Cybersecurity Brief – 2026-08-12

Wed, 12 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Wesco, a global supply chain and distribution company, is investigating a cybersecurity incident following claims by the ExfilSquad group of data theft from the company ^[30].
Mozilla revoked and updated the cryptographic signing key for Firefox and Thunderbird Linux releases after an unencrypted copy was accidentally committed to a private code repository, potentially impacting the integrity of downloads ^[17]^[31].
Fake CCleaner websites are distributing multi-stage malware that installs the GhostDesk spyware extension in Chrome browsers ^[54].
Attackers are using fake branded download pages to trick Windows users into installing legitimate remote-access software, which is then abused for unauthorized access ^[60].

Newly Discovered Vulnerabilities

SAP patched a maximum-severity flaw in Commerce Cloud (Data Hub Adapter) that allowed unauthenticated remote code execution ^[6]^[52].
Microsoft addressed nearly 400 vulnerabilities in its August Patch Tuesday, including a Windows kernel driver zero-day (afd.sys) under active attack for privilege escalation to SYSTEM, with three zero-days in total patched ^[9]^[28]^[37]^[40]^[42]^[48].
A proof-of-concept exploit named ShieldBreak was released, demonstrating a Microsoft Defender patch bypass that grants SYSTEM access ^[7].
Cisco Secure Firewall ASA and FTD vulnerabilities (CVE-2026-20349) are being actively exploited in the wild to trigger remote denial-of-service attacks, with patches released ^[8]^[25]^[47].
SonicWall patched critical vulnerabilities in its discontinued GMS platform that allowed unauthenticated remote code execution and data exposure ^[46].
Researchers disclosed an AI-assisted exploit chain for Microsoft SharePoint that enables unauthenticated remote code execution, now being used in ransomware attacks ^[13]^[34].
Zoom patched a vulnerability in the annotation tool that allowed meeting participants to hijack other attendees’ clients and execute code remotely ^[11]^[39]^[50].
Ivanti EPM updates addressed flaws that could leak credentials for external SQL connections or crash agent services ^[44].
Adobe released urgent patches for ColdFusion and Campaign Classic to fix critical code execution and denial-of-service vulnerabilities ^[49].
ClamAV vulnerabilities affecting Cisco Secure Endpoint Connector can be exploited for denial-of-service attacks, with public exploits available ^[35].
Siemens, Schneider, and Phoenix Contact released security updates addressing vulnerabilities in ICS and OT products ^[45].

Notable Threat Actor Activity

The Head Mare APT group is exploiting unpatched TrueConf server vulnerabilities to deliver PhantomCore and PhantomGraph backdoors to video conference participants via malicious installers ^[1].
Project CAV3RN is targeting Israeli organizations using Google Apps Script as a command-and-control relay and DNS-based channel selection, leveraging a modular .NET NativeAOT framework to evade detection ^[2].
The Russian Sandworm-linked group UAC-0145 is conducting social engineering campaigns targeting IT workers with fake job interviews, distributing a trojanized WireGuard VPN client capable of executing commands ^[12]^[24].
Researchers hired three suspected North Korean IT workers by creating a fake cryptocurrency startup, observing operational security tactics such as the use of virtual machines and attempts to exfiltrate data ^[18].
Gunra ransomware is targeting critical infrastructure globally, exploiting vulnerabilities in Fortinet and Schneider Electric products, and bypassing multi-factor authentication using leaked Conti code ^[21]^[36]^[38].
DeadLock ransomware is using decentralized, blockchain-based infrastructure (Polygon smart contracts) to facilitate victim communications and data leaks, making disruption more difficult ^[14]^[23].
Malicious SIM cards have been shown to execute attacker-controlled code within cellular IoT device modems, affecting sectors such as electric vehicle charging and industrial automation ^[16].

Trends, Tools, or Tactics of Interest

The Kimwolf v7 Android and IoT botnet has been updated to generate HTTP/2 DDoS traffic that closely mimics legitimate browsing, enhancing operational resilience and evasion ^[10].
DDoS attacks exceeding 1 Tbps increased fivefold in the last quarter, with over 800 network-layer attacks mitigated ^[33].
Malicious LiteLLM releases on PyPI, linked to the Trivy hack, carried credential-stealing code and potentially exposed sensitive data from over 2,100 organizations ^[5].
Attackers can split instructions across malicious MCP servers to covertly exfiltrate secrets from AI coding agents without triggering obvious alerts ^[20].
Researchers demonstrated that Windows Plug and Play USB auto-install can be abused to chain vendor software installation components, achieving SYSTEM-level access on fully updated Windows 11 machines ^[19].
AI tools are increasingly being used both for vulnerability discovery (e.g., in the Zoom and SharePoint exploits) and as a target for exploitation, with risks from vague task delegation and broad access in enterprise environments ^[13]^[32]^[39].
OpenAI launched GPT-5.6-Cyber, a model with reduced safeguards designed for cybersecurity tasks such as exploit development and incident response ^[15].

Regulatory or Policy Developments Affecting the Security Industry

U.S. and South Korean authorities issued joint warnings to government and critical infrastructure organizations regarding Gunra ransomware activity exploiting known vulnerabilities ^[21]^[36].
CISA published advisories on vulnerabilities in ICS and OT products from Siemens, Schneider, and Phoenix Contact ^[45].
Google reported that Chrome’s anti-abuse systems have reduced unwanted Android notifications by more than 7 billion per day in Q1 2026 ^[22].

Sources

Wesco confirms security incident after ExfilSquad claims data theft - bleepingcomputer.com
Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Key Lands in Private Repo - thehackernews.com
Mozilla updates GPG signing key for Firefox releases after exposure - bleepingcomputer.com
Fake CCleaner installs GhostDesk Chrome spyware - malwarebytes.com
Fake popular sites offer a free app, instead take over PCs - malwarebytes.com
SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code - thehackernews.com
SAP Patches Critical Code Injection, Memory Corruption Vulnerabilities - securityweek.com
Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack - thehackernews.com
Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days - bleepingcomputer.com
Microsoft's Patch Tuesday Deluge Continues With August Updates - darkreading.com
Microsoft Plugs Nearly 400 Security Holes - krebsonsecurity.com
Microsoft Patch Tuesday August 2026, (Tue, Aug 11th) - isc.sans.edu
August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day - securityweek.com
ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access - thehackernews.com
Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS - thehackernews.com
Cisco warns of ASA and FTD VPN flaw exploited to crash devices - bleepingcomputer.com
Cisco Patches Firewall Zero-Day Exploited for DoS Attacks - securityweek.com
SonicWall Patches Critical Vulnerabilities in Discontinued GMS Platform - securityweek.com
Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE - thehackernews.com
CISA: Microsoft SharePoint flaw now exploited in ransomware attacks - bleepingcomputer.com
Zoom Annotation Flaws Could Let a Meeting Participant Hijack Another Attendee's Client - thehackernews.com
A Zoom Screen-Sharing Bug Let Anyone Take Over Other Devices on a Call - wired.com
Zoom Patches Zero-Click Code Execution Vulnerability - securityweek.com
Ivanti EPM Update Patches Remotely Exploitable Flaws - securityweek.com
Adobe Urges Immediate Patching of Critical ColdFusion, Campaign Classic Flaws - securityweek.com
Cisco warns of high-severity ClamAV flaws with public exploits - bleepingcomputer.com
ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Phoenix Contact - securityweek.com
Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference participants - securelist.com
Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection - securelist.com
Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands - thehackernews.com
Sandworm hackers target IT pros with trojanized WireGuard VPN client - bleepingcomputer.com
Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers - thehackernews.com
Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks - thehackernews.com
US and South Korea warn of Gunra ransomware targeting govt agencies - bleepingcomputer.com
Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA - darkreading.com
DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt - thehackernews.com
DeadLock ransomware uses blockchain to resist infrastructure takedown - bleepingcomputer.com
A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices - thehackernews.com
Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing - thehackernews.com
DDoS attacks over 1 Tbps surged fivefold in the second quarter - bleepingcomputer.com
Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations - thehackernews.com
Malicious MCP Servers Can Split Instructions to Make AI Coding Agents Exfiltrate Secrets - thehackernews.com
Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11 - thehackernews.com
Vague Task, Total Access: When AI Delegation Becomes a Security Risk - bleepingcomputer.com
OpenAI Launches GPT-5.6-Cyber with Reduced Safeguards for Exploit Development - thehackernews.com
Google says Chrome cuts 7 billion unwanted Android notifications a day to fight abuse - bleepingcomputer.com

DeadLock ransomware on DanSec Daily

Cybersecurity Brief – 2026-08-12

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Sources