Cybersecurity Brief – 2026-07-07

Tue, 07 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Attackers are actively exploiting a maximum-severity Adobe ColdFusion vulnerability tracked as CVE-2026-48282, enabling remote code execution^[17].
River Bank & Trust, a US financial institution, has experienced a data breach, with customer data exposed^[32].
Armored Likho, an APT group, has gained access to government agencies and electrical power entities in Russia, Brazil, and Kazakhstan using modular RATs and information stealers^[18]^[27].
The NetNut residential proxy botnet, built on millions of hijacked devices and used by criminals, was disrupted through a coordinated operation involving Google, the FBI, and others^[35].

Newly Discovered Vulnerabilities

Several Tenda router firmware versions contain an undocumented authentication backdoor, granting administrative access to attackers^[2].
BeyondTrust patched two critical authentication bypass flaws in Remote Support (RS) and Privileged Remote Access (PRA) products that could allow unauthenticated attackers to gain access^[3]^[11].
A 16-year-old use-after-free bug in Linux’s KVM hypervisor, dubbed ‘Januscape’ (CVE-20xxxx), allows guest VMs to escape to the host on Intel and AMD x86 systems^[5].
Threat actors are probing a critical flaw in Gitea Docker images (CVE-2026-20896), which was recently patched^[6].
Attackers are targeting a newly disclosed memory disclosure flaw in Citrix NetScaler products following the release of a proof-of-concept exploit^[19].
Proof-of-concept code has been released for a root escalation vulnerability in Linux known as ‘Bad Epoll’, increasing the risk of exploitation^[29].

Notable Threat Actor Activity

An Iranian APT group affiliated with Iran’s Ministry of Intelligence and Security has been using a new modular C2 framework, Cavern (also called Cavern Manticore), to target Israeli organizations^[4]^[31].
A suspected China-nexus threat cluster is distributing a fake Indian tax filing utility to deliver DcRAT, targeting Indian taxpayers, tax professionals, and finance teams^[9].
North Korean threat actors have compromised over 100 legitimate open source packages and repositories in the PolinRider campaign to deliver a backdoor and information stealer to developers^[28].
Threat actors are abusing Microsoft Teams voice calls by impersonating IT support to distribute EtherRAT malware for initial access^[14].
Phishing campaigns are impersonating over 30 major brands in fake job interviews to steal Google account credentials from marketing professionals^[13].
Securonix has observed ‘Veil#Drop’ attacks leveraging compromised websites, Blogspot, PowerShell, and fileless techniques to deploy the PureLog information stealer^[25].

Trends, Tools, or Tactics of Interest

Device Code Phishing attacks are leveraging the OAuth 2.0 Device Authorization Grant on Microsoft websites to trick users, bypassing traditional URL-checking defenses^[1].
Researchers demonstrated ‘TrojPix’, a new technique for exfiltrating data from air-gapped systems by manipulating on-screen pixels to transmit information via video cable emissions^[10].
The first complete LLM-driven ransomware attack, dubbed JadePuffer, was reported, where an agentic threat actor exploited a Langflow flaw to steal data and encrypt systems^[20].
Researchers have uncovered prompt injection attacks embedding malicious prompts in websites to trick autonomous AI agents into making unauthorized cryptocurrency payments^[30].
Blogspot-hosted payloads and fileless malware delivery methods are being used in recent sophisticated attack frameworks^[25].
Ongoing discussion on the rapid pace of software development driven by AI and the associated lag in security integration and controls^[16].
The NetNut botnet disruption highlights the prevalence and risks of residential proxy networks built on compromised devices^[35].

Regulatory or Policy Developments Affecting the Security Industry

Vietnamese authorities arrested seven individuals allegedly responsible for operating HiAnime, a major anime piracy streaming service, prior to its shutdown in June^[15].
The Office of Professional Responsibility within ICE has opened over 100 cases investigating incidents of doxing and threats against ICE employees, reflecting increased scrutiny of online threats targeting government personnel^[21].

Sources

Max severity Adobe ColdFusion flaw now exploited in attacks - bleepingcomputer.com
6th July – Threat Intelligence Report - research.checkpoint.com
'BusySnake' Infostealer Slithers into Critical Infrastructure Networks - darkreading.com
Armored Likho APT Targeting Government, Electric Power Entities - securityweek.com
NetNut botnet takes a hit. Don’t be part of the next one. - malwarebytes.com
CERT/CC Warns of Hidden Admin Backdoor in Tenda Router Firmware - thehackernews.com
BeyondTrust Patches Critical Auth Bypass Flaws in Remote Support and PRA - thehackernews.com
BeyondTrust warns of critical flaws in remote access software - bleepingcomputer.com
16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems - thehackernews.com
Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure - thehackernews.com
CitrixBleed-ing Again? NetScaler Vulnerability Under Attack - darkreading.com
Proof-of-Concept Exploit Released for Linux ‘Bad Epoll’ Root Access Vulnerability - securityweek.com
Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations - thehackernews.com
Cavern Manticore: Exposing Iran-Linked Modular C2 Framework - research.checkpoint.com
Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT - thehackernews.com
North Korean Hackers Target Open Source Developers in Supply Chain Attacks - securityweek.com
Fake IT support calls on Microsoft Teams push EtherRAT malware - bleepingcomputer.com
Phishing poses as big-brand job interview to steal Google accounts - bleepingcomputer.com
Blogspot-Hosted Payloads Delivered in ‘Veil#Drop’ Attacks - securityweek.com
When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website - securelist.com
New TrojPix Attack Leaks Data From Air-Gapped Systems via Video Cable Emissions - thehackernews.com
JadePuffer: The First Complete LLM-Driven Ransomware Attack - darkreading.com
Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments - securityweek.com
Software Is Now Written at the Speed of Thought. Security Isn't. - bleepingcomputer.com
Vietnam arrests suspects behind HiAnime anime piracy service - bleepingcomputer.com
ICE’s Internal Watchdog Is Now Investigating Online Critics - wired.com

NetNut on DanSec Daily

Cybersecurity Brief – 2026-07-07

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Sources