Attackers are turning trusted tools against defenders, as seen in the latest GodDamn ransomware campaign where a Microsoft-signed driver disables endpoint protections before encryption strikes. Cyware spotlights how a single lapse—like unattended remote access—can cascade into days of undetected staging, culminating in a company’s name becoming the extension on every encrypted file.

Meanwhile, a critical zero-day in Windows Defender (CVE-2026-50656) lets attackers seize full SYSTEM control, with a proof-of-concept exploit already circulating ahead of Microsoft’s patch. On the Linux front, a CVSS 9.8 flaw in HP’s print software exposes enterprise print servers to remote code execution, leaving organizations scrambling for compensating controls as patches lag behind.

Threat actors are also innovating in stealth, with APT-C-20 (Fancy Bear) embedding remote-control Trojans inside images and leveraging fileless techniques to quietly infiltrate defense ministries. As extortion crews like Helix bypass MFA to siphon SharePoint data, today’s threat landscape demands vigilance at every layer—from endpoint to cloud.

Top Malware Reported in the Last 24 Hours

GodDamn ransomware disables defenses with PoisonX

GodDamn ransomware is a data-encrypting threat tied to the Hyadina group, notable for using a Microsoft-signed malicious driver called PoisonX to disable endpoint defenses before launching encryption. GodDamn leverages AnyDesk for remote access, stages activity over several days, and then executes encryption, renaming files with the victim organization’s name as the extension. GodDamn moves laterally using PsExec and mounts administrative shares with stolen credentials, while a toolkit including Mimikatz and multiple NirSoft utilities expands access. GodDamn infects systems via unattended remote access and exploits downtime for staging. GodDamn targets enterprise Windows environments, with observed attacks beginning May 29, 2026 and encryption triggered on June 3, 2026. Researchers highlight the operational disruption and compressed response window for affected organizations.

Everest ransomware hides behind heavy obfuscation

Everest ransomware is a heavily obfuscated .NET-based payload designed to hinder defenders and destroy recovery options. Everest deletes backup files, volume shadow copies, and system restore points, and alters system and network settings to weaken protections. Everest employs anti-reverse engineering tactics, including the Windows Restart Manager and an anti-Raccine routine to disable security tools. Everest applies a DACL-based self-protection mechanism, making process termination difficult. Everest infects Windows systems and disrupts environments by encrypting files, but no data exfiltration routines were found according to the report.

APT-C-20 hides trojan inside images

APT-C-20 (also known as Fancy Bear) is conducting a fileless-style campaign using weaponized Office documents and image steganography to deliver a remote-control Trojan. APT-C-20 initiates attacks with a malicious macro in readme.docm that drops a DLL and a PNG, then establishes persistence by registering a hijacked CLSID at HKEY_CURRENT_USER\Software\Classes\CLSID{68DDBB56-9D1D-4FD9-89C5-C0DA2A625392}\InProcServer32. APT-C-20 derives an AES-256 key using PBKDF2, decrypts a payload hidden in the PNG via LSB steganography, and uses reflective loading to execute a C# Trojan in memory. APT-C-20 blends command-and-control traffic with legitimate cloud storage API calls to evade detection. The campaign targets defense ministries, where a single document open can result in covert remote control over sensitive systems. Researchers attribute the campaign to APT-C-20 based on observed TTPs.

Top Vulnerabilities Reported in Last 24 hours

CVE-2026-50656: Defender zero-day grants SYSTEM control

CVE-2026-50656 is a privilege escalation vulnerability in Microsoft Defender with a CVSS score of N/A. Successful exploitation allows an attacker to escalate from a standard user to full SYSTEM control, enabling command execution, disabling protections, and full takeover. A proof-of-concept exploit for CVE-2026-50656 was released before Microsoft’s patch, increasing the risk of exploitation. Researcher Nightmare Eclipse publicly disclosed the bug, and Malwarebytes reported on the fix. Mitigation is available in Microsoft Malware Protection Engine 1.1.26060.3008; systems with Defender disabled and another antivirus active are not affected.

CVE-2026-14544: Linux print flaw enables remote takeover

CVE-2026-14544 is a critical integer overflow vulnerability in HP Linux Imaging and Printing Software (HPLIP) with a CVSS score of 9.8. Exploitation allows remote code execution and privilege escalation via a malicious print job. Attackers can exploit CVE-2026-14544 remotely by sending crafted jobs to vulnerable printer queues. The flaw is an incomplete fix for CVE-2026-8631, indicating persistent exposure. CVE-2026-14544 affects RHEL 8, RHEL 9, and RHEL 10, with no immediate patch available; compensating controls are recommended.

Hackers chain Langflow bugs to steal secrets

CVE-2026-55255 (IDOR) and CVE-2026-33017 (code-injection/RCE) are vulnerabilities in Langflow that attackers are chaining to steal credentials and execute code on affected servers. Exploitation of CVE-2026-55255 exposes other users’ flows, while CVE-2026-33017 enables code execution via hijacked flows. Attackers inject a “leak api keys” prompt to extract secrets, risking cross-tenant exposure in multi-user deployments. CVE-2026-55255 is actively exploited and was added to CISA’s Known Exploited Vulnerabilities catalog on July 7, 2026. A fix is available in Langflow 1.9.1 and updates are available for both issues.

Top Threat Actors Reported in Last 24 hours

Hyadina’s GodDamn ransomware disables endpoint defenses

Hyadina (previously tied to Monster and Beast ransomware lines) is a suspected criminal group focused on financial extortion. Hyadina deploys GodDamn ransomware and uses a Microsoft-signed PoisonX driver to disable endpoint protections. Hyadina gains access via AnyDesk remote access, moves laterally with PsExec, and harvests credentials using Mimikatz and NirSoft utilities. Hyadina targets enterprise networks, rapidly escalating from a single compromised machine to widespread disruption. The group’s campaign is marked by renaming encrypted files with the victim’s organization name as the extension.

Helix extortion crew abuses MFA for SharePoint theft

Helix, an extortion group linked to BlackFile and ShinyHunters, is suspected to operate for financial gain. Helix uses social engineering, including vishing and device-code phishing, to capture session tokens and bypass Conditional Access. Helix pivots to automated SharePoint data exfiltration, splitting operations between residential connections for manual browsing and hosted infrastructure for mass downloads. Helix targets enterprises relying on SharePoint for sensitive data storage. The group’s recent campaign is characterized by token-based intrusions and exfiltration patterns such as SharePoint queries using “contentclass:STS_Site” and python-requests traffic.

APT-C-20 targets defense ministries with fileless malware

APT-C-20 (also tracked as Fancy Bear) is a suspected state-sponsored group with espionage motives. APT-C-20 employs weaponized Office documents and COM hijacking for stealthy, fileless execution. APT-C-20 registers a hijacked CLSID at HKEY_CURRENT_USER\Software\Classes\CLSID{68DDBB56-9D1D-4FD9-89C5-C0DA2A625392}\InProcServer32 and triggers loading via explorer.exe to minimize forensic traces. APT-C-20 conceals payloads in PNGs using LSB steganography, decrypts them with AES-256 derived via PBKDF2, and uses reflective loading for a C# Trojan with layered encryption. APT-C-20 targets defense ministries, turning routine document workflows into persistent remote access channels. Researchers attribute the campaign to APT-C-20 based on overlapping TTPs and infrastructure.

Frequently Asked Questions

1. What is GodDamn? GodDamn ransomware, the latest iteration tied to the Hyadina group, stands out for using a Microsoft-signed malicious driver called PoisonX to shut down endpoint defenses before encrypting systems. It entered one victim environment when attackers deployed AnyDesk for unattended remote access on May 29, 2026, then used the downtime to stage activity before launching encryption on June 3, 2026.

2. What is Everest? Everest ransomware is being tracked as a heavily obfuscated .NET payload that tries to slow defenders down while it tears away recovery options. It sabotages restoration by deleting backup files, volume shadow copies, and system restore points, and it also changes system and network settings to weaken protections.

3. What is APT-C-20? APT-C-20 (also known as Fancy Bear) is behind a new fileless-style campaign that uses weaponized Office documents and image steganography to deliver a remote-control Trojan while trying to keep forensic traces low. The attack starts with a malicious macro in readme.docm that drops a DLL and a PNG, then establishes persistence by registering a hijacked CLSID at HKEY_CURRENT_USER\Software\Classes\CLSID{68DDBB56-9D1D-4FD9-89C5-C0DA2A625392}\InProcServer32.

4. What is CVE-2026-50656? Microsoft fixed a Windows Defender zero-day dubbed RoguePlanet that can let an attacker jump from a standard user account to full SYSTEM control on a Windows machine (CVE-2026-50656). In practical terms, that level of access can let an intruder run commands, disable protections, and take over the computer as if they were the operating system itself.

5. What is CVE-2026-14544? A critical flaw in HP Linux Imaging and Printing Software (HPLIP) can enable privilege escalation and remote code execution in enterprise print environments (CVE-2026-14544, CVSS 9.8). The issue stems from an integer overflow leading to a buffer overflow during print data processing, which can allow an attacker’s malicious print job to become code running on a target system.

6. What is CVE-2026-55255? Attackers are exploiting two Langflow vulnerabilities together to steal credentials and run code on affected servers: an IDOR that can expose other users’ flows (CVE-2026-55255) and a code-injection/RCE issue (CVE-2026-33017). By hijacking flows that contain embedded secrets, the attackers can turn an AI workflow into a pipeline for data theft and follow-on compromise.

7. What is Hyadina? Hyadina (previously tied to the Monster and Beast ransomware lines) is behind the GodDamn ransomware, pairing a data-encryption hit with defense evasion that uses a PoisonX driver signed by Microsoft to knock out endpoint protections. They gained a foothold using AnyDesk for remote access, with activity beginning May 29, 2026 and the ransomware deployed on June 3 after a dwell period consistent with staging and reconnaissance.

8. What is Helix? Helix, an extortion group linked in reporting to earlier crews like BlackFile and ShinyHunters, is leaning into identity attacks to get around modern MFA defenses and reach cloud data at scale. They use social engineering such as vishing and device-code phishing to capture session tokens and bypass Conditional Access, then pivot into automated SharePoint data exfiltration.

9. What is APT-C-20? APT-C-20 (also known as Fancy Bear) is running a new campaign against defense ministries that emphasizes stealthy, fileless execution and layered concealment rather than noisy malware installs. They start with weaponized Office documents (readme.docm) that drop a COM-hijacking component and decoy content to draw victims into enabling the attack chain.