Cyware Daily Threat Intelligence - August 19, 2026
Attackers are scaling up ransomware and data theft operations, with over 500 organizations—including healthcare providers—now impacted by disruptive campaigns that combine extortion, encryption, and the threat of public data leaks. Cyware tracks how these groups exploit both technical vulnerabilities and social engineering to maximize pressure on victims and extract payments.
Zero-day exploits are slashing through network defenses, as attackers leverage fresh flaws in SonicWall, Microsoft, VMware, and Apple products to seize root or SYSTEM-level access. With multiple CVEs under active attack and patches rolling out across platforms, organizations face a race to update before attackers can pivot to broader compromise.
Espionage and cybercrime groups are turning to AI-assisted malware and mass website compromise to breach government and enterprise targets. Recent campaigns have swept through Central Asia and abused thousands of outdated WordPress sites, exposing sensitive data and operational secrets to persistent, multi-tool intrusions.
Top Malware Reported in the Last 24 Hours
Medusa ransomware scales to 500 victims
Medusa ransomware is a file-encrypting malware targeting organizations in vital sectors, with a particular focus on healthcare. Medusa steals data before encrypting systems and employs extortion tactics, including threats to leak or sell stolen data, offering a “discount” for fast payment, and charging $10,000 to extend payment deadlines. Medusa leverages legitimate remote access tools such as AnyDesk and Atera to maintain persistence and evade detection by blending in with normal IT activity. Medusa exploits vulnerabilities in Fortra GoAnywhere, BeyondTrust, Fortinet EMS, and ScreenConnect, and also uses phishing to steal credentials for initial access. Medusa targets healthcare and other critical infrastructure sectors, impacting over 500 organizations, as reported in the latest FBI alert.
PhantomStealer hides in quote-review phish
PhantomStealer is an infostealer malware distributed via phishing emails disguised as quote-review requests. PhantomStealer elevates privileges using UAC bypass techniques, including SSPI-based and CMSTPLUA COM-based methods, and falls back to ShellExecuteExW with the “runas” verb if initial attempts fail. PhantomStealer performs a BYOVD attack by creating and registering a kernel driver service, then terminates defensive processes such as SecurityHealthService.Exe. According to AhnLab, PhantomStealer injects into AddInProcess32.Exe to steal keystrokes, screenshots, stored account data, and clipboard history, and targets browsers, applications, and cryptocurrency wallets to swap wallet addresses. PhantomStealer is delivered through phishing attachments, with recommended actions including blocking mail[.]mnt[.]com and phan[@]trimnt[.]com, monitoring for unauthorized kernel drivers, and user education.
StopAndProtect turns WordPress into malware hubs
StopAndProtect is a malware operation that combines data theft with file encryption, leveraging thousands of compromised WordPress sites for distribution and management. StopAndProtect uses the ClickFix social-engineering technique to lure victims into executing PowerShell, which initiates multiple .NET stages and delivers ransomware and worms. StopAndProtect relies on PHP scripts for file management and a backdoor installer to maintain persistence on compromised infrastructure. StopAndProtect targets outdated WordPress installations and plugins, affecting a broad range of organizations and individuals. Check Point researchers uncovered internal logs and source code due to operational security mistakes by the operators.
Top Vulnerabilities Reported in Last 24 hours
CVE-2026-15409 and CVE-2026-15410: Zero-day flaws in SonicWall SMA 1000 (CVSS not specified)
CVE-2026-15409 and CVE-2026-15410 are zero-day vulnerabilities in SonicWall SMA 1000 series appliances that allow unauthenticated attackers to gain root access. Successful exploitation enables attackers to steal session tokens and MFA seed data, providing persistent access to corporate networks. Attackers are actively exploiting these flaws in the wild, with activity attributed to the INC ransomware group and initial access brokers. The campaign has impacted telecommunications, manufacturing, professional services, and public sector organizations. A fix is available in SonicWall SMA 1000 firmware 12.4.3-03453 or 12.5.0-02835, with guidance to regenerate MFA TOTP seeds and rotate administrator credentials.
CVE-2025-60710: Windows Task Host privilege escalation (CVSS not specified)
CVE-2025-60710 is a privilege-escalation vulnerability in Windows Task Host that allows attackers to achieve SYSTEM-level control. Exploitation enables attackers to disable security tools, extract credentials, establish persistence, and deploy ransomware across networks, resulting in encrypted file shares and operational shutdowns. Attackers are already exploiting this vulnerability in the wild, with activity attributed to ransomware groups. The flaw was discovered in the Windows AI Recall scheduled task, and a patch is available from Microsoft as of November 11, 2025. Organizations are advised to monitor for exploitation attempts and ensure security tools are updated.
CISA flags exploited bugs across major platforms
CVE-2026-33824, CVE-2026-55040, CVE-2026-59310, and CVE-2026-65400 are actively exploited vulnerabilities affecting Microsoft, VMware, and Apple products, enabling remote code execution, authentication bypass, or full device takeover. Successful exploitation can result in unauthorized system control and deployment of cryptocurrency miners, with one macOS exploit achieving root access before dropping a Monero miner. Attackers are exploiting these flaws in the wild, including a Chinese-speaking threat actor targeting the Microsoft Windows IKE Service Extension bug and activity following a SharePoint proof-of-concept release. The VMware vCenter flaw has been used to execute code and deploy an SSH reverse shell framework. Separately, Australian authorities warn that N-able N-central RMM servers are under attack via CVE-2026-18577 and CVE-2026-18556, enabling unauthorized admin access. Fixes are available, including Microsoft patches from April 2026 and July 2026, VMware’s update from July 29, 2026, Apple’s update from August 6, 2026, and N-able’s security updates for N-central.
Top Threat Actors Reported in Last 24 hours
SilkParasite targets Central Asian governments
SilkParasite (linked to UAC-0063 and FamousSparrow) is a suspected China-based espionage operation focused on intelligence collection. SilkParasite uses AI-assisted malware development and a multi-tool intrusion set to breach government networks in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, and Kazakhstan. SilkParasite delivers booby-trapped Office files via phishing documents that impersonate government business, and employs multiple malware families, including previously unknown ones, to maintain access and exfiltrate data. SilkParasite targets state entities and public agencies in Central Asia, raising the risk of silent intelligence loss and long-term operational impact. Researchers attribute the campaign to sustained collection priorities in the region, with operational choices that trade polish for deniability.
Medusa ransomware expands beyond 500 victims
Medusa is a financially motivated ransomware group suspected to operate globally. Medusa exploits known vulnerabilities in Fortra GoAnywhere, BeyondTrust, Fortinet EMS, and ScreenConnect, and uses phishing to steal credentials before escalating access. Medusa relies on legitimate remote access tools such as AnyDesk, Atera, ConnectWise, eHorus, N-able, BeyondTrust, SimpleHelp, and Splashtop to blend in and maintain persistence. Medusa targets healthcare and other vital services, resulting in stolen data leveraged for extortion and encryption that disrupts operations. The FBI/CISA/HHS advisory reports that Medusa has impacted over 500 organizations, with payment demands that include added fees for deadline extensions and discounts for fast payment.
StopAndProtect abuses hacked WordPress sites
StopAndProtect is a criminal operation suspected to be financially motivated, pairing data theft with file encryption. StopAndProtect compromises thousands of outdated WordPress sites to distribute malware and manage infected machines, using ClickFix-style social engineering to trigger PowerShell execution and .NET-based payload delivery. StopAndProtect employs PHP scripts for file management and backdoor installers to maintain access and control over stolen data. StopAndProtect targets organizations and individuals globally, with most affected IPs in the US, Russia, and India. Check Point researchers observed operational security failures that exposed internal logs and source code after the operator reportedly infected themselves.
Frequently Asked Questions
What is Medusa? Medusa ransomware has now hit more than 500 organizations in “vital” sectors, with a heavy focus on healthcare, prompting an updated FBI warning about how the group breaks in and pressures victims. It steals data before encrypting systems, then uses extortion tactics that include threatening to leak or sell the data, offering a “discount” for fast payment, and charging $10,000 to extend the deadline by a day.
What is PhantomStealer? PhantomStealer is being distributed through phishing emails disguised as quote-review requests, tricking recipients into opening an attachment that launches an injector-style payload. Once running, it pushes for higher privileges using UAC bypass techniques (including SSPI-based and CMSTPLUA COM-based methods), and if those fail it falls back to invoking elevation via ShellExecuteExW with the “runas” verb.
What is StopAndProtect? StopAndProtect is an operation that combines data theft with file encryption, and it has used thousands of compromised WordPress sites to distribute malware, manage infected machines, and even store stolen information. Check Point says operational security mistakes exposed internal logs and source code, offering a rare view into how the campaign runs and how broad it has become.
What is CVE-2026-15409? Two zero-day flaws in SonicWall SMA 1000 series appliances (CVE-2026-15409 and CVE-2026-15410) are being used to gain root access to affected gateways without authentication, giving attackers a direct on-ramp into corporate networks. The reported attack chain combines a server-side request forgery issue in the /wsproxy component with a path traversal weakness in the remove_hotfix workflow, allowing access and persistence by stealing session tokens and MFA seed data.
What is CVE-2025-60710? A Windows Task Host privilege-escalation bug (CVE-2025-60710) is being exploited to turn a foothold into SYSTEM-level control, a fast path to domain-wide ransomware incidents. By abusing a link-following weakness tied to the Windows AI Recall scheduled task, attackers can redirect file operations and effectively operate with the highest local privileges.
What is CVE-2026-33824? CISA is urging immediate patching for four actively exploited vulnerabilities across Microsoft, VMware, and Apple products—issues that can enable remote code execution, authentication bypass, or full device takeover (CVE-2026-33824, CVE-2026-55040, CVE-2026-59310, CVE-2026-65400). Reported outcomes include unauthorized control of systems and follow-on payloads such as cryptocurrency miners, with one macOS exploit described as achieving root access before dropping a Monero miner.
What is SilkParasite? SilkParasite, a China-linked espionage campaign, is using AI-assisted malware development to power a multi-tool intrusion set aimed at government networks in Central Asia. They have targeted state entities in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, and Kazakhstan, using phishing documents that impersonate government business to deliver booby-trapped Office files.
What is Medusa? Medusa, a financially motivated ransomware operation, has grown to impact over 500 organizations as US agencies updated their warning on how the group breaks in and extorts victims. They exploit known weaknesses in Fortra GoAnywhere, BeyondTrust, Fortinet EMS, and ScreenConnect, and also use phishing to steal credentials before moving deeper into environments.
What is StopAndProtect? StopAndProtect is a criminal operation that pairs data theft with file encryption, scaling distribution by compromising thousands of outdated WordPress sites. They push victims into running a ClickFix-style social-engineering flow that leads to PowerShell execution, then chain through multiple .NET stages that download and run additional components.