Cyware Daily Threat Intelligence - August 13, 2026
A single compromised software component can ripple through thousands of organizations, as seen in the recent LiteLLM supply-chain attack that exposed secrets from giants like AWS, Samsung, and Cisco. Cyware tracks how attackers leveraged a tainted vulnerability scanner to siphon off credentials, cloud keys, and cryptowallets—aggregating the stolen data into a 153 gigabyte archive and putting over 2,500 organizations at risk of follow-on breaches.
Attackers are slashing through virtualization defenses by exploiting CVE-2026-59310 in VMware vCenter, with breaches traced to 361 unique IP addresses across 47 countries. The flaw lets intruders seize control of core management servers, pivoting deeper into enterprise infrastructure and threatening uptime for organizations in Germany, the United States, and Turkey.
A fake donation app is turning personal devices into surveillance hubs as Armored Likho (also known as Eagle Werewolf) targets Russian individuals and organizations. The group’s toolkit steals Telegram sessions and records audio, putting sensitive business and private conversations at risk across major corporations, the public sector, and education.
Top Malware Reported in the Last 24 Hours
Eclipse Ransomware expands across hybrid networks
Eclipse Ransomware is a Ransomware-as-a-Service operation designed to target mixed enterprise estates, delivering payloads for Windows, Linux, NAS devices, VMware ESXi, and Nutanix. Eclipse Ransomware splits development across a dual codebase—Rust for Windows and C++ for other platforms—enabling movement across critical server and virtualization systems. Eclipse Ransomware uses ChaCha20 encryption and a Kyber-based key exchange, and includes features for lateral movement, defense evasion, and process termination to maximize impact. Eclipse Ransomware is distributed by affiliates recruited under the EclipseSupport brand, who pay a $300 entry fee and receive a 90/10 revenue split for the first 10 extortion cases (then 80/20). Eclipse Ransomware targets organizations running hybrid infrastructure, threatening operational disruption and data publication via leak sites. Affiliates are prohibited from submitting samples to VirusTotal or public multi-scanner portals.
SpyNote and WindRelay enable tap-to-pay fraud
SpyNote RAT is a remote access trojan used in a new Android campaign to facilitate tap-to-pay fraud. SpyNote RAT provides attackers with remote access after convincing victims, via phone calls posing as bank employees, to install the malware. SpyNote RAT is then used to deploy a second payload, WindRelay, which turns the device into a contactless card reader and captures real-time data exchanged between cards and readers. Attackers use a second device to replay captured information and conduct unauthorized transactions, manipulating victims into entering their PINs for approval. SpyNote RAT and WindRelay target Android users, resulting in direct financial loss through fraudulent payments that appear legitimate.
LiteLLM supply-chain attack leaks developer secrets
LiteLLM is a Python project that connects applications to over a hundred large language models and was compromised in a supply-chain attack affecting approximately 2,500 organizations worldwide. LiteLLM propagated the compromise after its development environment was breached, spreading malware through its ecosystem and exposing downstream users. Researchers attribute the initial intrusion to a vulnerability scanner, Trivy, infected with infostealer malware, resulting in theft of Git logins, CI/CD secrets, cryptowallets, and cloud credentials (AWS, GCP, Azure). Attackers aggregated the stolen data into a 153 gigabyte RAR file. Organizations impacted include AWS, Samsung, and Cisco, increasing the risk of further intrusions if exposed secrets are reused.
Top Vulnerabilities Reported in Last 24 hours
Hackers hit VMware vCenter via traversal (CVE-2026-59310)
CVE-2026-59310 is a critical authentication bypass vulnerability in VMware vCenter servers with a CVSS score not specified in the source. Successful exploitation allows attackers to execute arbitrary code without authentication, enabling full takeover of the vCenter environment and pivoting to managed infrastructure. CVE-2026-59310 is actively exploited in the wild, with suspected APT involvement and installation of a reverse SSH framework for persistent access. The campaign has been linked to 361 unique IP addresses across 47 countries, with most compromised systems in Germany, the United States, and Turkey.
SharePoint exploit chain enables server takeover (CVE-2026-55040, CVE-2026-63520)
CVE-2026-55040 is a critical authentication bypass vulnerability in Microsoft SharePoint, and when chained with CVE-2026-63520, it enables full remote takeover of vulnerable servers. Attackers can access and modify data, threatening control over collaboration content and workflows. Both vulnerabilities are actively exploited in the wild, with Rapid7 reporting the bugs to Microsoft and publishing a proof-of-concept exploit, followed by Defused confirming exploitation. Microsoft released security updates on July 14, and organizations are urged to patch immediately.
Cisco firewall VPN bug triggers outages (CVE-2026-20349)
CVE-2026-20349 is a high-severity denial-of-service vulnerability in Cisco Secure Firewall ASA and FTD Software. Unauthenticated remote attackers can crash devices by targeting exposed remote-access services, forcing reloads and causing widespread connectivity loss. CVE-2026-20349 is actively exploited in the wild, with Qualys detailing exploitation via crafted HTTP requests against the Remote Access SSL VPN service in certain VPN/ZTNA configurations. Cisco has released patches for affected trains, including ASA 9.16, 9.18, 9.20, 9.22, 9.23, 9.24 and FTD 7.0, 7.2, 7.4, 7.6, 7.7, 10.0.
Top Threat Actors Reported in Last 24 hours
Armored Likho spies via fake donation app
Armored Likho (also known as Eagle Werewolf) is a suspected Russia-based espionage group focused on intelligence collection. Armored Likho uses a Rust-based dropper to decrypt and launch payloads after victims interact with a fake donation app interface and enter a password. Armored Likho’s Still Toolkit steals Telegram session data and records audio using a covert surveillance component. Armored Likho targets private individuals and organizations across Russia, including major corporations, the public sector, IT, and education. The current campaign leverages a graphical interface to trick users and deploys both toolkit components, which communicate with command-and-control servers via gRPC and FlatBuffers. Kaspersky’s Securelist analysis attributes the campaign to Armored Likho and details the technical infrastructure.
Eclipse Ransomware courts affiliates for hybrid attacks
Eclipse Ransomware (operated under the EclipseSupport brand) is a suspected financially motivated group recruiting affiliates for hybrid ransomware attacks. Eclipse Ransomware offers a 90/10 revenue split for the first 10 extortion cases (then 80/20) and charges a $300 entry fee, refundable after the first payout. Eclipse Ransomware uses ChaCha20 encryption and a Kyber-based key exchange, focusing on speed and operational control across Windows, Linux, NAS, VMware ESXi, and Nutanix. Eclipse Ransomware targets organizations with mixed infrastructure, increasing the likelihood of simultaneous disruption to servers and virtualization layers. The affiliate program prohibits submission of samples to VirusTotal or public multi-scanner portals, aiming to evade detection. The campaign’s breadth and technical sophistication are detailed in recent reporting.
Helix claims Uber Freight data theft
Helix, tracked by Google as part of the UNC6671 collective, is a suspected cybercriminal group focused on data theft and extortion. Helix is known for social engineering tactics, including voice phishing, to gain access to sensitive information. Helix has claimed responsibility for a breach of Uber Freight, allegedly exfiltrating mailboxes, cloud storage drives, accounts payable, and dispatch documents. Helix targets logistics businesses, with exposure of billing and dispatch materials creating fraud risk and supply-chain impacts for customers and partners. The group reportedly extorted at least $10.6 million in ransom payments between January and May this year. Uber Freight has not confirmed communication with Helix or the authenticity of the stolen files, and operations remain unaffected according to the company.
Frequently Asked Questions
What is Eclipse Ransomware? Eclipse Ransomware is a Ransomware-as-a-Service operation built to hit mixed enterprise estates, with payloads for Windows, Linux, NAS devices, VMware ESXi, and Nutanix. It splits development across a dual codebase—Rust for the Windows payload and C++ for other platforms—so it can move across the systems companies rely on to run servers and virtual infrastructure.
What is SpyNote RAT? SpyNote RAT is being used in a new Android campaign where attackers start with phone calls posing as bank employees and claiming there is a problem with a victim’s payment card. After talking targets into installing it during the call, it gives the attacker remote access to the device and is then used to install a second payload, WindRelay.
What is LiteLLM? LiteLLM, a Python project used to connect applications to more than a hundred large language models, was hit by a supply-chain attack that affected about 2500 organizations worldwide. The incident hinged on LiteLLM’s role in propagating the compromise: once its development environment was breached, the malware spread through the software’s ecosystem and exposed downstream users.
What is CVE-2026-59310? A critical flaw in VMware vCenter servers (CVE-2026-59310) is being used to break into systems and execute arbitrary code without a login, turning a core piece of virtualization management into an easy entry point. In practice, that means attackers can take over the vCenter environment and use it to pivot toward the infrastructure it controls, with obvious consequences for uptime and data security.
What is CVE-2026-55040? A critical Microsoft SharePoint authentication bypass (CVE-2026-55040) is being exploited to access and modify data, and when paired with CVE-2026-63520 it can escalate into a full remote takeover of vulnerable servers. The immediate risk for organizations is loss of control over collaboration content and workflows, with attackers able to tamper with information people rely on for daily operations.
What is CVE-2026-20349? A high-severity denial-of-service flaw in Cisco Secure Firewall ASA and FTD Software (CVE-2026-20349) lets unauthenticated remote attackers crash devices by targeting exposed remote-access services, forcing reloads that can knock organizations offline. For networks relying on these devices for VPN access or perimeter enforcement, successful attacks can translate into widespread connectivity loss and disrupted business operations.
What is Armored Likho? Armored Likho (also known as Eagle Werewolf), a Russia-focused espionage group, is running a new campaign that turns a fake “donation” app into a stealthy surveillance tool. Active since May 2026, they use a Rust-based dropper that decrypts and launches payloads in the background after victims interact with a graphical interface designed to trick them into entering a password.
What is Helix? Helix, a hacking group Google tracks within the UNC6671 collective, has claimed a breach of Uber Freight that allegedly involved exfiltrating mailboxes, cloud storage drives, accounts payable, and dispatch documents. Uber Freight says it is investigating and that operations remain unaffected, but the episode highlights how data theft can still create downstream risk even when day-to-day service continues.