Cyware Daily Threat Intelligence - August 12, 2026
A single click on a trojanized PDF viewer can hand attackers SYSTEM-level control, as Lazarus Group leverages a Windows kernel zero-day to deploy the stealthy FudModule rootkit. Cyware tracks how this campaign blends SEO-optimized lures, DLL sideloading, and a downloader that abuses Microsoft Graph API, targeting defense and aerospace organizations across three continents. Microsoft’s August patch aims to close the door on this high-impact threat.
Critical infrastructure faces a double blow as Gunra ransomware exploits authentication bypass flaws in unpatched Fortinet devices. Attackers steal business documents, databases, and PII before encrypting systems, with AhnLab reporting victims in healthcare, finance, and utilities. The campaign’s stealth tactics—deleting logs and striking off-hours—make incident response a race against time.
A breach at Metabase exposes the downstream risk of unpatched cloud services, as ShinyHunters claims responsibility for a hack tied to an SQL injection flaw. Organizations relying on Metabase now face the prospect of sensitive datasets leaking beyond company boundaries, with Belgian authorities urging immediate updates.
Top Malware Reported in the Last 24 Hours
Lazarus/FudModule Rootkit
FudModule is a rootkit deployed by Lazarus Group to provide SYSTEM-level control and evade EDR tools. FudModule hides malicious activity, disables security features, and blends command-and-control traffic into hijacked webmail and CMS infrastructure. FudModule is delivered via DLL sideloading from an encrypted ZIP bundle and a trojanized PDF viewer called SecurityPDF, distributed through SEO-optimized websites. FudModule targets defense, aerospace, and aviation organizations in Europe, India, and Brazil. Microsoft has released a patch to address this threat.
Gunra Ransomware
Gunra is a ransomware strain exploiting authentication bypass flaws in Fortinet devices as part of Operation Double Barrel. Gunra steals business-critical documents, databases, PII, and internal email before encrypting systems. Gunra deletes logs and conducts reconnaissance during off-hours to impair incident response. Gunra is delivered by exploiting CVE-2025-24472 and CVE-2024-55591 in FortiOS 7.0.0–7.0.16, FortiProxy 7.0.0–7.0.19, and 7.2.0–7.2.12. Gunra targets healthcare, financial services, critical manufacturing, transportation, government services, utilities, and retail sectors globally. Patches are available for affected Fortinet products.
GhostDesk Chrome Spyware
GhostDesk is a malicious Chrome extension installed by a counterfeit CCleaner installer to steal cookies, capture screenshots, execute arbitrary JavaScript, and monitor clipboard cryptocurrency addresses. GhostDesk modifies Chrome’s Security Extension by adding background.js and content.js, and communicates with command-and-control servers at 193[.]169[.]240[.]81 and liderongrade[.]duckdns[.]org. GhostDesk is delivered via a multi-stage script chain using dropped cscript.exe and repeatable file names like svc_it7p and rt_mxk.exe. GhostDesk targets Windows users, while related threats WindRelay and CNCMachineRMS target Android and enterprise environments. No fix status was stated.
Top Vulnerabilities Reported in Last 24 hours
CVE-2026-68820: Windows Kernel Zero-Day
CVE-2026-68820 is a privilege escalation vulnerability in the Windows kernel (AFD.sys) exploited by Lazarus Group (CVSS v3.1: 7.0). Successful exploitation enables SYSTEM-level privileges, allowing attackers to disable security features and tamper with processes. CVE-2026-68820 is actively exploited in the wild. Check Point attributed the activity to Operation Dream Job, with targets in defense, aerospace, and aviation across Europe, India, and Brazil. Microsoft released a fix in the August Patch Tuesday update.
CVE-2026-59310: VMware vCenter Directory Traversal
CVE-2026-59310 is a directory traversal vulnerability in VMware vCenter (CVSS not stated) that allows attackers to execute arbitrary code and establish persistent remote access. Exploitation can result in long-lived backdoors on core virtualization infrastructure. CVE-2026-59310 is already exploited in the wild, with 361 unique victim IPs across 47 countries, including Germany, the U.S., Turkey, Iran, and France. Researchers observed initial exploitation five days after public disclosure. Broadcom has released a patch.
CVE-2026-63520 & CVE-2026-55040: Microsoft SharePoint RCE Chain
CVE-2026-63520 is a remote code execution vulnerability in Microsoft SharePoint, chained with CVE-2026-55040 (CVSS v3.1: 9.1), enabling unauthenticated attackers to run arbitrary code under the SharePoint site service account. Successful exploitation can lead to stolen data, tampered content, or a network intrusion beachhead. No active exploitation has been observed. Rapid7 Labs discovered the flaws during Pwn2Own Berlin and coordinated disclosure with Microsoft. Fixes are available in Microsoft’s August 2026 patches, affecting organizations using SharePoint for internal collaboration.
Top Threat Actors Reported in Last 24 hours
Lazarus Group (Operation Dream Job)
Lazarus Group (also tracked as a North Korea-linked hacking operation) is a suspected state-sponsored actor focused on cyber-espionage and financial gain. Lazarus Group exploits a Windows zero-day (CVE-2026-68820, CVSS v3.1: 7.0) in the Windows Ancillary Function Driver for WinSock to achieve SYSTEM-level code execution. Lazarus Group uses recruiter lures, impersonation websites, and SEO techniques to distribute trojanized apps. Lazarus Group targets defense-adjacent technology makers, surveillance sensors, drones, and robotics in France, Germany, Brazil, and India. The group’s Operation Dream Job campaign leverages phishing and SEO-optimized lures for initial access. Check Point reported the bug, and US federal agencies were given a two-week deadline to patch; Lazarus Group’s history includes the Sony Pictures hack and WannaCry outbreak.
Gunra Ransomware Group
Gunra (potentially linked to North Korea and the Lazarus ecosystem) is a ransomware group motivated by financial gain. Gunra exploits authentication-bypass flaws in FortiOS 7.0.0–7.0.16, FortiProxy 7.0.0–7.0.19, and 7.2.0–7.2.12 to steal data and encrypt systems. Gunra deletes logs and conducts off-hours reconnaissance to hinder incident response. Gunra targets utilities, transportation, healthcare, financial services, critical manufacturing, government services, and retail sectors globally. The group’s Operation Double Barrel campaign leverages CVE-2024-55591 (CVSS v3.1: 9.8) for super-admin takeover risk. Mitigation guidance includes blocking UDP port 69 for related Fortinet issues.
ShinyHunters
ShinyHunters is a cybercriminal group suspected to operate for financial gain. ShinyHunters claims responsibility for a breach at Metabase, exploiting an unpatched SQL injection vulnerability in its cloud service. ShinyHunters leverages SQL injection to access and exfiltrate sensitive datasets from companies using Metabase. ShinyHunters targets organizations relying on Metabase for internal and customer data analysis. The campaign resulted in a breach disclosure and a call from the Belgian Centre for Cybersecurity to update affected systems. The group’s previous attacks include incidents at Odido, Canvas, and Exact Sciences.
Frequently Asked Questions
What is Lazarus Group? Lazarus Group is actively exploiting the Windows kernel zero-day CVE-2026-68820 to install the FudModule rootkit, giving attackers SYSTEM-level control that can hide activity from many EDR tools. It delivers the payload through two parallel infection chains: DLL sideloading from an encrypted ZIP bundle and a trojanized PDF viewer called SecurityPDF that impersonates a legitimate firm.
What is Gunra? Gunra ransomware operators are exploiting authentication bypass flaws in Fortinet devices as part of “Operation Double Barrel,” a campaign AhnLab says is hitting critical infrastructure globally. The group targets FortiOS 7.0.0 through 7.0.16, FortiProxy 7.0.0 through 7.0.19, and FortiProxy 7.2.0 through 7.2.12, abusing CVE-2025-24472 and CVE-2024-55591 to gain high-level access before encrypting systems.
What is GhostDesk? GhostDesk is a malicious Chrome extension deployed by a counterfeit CCleaner installer, using the familiarity of a popular utility to trick Windows users into installing spyware. The installer has been observed using repeatable file naming like svc_it7p and rt_mxk.exe, then running a multi-stage script chain via a dropped cscript.exe to recon the system and modify Chrome’s Security Extension by adding background.js and content.js.
What is CVE-2026-68820? North Korea’s Lazarus Group is exploiting a Windows kernel zero-day in AFD.sys to reach SYSTEM-level privileges and install the stealthy FudModule rootkit (CVE-2026-68820). Once attackers land on a machine, the privilege boost helps them disable security features, tamper with processes, and stay hidden from many EDR tools, turning a single foothold into deep, durable control.
What is CVE-2026-59310? A critical directory-traversal bug in VMware vCenter (CVE-2026-59310) is being abused to run attacker-chosen code and establish persistent remote access on compromised appliances. In plain terms, the flaw can let an intruder break out of intended file paths and pivot into actions that leave a long-lived backdoor on a core piece of virtualization infrastructure.
What is CVE-2026-63520? Rapid7 Labs disclosed a Microsoft SharePoint exploit chain that can lead to unauthenticated remote code execution, allowing attackers to run arbitrary code under the SharePoint site service account (CVE-2026-63520 with CVE-2026-55040). For organizations relying on SharePoint for internal portals and collaboration, that can translate into stolen data, tampered content, or a beachhead for wider network intrusion without an attacker needing to sign in first.
What is Lazarus Group? Lazarus Group (also tracked as a North Korea-linked hacking operation) is actively exploiting a Windows zero-day in Microsoft’s WinSock stack as part of its long-running Operation Dream Job activity. The flaw, CVE-2026-68820 (CVSS v3.1: 7.0), is a use-after-free bug in the Windows Ancillary Function Driver for WinSock that can enable SYSTEM-level code execution after the group gains an initial foothold via phishing.
What is Gunra? Gunra, a ransomware group described as potentially linked to North Korea and the Lazarus ecosystem, is breaking into unpatched Fortinet devices in a campaign AhnLab dubbed Operation Double Barrel. They exploit authentication-bypass issues affecting FortiOS 7.0.0–7.0.16 and FortiProxy 7.0.0–7.0.19 and 7.2.0–7.2.12, then steal data before encrypting systems—pulling business documents, databases, PII, and internal email that can ripple into customer harm and operational disruption.
What is ShinyHunters? ShinyHunters, a cybercriminal group known for past attacks on Odido, Canvas, and Exact Sciences, has claimed responsibility for a hack affecting Metabase, a data and intelligence database provider. Metabase disclosed a breach tied to an unpatched vulnerability in its cloud service, and the incident is expected to expose personal data from companies using the platform.