WEEKLY INTELLIGENCE BRIEFING

Critical VMware vCenter RCE Exploited by APT Across 47 Countries. A directory traversal flaw in VMware vCenter Syslog Server (CVE-2026-59310) is being actively exploited by an APT actor to deploy reverse_ssh for persistent remote access, with confirmed hits across 361 IP addresses in 47 countries. Broadcom patched the flaw on July 29, but researchers warn that patching alone may be insufficient if the actor has already established footholds. Learn more

Adobe Commerce Auth Bypass (CVE-2026-71362) Exploited Immediately After Disclosure. A critical incorrect authorization vulnerability (CVSS 9.1) in Adobe Commerce and Magento allows unauthenticated attackers to hijack customer accounts and access private data via session switching. Exploitation attempts were detected by Sansec within hours of Adobe's patch release. Learn more

SAP Commerce Cloud RCE (CVE-2026-58231) Targeted Within Three Days of Patch. An improper authorization flaw enabling unauthenticated RCE in SAP Commerce Cloud was confirmed exploited in the wild just three days after SAP released a fix, with honeypot data from Defused confirming active attempts. SAP has not yet formally flagged it as exploited, underscoring the gap between vendor timelines and real-world attacker speed.

Windows Zero-Day 'ShieldBreak' Bypasses Defender, Grants SYSTEM Privileges. Researcher Nightmare Eclipse publicly dropped a new exploit targeting a Windows User Profile Service flaw (CVE-2026-62832, now patched as LegacyHive) that allows any authenticated local user to escalate to SYSTEM. The researcher released it publicly to protest Microsoft's vulnerability disclosure practices, making weaponized code immediately available to threat actors. Learn more

Key Takeaway

Patch VMware vCenter, Adobe Commerce, and SAP Commerce Cloud immediately and conduct post-compromise threat hunts on all three, as exploitation preceded or matched patch timelines.

Shell Investigates Data Theft After Clop Claims 89GB Stolen via PTC Software Flaw. Clop ransomware claims to have exfiltrated 89GB of Shell engineering drawings and facility reports by exploiting CVE-2026-12569 in PTC's Windchill and FlexPLM software, with General Electric and Philips also reportedly impacted. Both PTC and CISA have issued advisories for this actively exploited vulnerability.

RingCentral Breach: ShinyHunters Leak 1.6 Million Accounts After Ransom Refusal. The ShinyHunters extortion group claims to have stolen 623GB from RingCentral via a social engineering campaign and subsequently leaked over 280GB of data including names, addresses, emails, and phone numbers after RingCentral declined to pay. Have I Been Pwned has confirmed the validity of the leaked records.

Akira Affiliate Disables EDR via Safe Mode, Exfiltrates Data but Fails to Encrypt. An Akira ransomware affiliate gained initial access through an unpatched SonicWall VPN, then rebooted the target into Safe Mode with Networking to neuter the EDR agent and Microsoft Defender. The ransomware payload failed to execute due to memory constraints in the stripped environment, but the attacker still succeeded in exfiltrating data for extortion purposes.

UK Cyber Attacks Surge 26% Year-on-Year as Global Ransomware Activity Doubles. UK organizations averaged 1,597 weekly attacks per entity in July 2026, a 26% year-on-year increase outpacing the global average, while worldwide ransomware victim reporting has surged 87% year-on-year. Generative AI tooling is cited as a new data exposure vector compounding existing risks. Learn more

Key Takeaway

Test EDR behavior in Safe Mode as part of your detection validation program, and verify SonicWall VPN patch status now as a first-step ransomware entry vector.

Trivy Scanner Compromise, Not LiteLLM, Was Root Cause for 2,500 Org Exposure. New analysis from researchers revealed that the majority of the 2,500 organizations attributed to the LiteLLM supply chain attack were actually compromised earlier through a vulnerability in Aqua Security's Trivy container scanner, which harvested secrets and credentials at scale before LiteLLM packages were even published.

ShipMonk Breach Exposes 14,000 Trezor Customers via Metabase Zero-Day. Trezor disclosed that its third-party logistics provider ShipMonk was compromised via a zero-day in the analytics platform Metabase, exposing nearly 14,000 customer names, shipping addresses, emails, and phone numbers. ShinyHunters have also claimed an attack on Metabase itself, suggesting a broader campaign against the platform. Learn more

Beacon CRM Breach Hits Over 1,000 Charities After AWS Key Exposed in JS Build Artifacts. UK CRM provider Beacon disclosed that attackers used a compromised AWS access key, found exposed in public JavaScript build artifacts, to download encrypted database backups affecting donor and supporter data for more than 1,000 charities. While financial data was not compromised, the incident is a textbook example of secret sprawl in CI/CD pipelines.

Key Takeaway

Audit third-party software tools used in your DevSecOps pipeline (including scanners and analytics platforms) for exposed secrets and perform regular secret rotation across all CI/CD artifacts.

Lazarus Group Deploys New 'Troy' Backdoor via Windows Zero-Day in Operation Dream Job. North Korea's Lazarus Group exploited CVE-2026-68820, a privilege escalation flaw in Windows Ancillary Function Driver for WinSock (AFD.sys), to achieve SYSTEM access and deploy the new Troy backdoor against defense and aerospace firms in France, Germany, Brazil, and India. The campaign used fake job offers as lures, consistent with Lazarus's long-running Operation Dream Job playbook. Learn more

Near-Autonomous AI Cyberattack Observed Against Taiwan Government. Suspected Chinese threat actors deployed an AI-driven attack framework against Taiwan's government that adapted mid-operation without human direction, autonomously researching vulnerabilities, pivoting to IT supply chain vendors and energy companies, and self-correcting errors. Researchers describe this as the first observed near-autonomous offensive AI operation against a government target. Learn more

Jewelbug APT Blends Government Espionage with Cryptocurrency Theft on a Single Panel. Researchers identified Jewelbug (also tracked as Earth Alux and REF7707) operating both state-sponsored espionage against 15 government webmail tenants in the Middle East and large-scale cryptocurrency fraud from the same control panel, with the Antino backdoor and browser credential-harvesting tools deployed across both mission sets. Learn more

HoneyMyte Upgrades CoolClient Backdoor with Kernel-Level Windows Rootkit. The HoneyMyte APT group, targeting countries across Asia, has added a kernel-mode rootkit driver to its CoolClient backdoor that hides processes, files, and network connections from security tooling while also adding Microsoft Defender exclusions to reduce detection likelihood.

Key Takeaway

Defense and aerospace organizations should validate controls against fake job offer phishing chains and treat any AFD.sys exploitation indicators as a Lazarus Group signal requiring immediate escalation.

Plug and Pwn: Fake USB Devices Exploit Windows Plug and Play for SYSTEM Privileges. Researchers demonstrated an attack technique that emulates USB devices to trigger Windows Plug and Play into installing signed but vulnerable vendor software packages with SYSTEM privileges, with some variants requiring no user interaction and one executable remotely over RDP without physical hardware present. Learn more

737 Fake Chrome VPN Extensions Route User Traffic Through a Single Russian Proxy. Over 737 malicious Chrome extensions impersonating popular VPN brands were found in the Chrome Web Store with nearly 75,000 combined downloads, secretly routing user traffic through SOCKS5 proxies tied to a single Russian provider while also engaging in subscription fraud. Learn more

City-Forum Campaign Has Quietly Stolen Data from Salesforce and ServiceNow Since March 2025. The persistent City-Forum campaign exploits misconfigured Salesforce Experience Cloud and ServiceNow customer portals that expose data to anonymous users, using custom tooling to exfiltrate records from finance, telecoms, and public sector organizations worldwide. The campaign leverages novel techniques against newer Salesforce frameworks, and defenders cannot rely on vulnerability patching alone since the root cause is misconfiguration. Learn more

Key Takeaway

Audit Salesforce Experience Cloud and ServiceNow portal permissions for anonymous data exposure, and implement a browser extension allowlist policy to block unauthorized extensions enterprise-wide.

• https://www.bleepingcomputer.com/news/security/critical-vmware-vcenter-rce-flaw-exploited-for-reverse-ssh-access/
• https://thehackernews.com/2026/08/lazarus-exploits-windows-zero-day-to.html
• https://cyberscoop.com/near-autonomous-ai-attack-government-target-taiwan/
• https://www.bleepingcomputer.com/news/security/city-forum-data-theft-attacks-target-salesforce-servicenow-portals/
• https://www.securityweek.com/trivy-not-litellm-behind-the-2500-org-compromise/
• https://www.bleepingcomputer.com/news/security/hackers-exploit-critical-adobe-commerce-flaw-to-hijack-customer-accounts/
• https://www.bleepingcomputer.com/news/security/white-house-taps-security-firms-for-offensive-hack-back-operations/
• https://www.bleepingcomputer.com/news/security/plug-and-pwn-attack-uses-fake-usb-devices-for-windows-system-access/