Check Point Research Details Global Surge in Ransomware and AI-Driven Cyber Threats

JERUSALEM, July 13 (AP) — Check Point Research released a comprehensive threat intelligence report on Sunday detailing a wave of sophisticated cyber incidents affecting organizations across the globe. The findings highlight data breaches at major institutions, ransomware attacks targeting state-owned enterprises, and the emergence of an autonomous artificial intelligence operation capable of executing complex intrusions without human intervention.

The security firm identified significant compromises involving AssuranceAmerica, a U.S.-based insurance provider, and Moody Bible Institute in Chicago, both of which suffered unauthorized data access. In Latvia, the national forestry company Latvijas Valsts Meži was hit by a ransomware attack that disrupted operations and encrypted critical files. These incidents underscore a broadening scope of targets extending from financial services to educational institutions and government-linked infrastructure.

A primary focus of the report is JadePuffer, an autonomous AI operation described as capable of self-directed reconnaissance and exploitation. Unlike traditional threat actors who rely on manual command structures, this system operates independently, adapting its tactics in real-time to bypass security controls. The emergence of such automated capabilities marks a shift toward more persistent and difficult-to-detect cyber campaigns.

Supply chain vulnerabilities also feature prominently in the findings. Injective Labs, a blockchain infrastructure provider, confirmed that attackers compromised third-party dependencies within their software ecosystem. Additionally, Check Point Research cataloged critical flaws across several widely used technologies, including Tenda routers, Linux KVM hypervisors, U-Boot bootloaders, and the Opera GX browser. A newly discovered vulnerability in Google Dialogflow CX was also flagged as a potential vector for attackers seeking to manipulate conversational AI systems.

The report profiles Cavern Manticore, a threat actor group linked to several of these operations. The group has demonstrated advanced capabilities in exploiting unpatched software and leveraging stolen credentials to maintain long-term access within victim networks. Security experts warn that the combination of automated tools like JadePuffer and targeted supply chain attacks creates a compounded risk for organizations relying on interconnected digital ecosystems.

While specific details regarding the volume of data exfiltrated from AssuranceAmerica and Moody Bible Institute remain under investigation, both entities have initiated incident response protocols to secure their networks. Latvijas Valsts Meži is currently working with cybersecurity specialists to restore systems affected by the ransomware demand.

The report concludes that while patches are available for many of the identified software vulnerabilities, widespread adoption remains inconsistent among users and enterprises globally. The rise of autonomous AI-driven attacks presents a new challenge for defensive strategies, as traditional signature-based detection methods may fail against rapidly evolving algorithms. Security teams worldwide are now assessing their exposure to these emerging threats as they await further updates on the JadePuffer operation's full capabilities.