Major Incidents or Breaches

  • Attackers are actively exploiting a maximum-severity Adobe ColdFusion vulnerability tracked as CVE-2026-48282, enabling remote code execution[17].
  • River Bank & Trust, a US financial institution, has experienced a data breach, with customer data exposed[32].
  • Armored Likho, an APT group, has gained access to government agencies and electrical power entities in Russia, Brazil, and Kazakhstan using modular RATs and information stealers[18][27].
  • The NetNut residential proxy botnet, built on millions of hijacked devices and used by criminals, was disrupted through a coordinated operation involving Google, the FBI, and others[35].

Newly Discovered Vulnerabilities

  • Several Tenda router firmware versions contain an undocumented authentication backdoor, granting administrative access to attackers[2].
  • BeyondTrust patched two critical authentication bypass flaws in Remote Support (RS) and Privileged Remote Access (PRA) products that could allow unauthenticated attackers to gain access[3][11].
  • A 16-year-old use-after-free bug in Linux’s KVM hypervisor, dubbed ‘Januscape’ (CVE-20xxxx), allows guest VMs to escape to the host on Intel and AMD x86 systems[5].
  • Threat actors are probing a critical flaw in Gitea Docker images (CVE-2026-20896), which was recently patched[6].
  • Attackers are targeting a newly disclosed memory disclosure flaw in Citrix NetScaler products following the release of a proof-of-concept exploit[19].
  • Proof-of-concept code has been released for a root escalation vulnerability in Linux known as ‘Bad Epoll’, increasing the risk of exploitation[29].

Notable Threat Actor Activity

  • An Iranian APT group affiliated with Iran’s Ministry of Intelligence and Security has been using a new modular C2 framework, Cavern (also called Cavern Manticore), to target Israeli organizations[4][31].
  • A suspected China-nexus threat cluster is distributing a fake Indian tax filing utility to deliver DcRAT, targeting Indian taxpayers, tax professionals, and finance teams[9].
  • North Korean threat actors have compromised over 100 legitimate open source packages and repositories in the PolinRider campaign to deliver a backdoor and information stealer to developers[28].
  • Threat actors are abusing Microsoft Teams voice calls by impersonating IT support to distribute EtherRAT malware for initial access[14].
  • Phishing campaigns are impersonating over 30 major brands in fake job interviews to steal Google account credentials from marketing professionals[13].
  • Securonix has observed ‘Veil#Drop’ attacks leveraging compromised websites, Blogspot, PowerShell, and fileless techniques to deploy the PureLog information stealer[25].

Trends, Tools, or Tactics of Interest

  • Device Code Phishing attacks are leveraging the OAuth 2.0 Device Authorization Grant on Microsoft websites to trick users, bypassing traditional URL-checking defenses[1].
  • Researchers demonstrated ‘TrojPix’, a new technique for exfiltrating data from air-gapped systems by manipulating on-screen pixels to transmit information via video cable emissions[10].
  • The first complete LLM-driven ransomware attack, dubbed JadePuffer, was reported, where an agentic threat actor exploited a Langflow flaw to steal data and encrypt systems[20].
  • Researchers have uncovered prompt injection attacks embedding malicious prompts in websites to trick autonomous AI agents into making unauthorized cryptocurrency payments[30].
  • Blogspot-hosted payloads and fileless malware delivery methods are being used in recent sophisticated attack frameworks[25].
  • Ongoing discussion on the rapid pace of software development driven by AI and the associated lag in security integration and controls[16].
  • The NetNut botnet disruption highlights the prevalence and risks of residential proxy networks built on compromised devices[35].

Regulatory or Policy Developments Affecting the Security Industry

  • Vietnamese authorities arrested seven individuals allegedly responsible for operating HiAnime, a major anime piracy streaming service, prior to its shutdown in June[15].
  • The Office of Professional Responsibility within ICE has opened over 100 cases investigating incidents of doxing and threats against ICE employees, reflecting increased scrutiny of online threats targeting government personnel[21].

Sources#

  1. Max severity Adobe ColdFusion flaw now exploited in attacks - bleepingcomputer.com
  2. 6th July – Threat Intelligence Report - research.checkpoint.com
  3. 'BusySnake' Infostealer Slithers into Critical Infrastructure Networks - darkreading.com
  4. Armored Likho APT Targeting Government, Electric Power Entities - securityweek.com
  5. NetNut botnet takes a hit. Don’t be part of the next one. - malwarebytes.com
  6. CERT/CC Warns of Hidden Admin Backdoor in Tenda Router Firmware - thehackernews.com
  7. BeyondTrust Patches Critical Auth Bypass Flaws in Remote Support and PRA - thehackernews.com
  8. BeyondTrust warns of critical flaws in remote access software - bleepingcomputer.com
  9. 16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems - thehackernews.com
  10. Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure - thehackernews.com
  11. CitrixBleed-ing Again? NetScaler Vulnerability Under Attack - darkreading.com
  12. Proof-of-Concept Exploit Released for Linux ‘Bad Epoll’ Root Access Vulnerability - securityweek.com
  13. Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations - thehackernews.com
  14. Cavern Manticore: Exposing Iran-Linked Modular C2 Framework - research.checkpoint.com
  15. Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT - thehackernews.com
  16. North Korean Hackers Target Open Source Developers in Supply Chain Attacks - securityweek.com
  17. Fake IT support calls on Microsoft Teams push EtherRAT malware - bleepingcomputer.com
  18. Phishing poses as big-brand job interview to steal Google accounts - bleepingcomputer.com
  19. Blogspot-Hosted Payloads Delivered in ‘Veil#Drop’ Attacks - securityweek.com
  20. When checking the URL isn’t enough: a Device Code Phishing attack via a Microsoft website - securelist.com
  21. New TrojPix Attack Leaks Data From Air-Gapped Systems via Video Cable Emissions - thehackernews.com
  22. JadePuffer: The First Complete LLM-Driven Ransomware Attack - darkreading.com
  23. Prompt Injection Attacks Trick AI Agents Into Making Crypto Payments - securityweek.com
  24. Software Is Now Written at the Speed of Thought. Security Isn't. - bleepingcomputer.com
  25. Vietnam arrests suspects behind HiAnime anime piracy service - bleepingcomputer.com
  26. ICE’s Internal Watchdog Is Now Investigating Online Critics - wired.com