Windows IKE Extension handles key exchange for VPN and IPsec connections. A flaw in this component that allows remote code execution is about as bad as it gets from an attack-surface perspective, it is network-reachable, it does not require the attacker to be authenticated, and exploitation grants the ability to run arbitrary code on the affected system.

The advisory attributes the exploitation to active campaigns. What the advisory does not say is which threat actors are behind this or what their end objective is. That is not unusual. CISA’s KEV process prioritises speed of notification over attribution completeness. The absence of a named actor should not be read as comfort. The presence of active exploitation should be read as urgency.

For UK SMBs, the question is simple: when did your systems last receive Windows security updates? If your IT provider patches on a monthly schedule, you may already be covered, but you need to verify that, not assume it. If you are running Windows in any form, servers, workstations, remote access infrastructure, and your provider cannot tell you within the hour whether the relevant patch has been applied, that is a conversation you need to have before the end of business today.

IKE Extension vulnerabilities are particularly relevant to organisations using Windows-based VPN solutions. If your remote access stack runs through Windows IKE, and it is unpatched, treat this as an emergency.

Immediate action: Contact your IT provider and ask specifically whether the August 2026 Windows security updates have been applied across all systems. Do not accept a general assurance. Ask for confirmation that the IKE Extension patch is deployed.

Clop Returns: Purpose-Built Tooling, Not Borrowed Kit

Clop has not gone away. It has been quiet. There is a difference.

ReliaQuest published analysis this week confirming that Clop has returned to mass exploitation tactics, this time targeting CVE-2026-12569 in PTC Windchill, industrial product lifecycle management software used extensively in manufacturing, engineering, and defence supply chains. The group has deployed a custom web shell designed specifically for this campaign. It is not repurposed malware. It is purpose-built tooling that provides immediate full data-theft capability without requiring Clop to install additional software post-compromise.

The web shell includes built-in credential harvesting, database enumeration, and a custom Java component for exfiltration. The implication is that Clop has invested development time in this campaign. They are not opportunistic here. They have identified a target sector, identified a vulnerability in the software that sector uses, and built tooling optimised for that exact environment.

For most UK SMBs, PTC Windchill is not a name that registers. That is exactly the problem. Clop is not targeting the SMB directly. It is targeting the Tier 1 and Tier 2 suppliers in manufacturing and engineering supply chains, the firms that hold the data, the contracts, and the credentials of the businesses downstream of them.

If your business works with manufacturers, engineering firms, or defence contractors, this campaign is relevant to you even if you have never heard of PTC Windchill. The advisory focuses on the exploitation vector. What it does not say is that Clop’s mass extortion model means data stolen from a supplier is routinely used to pressure that supplier’s clients. You may not be the direct victim. You may still be in the blast radius.

The NCSC published guidance on supply chain risk assessment years ago. The fact that supply chain exposure continues to be how ransomware groups reach organisations that think they are too small to be targeted tells you everything about how seriously that guidance is being applied.

Immediate action: If your business relies on manufacturing or engineering suppliers, ask those suppliers this week whether they use PTC Windchill and whether CVE-2026-12569 has been patched. If they cannot answer that question, treat it as a risk to your own data.

Mirage2FA: Phishing-as-a-Service That Bypasses MFA by Stealing Sessions

Mirage2FA is an active phishing-as-a-service toolkit targeting Microsoft 365. The mechanism is adversary-in-the-middle: rather than capturing a username and password and then being blocked by MFA, Mirage2FA proxies the entire authentication session in real time and steals the authenticated session token after MFA has been completed successfully by the victim.

By the time the victim has finished typing in their one-time code, their authenticated session has already been handed to the attacker. MFA has done exactly what it is supposed to do. It has not helped.

ANY.RUN analysis identifies over 4,000 confirmed victims, with 63.7 percent in the United States. Technology, manufacturing, and education are the most heavily targeted sectors. The delivery mechanism is HTML smuggling, a technique that embeds malicious content directly in HTML attachments to avoid email gateway detection, combined with phishing pages that impersonate Microsoft 365 login screens with sufficient fidelity that users do not notice the difference.

The advisory focuses on US victim counts. What it does not say is that Mirage2FA is a phishing-as-a-service offering, meaning any threat actor with a subscription can use it. The 4,000-victim figure reflects one platform’s reach as measured from observable infrastructure. The actual number of organisations affected by adversary-in-the-middle Microsoft 365 attacks across all platforms is materially higher.

For UK SMBs, the relevant takeaway is not that MFA is useless. MFA remains one of the most effective single controls you can deploy. The takeaway is that MFA implemented as a standalone control, without session monitoring or conditional access policies that flag anomalous logins, is not sufficient against this class of attack. If a user in Birmingham authenticates successfully and then that session is used from a data centre in Eastern Europe thirty seconds later, your environment should be detecting that. Many SMB Microsoft 365 tenants are not configured to do so.

Phishing awareness training will not reliably catch adversary-in-the-middle attacks. The pages are convincing. The flow is indistinguishable from a legitimate login. The defence here is conditional access, restricting where authenticated sessions can be used, flagging impossible travel, and blocking legacy authentication protocols that bypass MFA entirely.

Immediate action: If your organisation uses Microsoft 365, ask your IT provider whether conditional access policies are configured to detect anomalous session use and whether legacy authentication has been disabled. If they are not sure what legacy authentication protocols are, that is the conversation you need to have.

In Brief: Medusa Ransomware and the Broader Picture

Also today: the FBI confirmed that the Medusa ransomware group has breached more than 500 critical infrastructure organisations in the United States since June 2021. The advisory is US-focused, but Medusa has operated internationally, and the TTPs documented, phishing, exploiting unpatched remote access vulnerabilities, living-off-the-land techniques to avoid detection, are not geographically constrained.

The 500-organisation figure is not a ceiling. It is a confirmed floor, derived from law enforcement visibility into the group’s operations. The actual number of Medusa victims, including those who paid quietly without triggering law enforcement notification, is higher. I am inferring that. The advisory does not say it. But it is consistent with how ransomware economics work.

What To Do Today

If you do nothing else this week, do these three things:

Patch Windows. Confirm with your IT provider that August 2026 security updates have been applied to every Windows system in your environment. Specifically ask about the IKE Extension patch. Do not accept a general assurance.
Ask your suppliers about PTC Windchill. If you work with manufacturing or engineering businesses, ask them whether they use this software and whether CVE-2026-12569 is patched. You have a legitimate interest in the answer.
Review your Microsoft 365 conditional access configuration. Legacy authentication should be disabled. Impossible travel detection should be active. Session token theft is a real and current threat, and MFA alone does not stop it.

None of these actions cost money. All of them require a conversation with whoever manages your IT. If that conversation is difficult to have, that is itself useful information about the state of your cyber resilience.

Before the next briefing: if Threat Analysis is useful to you, follow the show wherever you listen so tomorrow’s briefing arrives without you having to go looking for it. And if you know someone who runs a business and would benefit from knowing what is actually happening in the threat landscape, not the vendor marketing version, but the operational picture, pass it on. They can make their own judgement about what to do with it.

Sources

Source	Title	URL
CISA / BleepingComputer	Critical RCE flaw in Windows IKE Extension now actively exploited	https://www.bleepingcomputer.com/news/security/cisa-critical-windows-ike-extension-flaw-now-exploited-in-attacks/
ReliaQuest	Clop Returns with Custom Implant in Mass-Extortion Campaign	https://reliaquest.com/blog/clop-returns-with-custom-implant-in-mass-extortion-campaign
ANY.RUN	Mirage2FA Hijacks Companies’ Microsoft 365 Sessions, with Over 4K Victims in the US	https://any.run/cybersecurity-blog/mirage2fa-phishing-targets-us-companies/
BleepingComputer	CISA: Medusa ransomware hit over 500 critical infrastructure orgs	https://www.bleepingcomputer.com/news/security/cisa-medusa-ransomware-hit-over-500-critical-infrastructure-orgs/
Proofpoint	Unpacking Cruciferra: An Analysis of a Sophisticated Crypter Service	https://www.proofpoint.com/us/blog/threat-insight/unpacking-cruciferra-analysis-sophisticated-crypter-service