Cyware Daily Threat Intelligence - August 04, 2026
A single malicious script embedded in a trusted npm package can ripple through thousands of software projects, as seen in the recent supply-chain attack that compromised 868 packages and exposed secrets across the ecosystem. Cyware spotlights how attackers are leveraging open-source dependencies to harvest credentials and threaten downstream organizations at scale.
A critical flaw in SonicWall SMA1000 VPN gateways has become a fast lane for ransomware crews, with attackers exploiting CVE-2026-15409 weeks before patches landed. The result: business disruption and cross-border fallout as organizations scramble to update and defend their networks.
A Russian-speaking access broker has been exposed selling footholds in internet-facing appliances, blending commercial access-for-sale with espionage targeting Ukrainian defense and aerospace. With multiple CVEs exploited and entire Active Directory environments at risk, the campaign highlights the persistent threat to critical sectors worldwide.
Top Malware Reported in the Last 24 Hours
Shai-Hulud taints npm packages at scale
Shai-Hulud is a supply-chain attack that delivers credential-stealing malware through widely used npm packages. Shai-Hulud spreads by planting a malicious setup.mjs dropper, which downloads the Bun JavaScript runtime to execute Math_Symbol.js, the payload responsible for harvesting secrets. Shai-Hulud targets high-value credentials such as npm registry auth tokens, GitHub CLI tokens, AWS access keys, and HashiCorp Vault tokens. Shai-Hulud infects systems via compromised packages including keyv, cacheable, flat-cache, and file-entry-cache, as well as packages maintained by @deliveroo/reevent, @or-sdk/invitations, and @picsart/ai-sdk. Shai-Hulud targets organizations using npm-based build pipelines, putting downstream companies at risk even if they never directly install malware. Researchers report that as of August 4, 2026, at least 868 packages across 1381 versions have been compromised.
INC Ransomware exploits SonicWall SMA1000 flaws
INC Ransomware is a ransomware operation that leverages active exploitation of SonicWall SMA1000 gateway vulnerabilities to gain network access, steal data, and deploy ransomware. INC Ransomware chains remote code execution and privilege escalation flaws, with CVE-2026-15409 carrying a maximum CVSS score of 10.0. INC Ransomware exploits these flaws to turn perimeter devices into entry points, with attacks observed since June 22, 2026, before patches were available. INC Ransomware targets organizations using SMA1000 for VPN and load balancing, resulting in business disruption and exposure of sensitive data. CISA reported the campaign and urged immediate patching, network monitoring, and log review.
Interlock ransomware hits hospitals and schools
Interlock, tracked as GOLD EMBRACE, is a ransomware operation targeting critical infrastructure, healthcare, and education in North America and Europe. Interlock uses a double-extortion model, stealing data before encrypting systems. Interlock initiates attacks via drive-by compromise from compromised web properties and employs ClickFix-style social engineering, a custom RAT (NodeSnake), and PHP-based backdoors to maintain access. Interlock abuses legitimate tools such as Volatility3 to extract NTLM and LM hashes, facilitating lateral movement via RDP. Researchers linked Interlock activity to exploitation of CVE-2026-20131 in Cisco Secure Firewall Management Center Software. Victims face operational shutdown and the threat of public data leaks if ransom demands are not met.
Top Vulnerabilities Reported in Last 24 hours
CVE-2026-15409: SonicWall SMA1000 remote code execution (CVSS 10.0)
CVE-2026-15409 is a remote code execution vulnerability in SonicWall SMA1000 VPN gateways with a CVSS score of 10.0. Successful exploitation allows attackers to gain initial access and escalate privileges, leading to data theft and ransomware deployment. CVE-2026-15409 is actively exploited in the wild, with CISA reporting attacks since June 22, 2026. The INC Ransomware group leverages a Python script called KNUCKLEBALL to launch the Suo5 proxy and drop a custom Java web shell named ORANGETAIL, then pressures victims with negotiation emails and calls. Victims span Australia, the U.S., the U.A.E., Colombia, and Switzerland. A fix is available via updates released on July 14, 2026.
CVE-2026-18574: Check Point management remote code execution
CVE-2026-18574 is a critical remote code execution vulnerability in Check Point’s management layer. Successful exploitation allows attackers to bypass security policy controls and run code remotely, threatening centralized administration. No active exploitation has been reported. The issue is documented in Check Point’s bulletin sk185222 and referenced by CERT-FR. A fix is available for Multi-Domain Security Management and Security Management in R81.20 prior to Take 161, R82 prior to Take 122, and R82.10 prior to Take 40, with older versions also affected.
CVE-2026-62870: Microsoft Excel remote code execution
CVE-2026-62870 is a critical remote code execution vulnerability in Microsoft Excel. Exploitation allows an attacker to execute code on a user’s machine when a specially crafted spreadsheet is opened. No active exploitation is known, and Microsoft rated exploitation as “less likely.” An external researcher discovered and reported the issue to Microsoft. The patch applies to Microsoft Excel 2016, Microsoft Office LTSC 201 and 2024, Microsoft 365 Apps for Enterprise, and Microsoft Office 2019.
Top Threat Actors Reported in Last 24 hours
Russian-speaking access broker sells appliance footholds
A Russian-speaking initial access broker is a suspected operator blending commercial access-for-sale with espionage aligned with Russian state interests. The broker organizes open directories by vulnerability and uses masscan, httpx, and nuclei to scan and exploit internet-facing appliances. The broker exploits vulnerabilities including CVE-2025-25257, CVE-2022-40684, and CVE-2023-46747, then moves toward credential theft and full Active Directory compromise. The broker targets universities, government bodies, managed services providers, and IoT/surveillance operators. The campaign includes targeting Ukrainian defense and aerospace interests using Sliver C2, as reported by CloudSEK.
OctLurk-linked BINDCLOAK hits Middle East
OctLurk is a suspected threat group now linked to the modular backdoor BINDCLOAK. OctLurk uses shared infrastructure and code similarities to tie BINDCLOAK to its operations. OctLurk employs BINDCLOAK for post-compromise activity against government entities in the Middle East, expanding from earlier targeting in Central Asia and focusing on the energy sector. OctLurk’s BINDCLOAK uses evasion techniques to prevent detection of API calls from unbacked executable memory regions and generates unique host identifiers from victim hostnames and volume serial numbers. Zscaler reported that OctLurk’s BINDCLOAK supports core and plugin modules delivered from its C2, with command-and-control relying on encrypted, structured messages over TLS via TCP.
AI-fueled attackers shrink patching windows
Famous Chollima and Altered Spider are adversaries cited in a surge of AI-enabled cyber activity, with CrowdStrike reporting an 89% increase in AI-enabled adversary operations. These actors use AI to scale attacks and also target AI systems and APIs, including through “LLMjacking” and cost-harvesting schemes. Famous Chollima and Altered Spider exploit vulnerabilities rapidly, with 88% of exploitation occurring within 48 hours of public proof-of-concept code release. These actors target businesses running AI workloads, leading to increased exposure and costs when access is stolen and abuse is automated. CrowdStrike and The Register highlight the expanding vulnerability ecosystem, with 48,200 CVEs registered in 2025 and 43,000 more reported by mid-2026.
Frequently Asked Questions
What is Shai-Hulud? Shai-Hulud is a supply-chain attack that slipped credential-stealing malware into widely used npm packages, including keyv, cacheable, flat-cache, and file-entry-cache, putting software build pipelines in the blast radius. It spreads by planting a malicious setup.mjs dropper that pulls down the Bun JavaScript runtime to execute Math_Symbol.js, the payload responsible for harvesting secrets.
What is INC Ransomware? INC Ransomware is using active exploitation of SonicWall SMA1000 gateway vulnerabilities to break into networks, steal data, and then deploy ransomware, according to reporting citing CISA. The campaign chains two issues—remote code execution and privilege escalation—with CVE-2026-15409 carrying a maximum CVSS score of 10.0, underscoring how quickly a perimeter device can become an entry point.
What is Interlock? Interlock, a ransomware operation tracked as GOLD EMBRACE, is targeting critical infrastructure, healthcare, and education across North America and Europe with a double-extortion playbook that steals data before encrypting systems. It starts with a drive-by compromise from a compromised web property and uses ClickFix-style social engineering, alongside a custom RAT (NodeSnake) and PHP-based backdoors, to keep access and move through environments.
What is CVE-2026-15409? Ransomware operators are actively exploiting two critical flaws in SonicWall SMA1000 VPN gateways to break into networks, steal data, and deploy encryption, according to CISA; one of them is CVE-2026-15409 with a maximum CVSS score of 10.0. The attackers chain the issues to gain initial access and then escalate privileges, turning an internet-facing gateway into a direct path into corporate systems.
What is CVE-2026-18574? A critical flaw in Check Point’s management layer can let attackers run code remotely and bypass security policy controls, putting centralized administration at risk (CVE-2026-18574). In practical terms, compromising a management server can let an intruder change enforcement decisions or take control in ways that ripple across the environments it manages.
What is CVE-2026-62870? Microsoft issued an emergency fix for a critical Microsoft Excel vulnerability that can let an attacker execute code on a user’s machine simply by getting them to open a booby-trapped spreadsheet (CVE-2026-62870). The attack path is straightforward: a specially crafted Excel file triggers the bug when opened, potentially giving an attacker the same foothold as the logged-in user.
What is OctLurk? OctLurk is now being linked to a newly identified modular backdoor called BINDCLOAK, as researchers tie the malware to the group through shared infrastructure and code similarities. The campaign has focused on post-compromise activity against government entities in the Middle East, marking an expansion from the group’s earlier victimology in Central Asia, with particular attention on the energy sector.
What is Famous Chollima? Famous Chollima and Altered Spider are among the adversaries cited in a broader surge of AI-enabled cyber activity, as CrowdStrike reported an 89% increase in AI-enabled adversary operations. The Register’s coverage underscores the double-edged reality: AI is being used to scale attacks while AI systems and APIs are increasingly becoming targets themselves, including through “LLMjacking” and cost-harvesting schemes.