Inferlume

Top CVEs CVE-2026-8037 Progress LoadMaster unauthenticated command injection CVSS 9.6 CISA KEV active exploitation confirmed patch by 10 August 2026 for FCEB CVE-2026-9198 IBM Langflow unauthenticated code injection RCE on default deployments CVSS 9.8 CISA KEV fixed in 1.10.1 CVE-2026-63077 JetBrains TeamCity unauthenticated RCE via agent polling deserialization path CVSS 9.8 class reporting CISA KEV fixed in 2026.1.3 and 2025.11.7 CVE-2026-18577 and CVE-2026-18556 Nable Ncentral authentication bypass CVSS 8.2 both KEV incomplete fix narrative between the pair CVE-2026-34486 Apache Tomcat EncryptInterceptor bypass cluster message protection failure CVSS 7.5 CISA KEV fixed in 11.0.21 10.1.54 9.0.117 CVE-2026-64638 WordPress Core pre authentication reflected XSS on login XSS2Shell CVSS 8.9 fixed in 7.0.3 and backports RCE chain requires additional conditions user interaction in the wild mass exploitation not confirmed CVE-2026-59309 and CVE-2026-59310 VMware vCenter critical authentication bypass and syslog directory traversal RCE CVSS 9.8 class Broadcom emergency patches no workarounds exploitation in the wild not confirmed in early week coverage CVE-2026-16723 Fastjson 1.x RCE class issue under active attack per secondary research no 1.x fix path migrate to 2.x CVE-2026-3055 and CVE-2026-39987 Citrix NetScaler memory disclosure and Marimo notebook command execution used in Unit42 observed manual campaign impact CVE-2026-42897 Outlook Web Access persistent XSS exploited to deploy OWAReaper implant patched by Microsoft in mid May exploitation reported ongoing CVE-2026-15409 and CVE-2026-15410 SonicWall SMA1000 SSRF and RCE chain CISA KEV since 14 July reported active use by INC ransomware this week CVE-2021-22681 Unitronics Vision Series default credential flaw reused in the Minnesota water utility incident despite being years old not confirmed whether this specific CVE was the sole vector versus default credential access alone CVE-2026-66066 KindaRails2Shell Ruby on Rails Active Storage unauthenticated file read RCE patched this week

Attack Vectors This Week Unauthenticated and alternate path exploitation against internet reachable management APIs dominated confirmed KEV activity especially command injection authentication bypass and unsafe deserialization on appliances and CI CD control planes. Secondary but strategically important vectors included OAuth device code phishing against cloud identities vishing assisted SaaS takeover RMM dual use installation via banking lures and parser differential XSS on ubiquitous CMS login surfaces. Supply chain and dependency risk remained elevated in reporting npm centric patterns in CrowdStrike H1 data unmaintained Java JSON libraries while cloud third party storage exposure drove the week major healthcare adjacent breach disclosure. Exploitation of internet facing management and remote access infrastructure dominated the window SonicWall SMA1000 Nable Ncentral Cisco adjacent remote management and OWA all fit this pattern of attackers targeting the administrative or webmail layer rather than endpoints directly. Credential theft and access persistence featured heavily both in the OWAReaper implant browser storage persistence and in the Minnesota water utilities default credential exposure. Supply chain and third party cloud exposure also surfaced with Amgen breach traced to third party cloud providers rather than Amgen own infrastructure.

Actor and Infrastructure Patterns Storm1175 Microsoft financially motivated StormEncryptor C++ .encrypted extension !!!README_FIRST!!!.txt post compromise use of AnyDesk SimpleHelp Advanced IP Scanner Mimikatz LSASS rapid disclosure to ransomware tempo prior Medusa association. Nable initial access Under Attribution likely per Microsoft not confirmed. knaithe KnYuan Unit42 Chinese speaking opportunistic operator DeepSeek plus Hermes Agent plus Telegram tasking FOFA enumeration public GitHub PoCs accidental workspace exposure via python3 m http.server mixed autonomous failure and manual success. China nexus SNOWLIGHT delivery against Tomcat and broader spray infrastructure reported via consulted sources with UNC style cluster labels in some write ups. Treat multi country government commercial scanning as corroborated theme precise group unification remains Under Attribution where only single commercial telemetry is available. APT29 Cozy Bear cited by CrowdStrike as prominent device code phishing operator against cloud identities technique emphasis not a new full campaign dossier this week. FAMOUS CHOLLIMA STARDUST CHOLLIMA DPRK nexus CrowdStrike report context AI environment and npm supply chain themes in H1 2026 hunting retrospective background pressure not a fresh Week of August 2 exclusive intrusion set. Cybercrime legal closure Connor Riley Moucka guilty plea Krebs on Snowflake era extortion and related theft enforcement signal not active intrusion TTPs for current week operations. Void Blizzard TA488 activity this week showed a maturing infrastructure model GitHub commit search API polling for command and control AES CTR encrypted HTTPS with DNS tunneling fallback and dual persistence across browser localStorage and offline IndexedDB caches a notable evolution from the group earlier Zimbra focused campaign. CyberAv3ngers activity against water utilities relied on low sophistication default credential access rather than novel exploitation consistent with their prior Unitronics focused campaigns per CISA updated AA26 097A. ShinyHunters continued its pattern of converting a single cloud CRM compromise into a rolling multi victim extortion campaign adding three named companies to its leak site this week.

MITRE ATT&CK Themes T1190 Exploit Public Facing Application KEV cluster on LoadMaster Langflow TeamCity Tomcat Ncentral and related edge dev tools T1133 External Remote Services RMM and management plane abuse Ncentral Take Control patterns AnyDesk SimpleHelp ScreenConnect T1059 Command and Scripting Interpreter command injection and post exploit scripting across appliance and endpoint stages T1003.001 OS Credential Dumping LSASS Memory Storm1175 Mimikatz LSASS behavior per Microsoft T1486 Data Encrypted for Impact StormEncryptor ransomware deployment T1566 Phishing T1566.002 Spearphishing Link banking lures and broader social delivery vishing growth in CrowdStrike data supports voice led variants T1566.004 where applicable T1528 Steal Application Access Token device code OAuth grant abuse culminating in cloud session theft behavioral basis device authorization flow misuse described by CrowdStrike map refined with org specific IdP telemetry T1078 Valid Accounts post grant and post bypass operation under legitimate sessions and admin contexts Unitronics default credential access in the Minnesota water utility incident T1195 Supply Chain Compromise npm registry and dependency themes in hunting report retrospective Fastjson transitive risk T1048 T1567 Exfiltration Over Alternative Web Services Amgen cloud exfiltration outcome NetScaler memory theft seeking session cookies in Unit42 casework T1102 Web Service Telegram as operator channel for agentic tasking Unit42 T1027 living off the land patterns dual use RMM and scanners blending into admin noise T1505.003 Web Shell T1189 Drive by Compromise OWAReaper browser context execution triggered by opening a crafted email functioning as a client side persistence mechanism within OWA T1550.004 Web Session Cookie OWAReaper stated survival through credential resets implies session or token level persistence rather than credential dependent access T1071.001 Web Protocols GitHub API polling used as command and control channel by the OWA campaign

Threat Detection SIGMA StormEncryptor ransom note and extension

SIGMA Suspicious dual use RMM installation outside change window

YARA StormEncryptor sample family hash anchored plus note string

YARA Hermes DeepSeek agent workspace residue defensive hunting

SIEM logic Device code OAuth grant anomalies IdP agnostic pseudocode

SIEM logic Ncentral RMM admin takeover follow on

SIEM logic LoadMaster accessv2 pre auth exploitation attempts

SIGMA rule anomalous OWA session activity following message open behavioral based on OWAReaper reporting

YARA rule pseudocode for OWAReaper style browser context implant fragments conceptual based on public reporting no confirmed sample hash available

rule Suspected_OWAReaper_Fragment
{
    meta:
        description = "Detects Base64-fragmented JS assembly pattern reported in OWAReaper campaign"
        reference = "Proofpoint reporting, Aug 2026 - unconfirmed sample"
        confidence = "low - behavioral pattern only, no verified IOC hash"
    strings:
        $b64_fragment_marker = /[A-Za-z0-9+\/]

SIEM detection logic vendor agnostic pseudocode default credential access to ICS OT human machine interfaces