Langflow RCE Exploitation (CVE-2026-0768) + Akira Ransomware & Q3 2026 Phishing Surge: OTX Pulse Analysis — Enterprise Detection Pack

Three OTX pulses paint a converging threat picture: AI/ML development platforms are now part of internet-wide exploitation (Langflow CVE-2026-0768), while Akira ransomware continues to monetize enterprise access (RDP intrusion, AV tampering, Rclone exfiltration, GOST tunnel persistence). Meanwhile, the Q3 2026 email threat landscape shows an explosive surge in phishing—7.3B threats detected Jul–Sep, with September spiking to ~3B (+41% MoM)—targeting legal, retail, manufacturing, and finance sectors via Agent Tesla, device code phishing, CAPTCHA-gated SVG lures, and domain spoofing. Collectively, these reflect a dual-track threat environment: mass vulnerability scanning of emerging AI infrastructure and high-volume social engineering feeding ransomware and infostealer operations.

Threat Actor / Malware Profile

Langflow Exploitation (CVE-2026-0768) — An unauthenticated remote code execution in the Langflow AI application-building platform. F5 Labs observed 405 exploitation attempts from 55 distinct IPs in September 2026, marking the first recorded AI/ML platform RCE in opportunistic internet-wide scanning. Payloads included capability probing; exploitation aligns with MITRE ATT&CK T1190 (Exploit Public-Facing Application) and likely T1059 (Command & Scripting Interpreter). This pulse also lists legacy CVEs (ProxyLogon CVE-2021-26855, PrintNightmare CVE-2021-34523, PHP CGI CVE-2024-4577, etc.), suggesting a broad exploit arsenal.

Akira Ransomware (S1129) — Akira affiliates gain initial access via RDP (T1133), disable antivirus (T1562.001 Impair Defenses), then deploy Rclone for data exfiltration (T1041 Exfiltration Over C2 Channel) and GOST tunneling for persistence and covert C2. Akira exfiltrates data before encrypting, applying double-extortion pressure. Tooling is living-off-the-land heavy; defense must key on behavior, not signatures.

Agent Tesla (S0331) & Q3 2026 Phishing Wave — Agent Tesla is a .NET-based infostealer delivered via phishing attachments (including SVG lures) and malicious links. It harvests credentials from browsers, mail clients, and FTP/VPN software, then exfiltrates via SMTP, HTTP, or Telegram. Q3 campaigns show declining QR phishing, resurgent CAPTCHA-gated pages, and device code phishing (OAuth device code flow abuse) to bypass MFA—indicating actors are optimizing for identity compromise.

IOC Analysis

Indicator types across pulses include CVEs (Langflow + legacy RCEs), domains (e.g., wekash.net, splace.co.za, carloxmextos.org), URLs (phishing landing paths mimicking OneDrive), and FileHash-SHA256 values tied to Akira tooling and phishing payloads. SOC teams should operationalize by: (1) pushing CVEs to vuln management and edge/WAF blocking, (2) adding domains/URLs to proxy, DNS sinkhole, and email secure gateway blocklists, (3) loading SHA256 hashes into EDR blocklists and VirusTotal/OTX lookups, and (4) mapping behaviors (Rclone, GOST, rundll32/svg phishing) to detection rules. Use MISP/ThreatIntel platforms to normalize STIX/TAXII, and enrich with OTX pulses for context and confidence scoring.

Detection Engineering

---
title: Langflow CVE-2026-0768 Exploitation Attempt
id: 7f3a1c2e-9d4b-4a1f-8c2e-5f6a7b8c9d0e
status: experimental
description: Detects unauthenticated RCE exploitation attempts against Langflow AI platform
author: Security Arsenal
date: 2026/11/06
logsource:
  category: webserver
  product: iis|apache|nginx
detection:
  selection:
    cs-method: 'POST'
    cs-uri-query|contains:
      - 'exec'
      - 'cmd'
      - 'payload'
    c-ip|contains: '55.'  # scanning IPs observed; refine with pulse IOCs
  condition: selection
level: high
tags:
  - attack.t1190
  - attack.initial_access
  - cve.2026.0768
---
title: Akira Ransomware Rclone Exfiltration
id: 2b8c4d6f-1e3a-4f5b-9c7d-2a4b6c8d0e1f
status: experimental
description: Detects Rclone usage for data exfiltration by Akira ransomware operators
author: Security Arsenal
date: 2026/11/06
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\rclone.exe'
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - '--config'
      - 'remote:'
  condition: selection
level: high
tags:
  - attack.t1041
  - attack.exfiltration
  - malware.akira
---
title: Agent Tesla Phishing Attachment Execution
id: 4c6d8e0f-2a3b-4c5d-7e8f-1a2b3c4d5e6f
status: experimental
description: Detects execution of suspicious SVG/attachment-based Agent Tesla payloads
author: Security Arsenal
date: 2026/11/06
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\rundll32.exe'
      - '\mshta.exe'
      - '\powershell.exe'
    CommandLine|contains:
      - 'svg'
      - 'attachment'
      - 'Invoke-Expression'
      - 'DownloadString'
  condition: selection
level: medium
tags:
  - attack.t1059
  - attack.t1204
  - malware.agent_tesla

// Hunt for Akira Rclone exfiltration and GOST tunneling
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("rclone.exe","gost.exe")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName
| join kind=leftouter (DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemotePort in (443, 8443, 1080, 8080)
    | project TimeGenerated, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName) on DeviceName, InitiatingProcessFileName
| summarize ExfilAttempts=count(), UniqueDestinations=dcount(RemoteIP) by DeviceName, FileName, bin(TimeGenerated, 1h)
| where UniqueDestinations > 3 or ExfilAttempts > 10

# Hunt for Akira persistence & Agent Tesla artifacts
$paths = @("$env:APPDATA\rclone\rclone.conf","$env:TEMP\*.svg","$env:ProgramData\Microsoft\Crypto\RSA\MachineKeys")
foreach ($p in $paths) { if (Test-Path $p) { Write-Host "[HIT] $p" } }
Get-ScheduledTask | Where-Object {$_.TaskName -match "rclone|gost|agent"} | Select-Object TaskName,TaskPath
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" | Select-Object * | Out-String
netstat -ano | Select-String ":443|:8443|:1080"

Response Priorities

• Immediate: Block CVE-2026-0768 at WAF/edge; isolate endpoints with Rclone/GOST execution; block phishing domains/URLs and SHA256 hashes; hunt for the Sigma/KQL patterns above.
• 24h: If Agent Tesla or credential harvesting is suspected, force enterprise-wide password resets, revoke OAuth tokens, audit device code grants, and enforce phishing-resistant MFA.
• 1 week: Harden AI/ML platforms (patch Langflow, restrict unauthenticated access), disable RDP where not required, deploy application control (block rclone/gost by default), and tighten email defenses (SVG attachment sandboxing, DMARC enforcement).

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub