--- title: IronCORE Recon 2026-06-19 description: The latest threats in software supply chain security, including AI-driven ransomware and credential theft, and learn how to strengthen your defenses. image: https://www.irongatesecurity.com/hubfs/ChatGPT%20Image%20Mar%2013%2c%202026%2c%2010_08_54%20AM.png --- [Skip to the main content.](https://www.irongatesecurity.com/ironintel/ironcore-recon-2026-06-19#main-content) [![Plexos\_IronGate\_Logo\_Final-2](https://www.irongatesecurity.com/hs-fs/hubfs/Plexos_IronGate_Logo_Final-2.png?width=1246&height=190&name=Plexos_IronGate_Logo_Final-2.png "Plexos_IronGate_Logo_Final-2")](https://www.irongatesecurity.com) [![Plexos\_IronGate\_Logo\_Final-2](https://www.irongatesecurity.com/hs-fs/hubfs/Plexos_IronGate_Logo_Final-2.png?width=1246&height=190&name=Plexos_IronGate_Logo_Final-2.png "Plexos_IronGate_Logo_Final-2")](https://www.irongatesecurity.com) - [Who We Are](https://www.irongatesecurity.com/who-we-are) - [Our Leaders](https://www.irongatesecurity.com/who-we-are#our-leaders) - [Services](https://www.irongatesecurity.com/services) - [Active Defense](https://www.irongatesecurity.com/active-defense) - [Governance, Risk & Compliance](https://www.irongatesecurity.com/governance-risk-compliance) - [Security Operation (SecOps) Services](https://www.irongatesecurity.com/security-operation-services) - [Digital Forensics and Incident Response (DFIR)](https://www.irongatesecurity.com/digital-forensics-incident-response) - [Insurance Advisory Services](https://www.irongatesecurity.com/insurance-advisory-services) - [Why IronGate](https://www.irongatesecurity.com/why-irongate) - [How We Work](https://www.irongatesecurity.com/how-we-work) - Resources - [IronINTEL Blog](https://www.irongatesecurity.com/ironintel) - [Careers](https://www.irongatesecurity.com/careers) [![CONTACT US](https://no-cache.hubspot.com/cta/default/43428275/interactive-129984586382.png)](https://www.irongatesecurity.com/hs/cta/wi/redirect?encryptedPayload=AVxigLJoK7IyZc2nbFSdQ6f9dYMtlUo6Gy2avVsmilRA8Dl8cSMR%2FhyedQzjov6sZ%2FiosRrcK9Zx9IDkgxNDd9KmkDsauUyPbRCyAKfvF0n6Sh6GoKeSMJktgM8SSCX98FYAcWoOZTNyIBGfnk2fp1UD4O%2Ft3II5FLGMgtPAkTRJCLqeIxDs3vnCqLfXC8CjfzXAl25Sf5hPHQ%3D%3D&webInteractiveContentId=129984586382&portalId=43428275) Toggle Menu Toggle Menu [![CONTACT US](https://no-cache.hubspot.com/cta/default/43428275/interactive-129984586382.png)](https://www.irongatesecurity.com/hs/cta/wi/redirect?encryptedPayload=AVxigLJoK7IyZc2nbFSdQ6f9dYMtlUo6Gy2avVsmilRA8Dl8cSMR%2FhyedQzjov6sZ%2FiosRrcK9Zx9IDkgxNDd9KmkDsauUyPbRCyAKfvF0n6Sh6GoKeSMJktgM8SSCX98FYAcWoOZTNyIBGfnk2fp1UD4O%2Ft3II5FLGMgtPAkTRJCLqeIxDs3vnCqLfXC8CjfzXAl25Sf5hPHQ%3D%3D&webInteractiveContentId=129984586382&portalId=43428275) - [Who We Are *Toggle Menu*](https://www.irongatesecurity.com/who-we-are) - [Our Leaders](https://www.irongatesecurity.com/who-we-are#our-leaders) - [Services *Toggle Menu*](https://www.irongatesecurity.com/services) - [Active Defense *Toggle Menu*](https://www.irongatesecurity.com/active-defense) - [Governance, Risk & Compliance](https://www.irongatesecurity.com/governance-risk-compliance) - [Security Operation (SecOps) Services](https://www.irongatesecurity.com/security-operation-services) - [Digital Forensics and Incident Response (DFIR)](https://www.irongatesecurity.com/digital-forensics-incident-response) - [Insurance Advisory Services](https://www.irongatesecurity.com/insurance-advisory-services) - [Why IronGate](https://www.irongatesecurity.com/why-irongate) - [How We Work](https://www.irongatesecurity.com/how-we-work) - Resources *Toggle Menu* - [IronINTEL Blog](https://www.irongatesecurity.com/ironintel) - [Careers](https://www.irongatesecurity.com/careers) 2 min read # IronCORE Recon 2026-06-19 [![Picture of IronGate](https://www.irongatesecurity.com/hubfs/IronGate%20Favicon.png) IronGate](https://www.irongatesecurity.com/ironintel/author/irongate) Jun 19, 2026, 8:51:40 AM [Vulnerability](https://www.irongatesecurity.com/ironintel/tag/vulnerability) [Ransomware](https://www.irongatesecurity.com/ironintel/tag/ransomware) [IronCORE Recon](https://www.irongatesecurity.com/ironintel/tag/ironcore-recon) [AI](https://www.irongatesecurity.com/ironintel/tag/ai) [malware](https://www.irongatesecurity.com/ironintel/tag/malware) [fortinet](https://www.irongatesecurity.com/ironintel/tag/fortinet) [splunk](https://www.irongatesecurity.com/ironintel/tag/splunk) [OAuth](https://www.irongatesecurity.com/ironintel/tag/oauth) [threat intelligence](https://www.irongatesecurity.com/ironintel/tag/threat-intelligence) ![IronCORE Recon 2026-06-19](https://www.irongatesecurity.com/hubfs/ChatGPT%20Image%20Mar%2013%2c%202026%2c%2010_08_54%20AM.png) # **Executive Overview** The week’s channel intelligence points to a concentrated risk pattern: widely deployed enterprise platforms are being actively exploited or exposed through credentials, ransomware operators are refining pre-encryption defense evasion, SaaS integrations are becoming data-theft routes, and state-aligned actors continue to mature kernel-level stealth. The AI thread is also moving from theoretical governance concern to operational exposure, with attackers targeting developer AI API keys through marketplace plugins.    # **Key Articles & Threat Summaries** ##### 1.  **CISA: Splunk Enterprise flaw actively exploited, patch by Sunday** Source: [Bleeping Computer](https://www.bleepingcomputer.com/news/security/cisa-splunk-enterprise-flaw-actively-exploited-patch-by-sunday/) CISA confirmed active exploitation of CVE-2026-20253, a critical Splunk Enterprise flaw affecting versions 10.2.0 to 10.2.3 and 10.0.0 to 10.0.6 that allows unauthenticated remote attackers to create or truncate files through a PostgreSQL sidecar endpoint. ###### **Why It Matters** Security operations platforms are high-value targets. A compromise affecting SIEM or log infrastructure can erode detection, investigation, and response capacity at the same moment defenders need those systems most.  ##### **2. CISA warns Fortinet users to secure devices after FortiBleed leak** Source: [Bleeping Computer](https://www.bleepingcomputer.com/news/security/cisa-warns-fortinet-users-to-secure-devices-after-fortibleed-leak/) CISA warned Fortinet customers after leaked credentials associated with roughly 74,000 Fortinet devices, including firewalls and VPN gateways, were tied to malicious targeting of government and private-sector organizations. ###### **Why It Matters** Perimeter credentials remain a direct route to remote access, lateral movement, and ransomware staging. Organizations should treat exposed VPN and administrative credentials as active incident response triggers, not routine password reset events. ##### **3. Gentlemen ransomware uses multiple EDR killers to disable defenses** Source: [Bleeping Computer](https://www.bleepingcomputer.com/news/security/gentlemen-ransomware-uses-multiple-edr-killers-to-disable-defenses/) The Gentlemen ransomware as a service operation is maintaining a suite of EDR killing tools, including GentleKiller variants that use vulnerable drivers and target more than 400 security related processes across roughly 48 vendors. ###### **Why It Matters** Ransomware crews continue to industrialize defense evasion before encryption. Driver governance, attack surface reduction, tamper protection, and early stage telemetry are now board relevant ransomware controls. ##### **4. Salesforce Data Thefts Continue via Klue App Compromise** Source: [Dark Reading](https://www.darkreading.com/cyberattacks-data-breaches/salesforce-data-thefts-klue-app-compromise) Attackers abused compromised Klue Battlecards integration credentials and OAuth tokens to access Salesforce instances, automate REST API data theft, and support an extortion campaign attributed in reporting to the emerging Icarus group. ###### **Why It Matters** SaaS integrations are functioning as supply chain pathways into sensitive business data. OAuth grants, dormant credentials, connected app permissions, and abnormal API volume need the same executive attention as endpoint and cloud controls. ##### **5. SprySOCKS Windows Variant Abuses Kernel Drivers to Evade Detection** Source: [Dark Reading](https://www.darkreading.com/threat-intelligence/sprysocks-windows-variant-kernel-drivers) FishMonger, a China nexus threat group, expanded SprySOCKS with a Windows variant using malicious kernel drivers for stealth, with reporting tying deployments to government targets in Honduras, Taiwan, Thailand, and Pakistan. ###### **Why It Matters** State aligned operators are continuing to expand cross platform and kernel level evasion capabilities. That shifts driver control, code integrity, and public facing application hygiene into strategic cyber resilience priorities. ##### **6. Malicious JetBrains Marketplace plugins steal AI API keys from developers** Source: [Bleeping Computer](https://www.bleepingcomputer.com/news/security/malicious-jetbrains-marketplace-plugins-steal-ai-api-keys-from-developers/) At least 15 malicious JetBrains Marketplace plugins posed as AI coding assistants, code review tools, and Git utilities while exfiltrating AI provider API keys from developer settings, with the campaign reportedly nearing 70,000 installs. ###### **Why It Matters** AI tooling creates new credential exposure and data governance risk inside developer workflows. Security teams should extend marketplace vetting, secrets scanning, and API key governance to AI coding assistants and adjacent plugins. # Bottom Line Conclusion Summary Cyber risk this week is less about isolated exploits and more about control plane trust: identity, credentials, integrations, endpoint protection, and developer tooling are all being targeted as force multipliers. Executives should prioritize exposed access paths, verify SaaS trust relationships, and test whether ransomware era defense evasion can be detected before business disruption begins.   **For immediate assistance with securing AI, network intrusion, ransomwareattack, or BEC, please contact: [IrongateResponse@irongatesecurity.com](mailto:IrongateResponse@irongatesecurity.com)**   [![IronCORE Recon 2026-07-03](https://www.irongatesecurity.com/hubfs/ChatGPT%20Image%20Mar%2013%2c%202026%2c%2010_08_54%20AM.png)](https://www.irongatesecurity.com/ironintel/ironcore-recon-2026-07-03) #### [IronCORE Recon 2026-07-03](https://www.irongatesecurity.com/ironintel/ironcore-recon-2026-07-03) [![Picture of IronGate](https://www.irongatesecurity.com/hs-fs/hubfs/IronGate%20Favicon.png?width=30&name=IronGate%20Favicon.png) IronGate](https://www.irongatesecurity.com/ironintel/author/irongate) : Jul 3, 2026, 8:44:07 AM This week's IronCORE Recon highlights identity abuse and exploitation of enterprise platforms, emphasizing the need for enhanced cybersecurity... [Vulnerability](https://www.irongatesecurity.com/ironintel/tag/vulnerability) [Ransomware](https://www.irongatesecurity.com/ironintel/tag/ransomware) [IronCORE Recon](https://www.irongatesecurity.com/ironintel/tag/ironcore-recon) [AI](https://www.irongatesecurity.com/ironintel/tag/ai) [Supply Chain](https://www.irongatesecurity.com/ironintel/tag/supply-chain) [malware](https://www.irongatesecurity.com/ironintel/tag/malware) [M365](https://www.irongatesecurity.com/ironintel/tag/m365) [fortinet](https://www.irongatesecurity.com/ironintel/tag/fortinet) [OAuth](https://www.irongatesecurity.com/ironintel/tag/oauth) [threat intelligence](https://www.irongatesecurity.com/ironintel/tag/threat-intelligence) [Oracle](https://www.irongatesecurity.com/ironintel/tag/oracle) [cyber warfare](https://www.irongatesecurity.com/ironintel/tag/cyber-warfare) [Read More](https://www.irongatesecurity.com/ironintel/ironcore-recon-2026-07-03) [![IronCORE Recon 2026-06-26](https://www.irongatesecurity.com/hubfs/ChatGPT%20Image%20Mar%2013%2c%202026%2c%2010_08_54%20AM.png)](https://www.irongatesecurity.com/ironintel/ironcore-recon-2026-06-26) #### [IronCORE Recon 2026-06-26](https://www.irongatesecurity.com/ironintel/ironcore-recon-2026-06-26) [![Picture of IronGate](https://www.irongatesecurity.com/hs-fs/hubfs/IronGate%20Favicon.png?width=30&name=IronGate%20Favicon.png) IronGate](https://www.irongatesecurity.com/ironintel/author/irongate) : Jun 26, 2026, 8:24:21 AM This week revealed a surge in ransomware attacks in Europe, AI-targeted malware, and evolving threats in cybersecurity. Stay informed on key trends. [Vulnerability](https://www.irongatesecurity.com/ironintel/tag/vulnerability) [Ransomware](https://www.irongatesecurity.com/ironintel/tag/ransomware) [IronCORE Recon](https://www.irongatesecurity.com/ironintel/tag/ironcore-recon) [AI](https://www.irongatesecurity.com/ironintel/tag/ai) [phishing](https://www.irongatesecurity.com/ironintel/tag/phishing) [Supply Chain](https://www.irongatesecurity.com/ironintel/tag/supply-chain) [malware](https://www.irongatesecurity.com/ironintel/tag/malware) [threat intelligence](https://www.irongatesecurity.com/ironintel/tag/threat-intelligence) [Read More](https://www.irongatesecurity.com/ironintel/ironcore-recon-2026-06-26) [![IronCORE Recon 2026-05-29](https://www.irongatesecurity.com/hubfs/ChatGPT%20Image%20Mar%2013%2c%202026%2c%2010_08_54%20AM.png)](https://www.irongatesecurity.com/ironintel/ironcore-recon-2026-05-29) #### [IronCORE Recon 2026-05-29](https://www.irongatesecurity.com/ironintel/ironcore-recon-2026-05-29) [![Picture of IronGate](https://www.irongatesecurity.com/hs-fs/hubfs/IronGate%20Favicon.png?width=30&name=IronGate%20Favicon.png) IronGate](https://www.irongatesecurity.com/ironintel/author/irongate) : May 29, 2026, 8:23:38 AM Stay informed on the latest cybersecurity threats, including ransomware and credential theft, and learn how to protect your organization effectively. [Vulnerability](https://www.irongatesecurity.com/ironintel/tag/vulnerability) [Ransomware](https://www.irongatesecurity.com/ironintel/tag/ransomware) [IronCORE Recon](https://www.irongatesecurity.com/ironintel/tag/ironcore-recon) [AI](https://www.irongatesecurity.com/ironintel/tag/ai) [phishing](https://www.irongatesecurity.com/ironintel/tag/phishing) [malware](https://www.irongatesecurity.com/ironintel/tag/malware) [Read More](https://www.irongatesecurity.com/ironintel/ironcore-recon-2026-05-29)   ![Plexos\_IronGate\_Logo\_Final-2](https://www.irongatesecurity.com/hs-fs/hubfs/Plexos_IronGate_Logo_Final-2.png?width=301&height=46&name=Plexos_IronGate_Logo_Final-2.png) ![Irongate\_Award\_Logos](https://www.irongatesecurity.com/hs-fs/hubfs/Irongate_Award_Logos.png?width=557&height=210&name=Irongate_Award_Logos.png)   - [Privacy Policy](https://www.irongatesecurity.com/privacy-policy) - [Terms of Use](https://www.irongatesecurity.com/terms-of-use) - [Your Privacy Choices ![](https://www.irongatesecurity.com/hubfs/privacyoptions.png)](https://www.irongatesecurity.com/your-privacy-choices) © 2026 IronGate Cybersecurity LLC [*LinkedIn*](https://www.linkedin.com/company/irongate-cybersecurity-llc/?lipi=urn%3Ali%3Apage%3Ad_flagship3_search_srp_companies_load_more%3BcMuuS27qSPaVn%2BG%2BihNnZw%3D%3D) *Return to Top* ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "IronGate", "url" : "https://www.irongatesecurity.com/ironintel/author/irongate" }, "dateModified" : "2026-06-19T12:51:40.825Z", "datePublished" : "2026-06-19T12:51:40.000Z", "headline" : "IronCORE Recon 2026-06-19", "image" : [ "https://www.irongatesecurity.com/hubfs/ChatGPT%20Image%20Mar%2013%2c%202026%2c%2010_08_54%20AM.png" ], "mainEntityOfPage" : { "@id" : "https://www.irongatesecurity.com/ironintel/ironcore-recon-2026-06-19", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.irongatesecurity.com/hubfs/Plexos_IronGate_Logo_Final-1.png" }, "name" : "IronGate Cybersecurity LLC" } } ```