Cyware Daily Threat Intelligence - August 18, 2026
Attackers are turning trusted cloud services into covert command centers, as seen in recent campaigns tracked by cyware.com. One Python-based framework now leverages Microsoft 365 and Teams infrastructure to blend malicious traffic with legitimate business activity, making detection a challenge for defenders. In July, researchers observed this technique in active use, highlighting the evolving risk to organizations relying on cloud collaboration tools.
Critical vulnerabilities are being exploited in the wild, with attackers targeting both open-source and commercial platforms. CVE-2025-62593 in Ray-Project Ray and CVE-2026-65400 in macOS have prompted urgent advisories, while Citrix NetScaler’s RCE flaw exposes edge devices to root-level compromise. Security teams must act quickly, as fixes and mitigation guidance are now available for affected systems.
Human-driven attacks remain a persistent threat, with groups like BlackFile using voice phishing to breach high-profile enterprises. Extortion demands often start at $3 million, but can be negotiated down to less than $1 million, impacting over two dozen organizations since January. These campaigns show how a single call can escalate into weeks of disruption and high-stakes negotiations.
Top Malware Reported in the Last 24 Hours
TWINLOOT hides C2 in Microsoft cloud
TWINLOOT is a newly discovered Python malware framework that uses Microsoft cloud services as its command-and-control channel. TWINLOOT leverages SharePoint Online to poll for commands and exfiltrate data, and relies on Microsoft Teams’ TURN infrastructure for interactive communications. TWINLOOT launches Microsoft Edge in headless mode so Graph API requests appear to originate from a legitimate Edge process, and captures and encrypts password attempts to support lateral movement. TWINLOOT persists by creating a mandatory-profile hive without admin rights. The campaign was identified in July during active use.
Shadow hVNC kit enables invisible takeovers
Shadow hVNC is a newly advertised malware-as-a-service kit that enables attackers to operate on a Windows machine without visible activity on the victim’s screen. Shadow hVNC creates a hidden virtual desktop (marketed as RemoteXHidden) and allows operators to run tools like Chrome, PowerShell, and command shells in that concealed environment. Shadow hVNC exploits the Windows environment using the Chrome DevTools Protocol to inject cookies and inherit live browser sessions, enabling immediate account access. Shadow hVNC targets Chromium and Gecko browser data, Windows Vault entries, Telegram sessions, Discord tokens, crypto-wallet artifacts, VPN configurations, and password-manager data. Marketed by a user known as “RemoteX” in March 2026, Shadow hVNC achieves persistence through scheduled tasks and firewall rules.
Blockchain DDRs and Octagon complicate takedowns
Blockchain dead drop resolvers (DDRs) are being used by multiple malware families to store and retrieve command-and-control pointers via public blockchains, making disruption more difficult due to decentralized infrastructure. Blockchain DDRs have been adopted by malware families including TroyDen, DeadLock, CLEARSHORT, and JADESNOW, which use Ethereum, Solana, and TON to update C2 information dynamically. The August 2026 ChainDrop attack compromised over 440 npm packages using Ethereum contracts. In parallel, Octagon is an Android malware-as-a-service platform targeting cryptocurrency wallets and banking apps, advertised on a Russian-language cybercrime forum and using Bahrain Civil Defense lures. Octagon abuses Android Accessibility Services to capture unlock patterns, passwords, and PINs, and uses hidden VNC-style control and credential-stealing overlays to take actions on the victim’s device. Victims face covert account and fund compromise while traffic blends into normal blockchain or mobile activity.
Top Vulnerabilities Reported in Last 24 hours
CISA flags exploited Ray code injection (CVE-2025-62593)
CVE-2025-62593 is a code injection vulnerability in Ray-Project Ray with a CVSS score not specified in the alert. Successful exploitation allows a malicious actor to gain unauthorized access and control of affected systems. CVE-2025-62593 is already being actively exploited in the wild. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog after confirming exploitation. The advisory highlights exposure across government, defense, and technology organizations, with BOD 26-04 framing the issue as a priority risk for U.S. federal agencies.
Apple fixes exploited macOS vulnerability (CVE-2026-65400)
CVE-2026-65400 is a vulnerability in macOS Tahoe, Sequoia, and Sonoma with a CVSS score not disclosed. Exploitation of CVE-2026-65400 could enable unauthorized access or control over affected Macs, risking sensitive data and system integrity. Attackers are already exploiting this vulnerability in the wild. Apple’s security advisories are the primary source for details and mitigation. A fix is available in macOS Tahoe 26.6.1, Sequoia 15.7.9, and Sonoma 14.8.9.
NetScaler RCE reports tied to SAML setups (CVE-2026-8452)
CVE-2026-8452 is a critical remote code execution vulnerability in Citrix NetScaler ADC and Gateway. Successful exploitation allows an unauthenticated attacker to run code on a vulnerable system, potentially leading to root-level execution and webshell installation. Initial signs of exploitation have been reported. The issue has been demonstrated by watchTowr, with exploitation signals also cited by Defused and researcher Kevin Beaumont. A fix may be available from Citrix, and the advisory recommends ensuring NetScaler systems are not unnecessarily configured as a SAML Identity Provider (IdP) unless required, as this setup is a limiting factor for attacks.
Top Threat Actors Reported in Last 24 hours
Cavern Manticore hides C2 in Microsoft 365
Cavern Manticore (also associated with OilRig) is an Iran-linked hacking group with a suspected espionage motive. Cavern Manticore uses its Cavern command-and-control framework to exploit Microsoft 365 calendars as a covert channel, employing the HOLLOWGRAPH module to pass instructions and move stolen files via the Microsoft Graph API. Cavern Manticore can switch between direct HTTPS and Google Apps Script relays based on DNS A-record responses, complicating detection. Cavern Manticore targets organizations reliant on Microsoft 365 collaboration tools. The group’s recent campaign leverages routine calendar activity to mask data theft and ongoing access. Check Point Research has documented Cavern Manticore’s evolving tactics and network evasion techniques.
Kimsuky boosts phishing with local AI
Kimsuky is a North Korea-linked espionage group with a suspected focus on intelligence collection. Kimsuky incorporates a local AI toolkit into spear-phishing campaigns tracked as Operation GitPower, using email lures themed around government, research, and financial documents. Kimsuky relies on GitHub-hosted infrastructure and disguises activity with encrypted payloads masquerading as images. Kimsuky employs evasion through Base64 encoding and custom obfuscation routines. The group targets organizations in government and research sectors. Researchers report Kimsuky is building an internal AI environment with tools like Ollama, GPT4All, and Msty to accelerate malware and phishing content development.
BlackFile vishes executives for million-dollar extortion
BlackFile is a cybercrime group with a suspected financial motive. BlackFile uses voice phishing and social engineering tactics, sometimes recruiting lower-level operators to place calls and advance intrusions. BlackFile targets high-profile enterprises including Blackstone, Bain Capital, Moody’s, CME, and Apollo, as well as organizations in healthcare, technology, transportation, logistics, wholesale, retail, and hospitality. BlackFile’s recent campaign involves breaching enterprises and pressuring them into extortion payments. Mandiant reports incident responders have engaged with over two dozen organizations compromised by BlackFile since January, with extortion demands starting at $3 million but often negotiated down to less than $1 million.
Frequently Asked Questions
What is TWINLOOT? TWINLOOT is a newly discovered Python malware framework that turns trusted Microsoft cloud services into its command-and-control channel, making malicious traffic look routine. It uses SharePoint Online to poll for commands and exfiltrate data, and it relies on Microsoft Teams’ TURN infrastructure to enable interactive communications.
What is Shadow hVNC? Shadow hVNC is a newly advertised malware-as-a-service kit that gives attackers a way to operate on a Windows machine without showing activity on the victim’s visible screen. It creates a hidden virtual desktop (marketed as RemoteXHidden) and lets operators run tools like Chrome, PowerShell, and command shells inside that concealed environment.
What is Blockchain dead drop resolvers (DDRs)? Blockchain dead drop resolvers (DDRs) are emerging as a way for multiple malware families to store and retrieve command-and-control pointers using public blockchains, making disruption harder because the infrastructure is decentralized. Recent campaigns cited malware families including TroyDen, DeadLock, CLEARSHORT, and JADESNOW using platforms such as Ethereum, Solana, and TON to update C2 information dynamically, and the August 2026 ChainDrop attack compromised over 440 npm packages using Ethereum contracts.
What is CVE-2025-62593? A code injection flaw in Ray-Project Ray (CVE-2025-62593) has been added to CISA’s Known Exploited Vulnerabilities catalog after evidence showed attackers are actively exploiting it. In practical terms, successful exploitation can give a malicious actor unauthorized access and control of affected systems, raising the stakes for environments that rely on Ray for compute workloads.
What is CVE-2026-65400? Apple has shipped security updates for a macOS vulnerability now tracked as CVE-2026-65400, warning that it is being exploited in the wild across macOS Tahoe, Sequoia, and Sonoma. While Apple has not disclosed the specific bug type, the advisory says exploitation could enable unauthorized access or control over affected Macs, putting sensitive data and system integrity at risk.
What is CVE-2026-8452? A critical remote code execution flaw in Citrix NetScaler ADC and Gateway (CVE-2026-8452) could let an unauthenticated attacker run code on a vulnerable system, a fast path to data exposure and follow-on intrusion in organizations that use NetScaler for traffic distribution and remote access. Reporting says exploitation can lead to root-level execution and webshell installation, turning an edge device into a foothold inside the network.
What is Cavern Manticore? Cavern Manticore, an Iran-linked hacking group (also associated with OilRig), is pushing its Cavern command-and-control framework deeper into everyday cloud services by using Microsoft 365 calendars as a covert channel. They do this with a module dubbed HOLLOWGRAPH, which uses the Microsoft Graph API to pass instructions and move stolen files through seemingly normal calendar activity.
What is Kimsuky? Kimsuky, a North Korea-linked espionage group, is folding a local AI toolkit into a long-running spear-phishing playbook in a campaign tracked as Operation GitPower. They use email lures themed around government correspondence, research materials, and financial documents, and pair them with AI-generated decoy content to make the outreach more convincing.
What is BlackFile? BlackFile, a cybercrime group, is leaning on old-fashioned human manipulation to breach large enterprises and pressure them into paying. They use voice phishing and other social engineering tactics, sometimes recruiting lower-level operators to place calls and help move intrusions forward.