Cyware Weekly Threat Intelligence - August 7 - 14, 2026
Attackers are slashing through enterprise defenses by chaining zero-days and supply chain compromises, as cyware.com tracked ransomware crews exploiting fresh vulnerabilities in Fortinet, N-able, and Microsoft Winsock. Over 8,500 SharePoint servers and hundreds of VMware vCenter instances faced active exploitation, with ransomware gangs moving from disclosure to deployment in days.
The npm ecosystem has been turned into a high-speed infection vector, with the Shai-Hulud malware compromising at least 868 packages and the npm worm leveraging lifecycle scripts to propagate across millions of downloads. Meanwhile, North Korea’s Lazarus Group and China-linked Storm-1175 escalated global campaigns, targeting defense, MSP, and critical infrastructure sectors with advanced social engineering and ransomware payloads.
Top Malware Reported This Week
Gunra Ransomware Exploits Fortinet Devices in Operation Double Barrel
Gunra ransomware is a ransomware-as-a-service operation with potential links to North Korea and the Lazarus group, designed to encrypt and exfiltrate sensitive data from compromised systems. Gunra ransomware targets both Windows and Linux environments, employing stealth tactics such as log deletion and off-hours reconnaissance to evade detection. Gunra ransomware exploits authentication bypass vulnerabilities in Fortinet products, specifically FortiOS and FortiProxy, to gain initial access. Gunra ransomware targets critical infrastructure sectors globally, including healthcare, financial services, critical manufacturing, transportation, government services, utilities, and retail. Gunra ransomware has been observed exfiltrating business-critical documents, databases, PII, and internal email communications. Patches for CVE-2025-24472 and CVE-2024-55591 are recommended, with enhanced monitoring for exploitation attempts.
StormEncryptor Ransomware Rapidly Exploits N-able Vulnerability
StormEncryptor ransomware is a C++-based ransomware strain deployed by Storm-1175 to encrypt files and disrupt operations, appending the .encrypted extension and dropping a ransom note named !!!README_FIRST!!!.txt. StormEncryptor ransomware leverages remote administration tools like AnyDesk and SimpleHelp, and uses credential theft tools such as Mimikatz to expand access within networks. StormEncryptor ransomware exploits the CVE-2026-18577 authentication bypass vulnerability in N-able N-Central products, capitalizing on the gap between public disclosure and patch deployment. StormEncryptor ransomware targets organizations using N-Central for remote monitoring and management, with the potential to impact thousands of devices managed by MSPs. StormEncryptor ransomware was rapidly deployed following the vulnerability's public disclosure, with British security researcher Kevin Beaumont assisting a government agency affected by the attack.
Worm Compromises Popular npm Packages via Lifecycle Script Propagation
The npm worm is a self-propagating malware that compromises npm packages to inject a backdoor and autonomously spread across repositories. The npm worm executes via preinstall lifecycle scripts, stages a second payload using Bun, and collects sensitive data such as files and environment variables. The npm worm communicates with a C2 server via an Ethereum contract and uses GitHub as a fallback for data exfiltration, propagating by stealing npm tokens and GitHub credentials. The npm worm spreads through compromised npm packages, including keyv, cacheable, and ecto, leveraging npm tokens and GitHub credentials to infect additional projects. The npm worm poses a significant threat due to the high download rates of affected packages and the use of lifecycle scripts for propagation.
Shai-Hulud Supply Chain Attack Compromises npm Ecosystem at Scale
Shai-Hulud is a credential-stealing malware injected into widely-used npm packages, targeting secret stores and exfiltrating sensitive tokens and keys. Shai-Hulud uses setup.mjs as a dropper to download the Bun JavaScript runtime and execute Math_Symbol.js, which extracts npm registry auth tokens, GitHub CLI tokens, AWS access keys, and HashiCorp Vault tokens. Shai-Hulud spreads by compromising maintainers and propagating malicious versions across the npm ecosystem, affecting millions of users. Shai-Hulud has compromised at least 868 packages across 1381 versions, including keyv, cacheable, flat-cache, and file-entry-cache, as well as packages used by major organizations. Shai-Hulud poses a significant risk due to the scale of the attack and the credential extraction capabilities.
Eclipse Ransomware RaaS Targets Hybrid Enterprise Environments
Eclipse Ransomware is a Ransomware-as-a-Service platform that encrypts files on Windows, Linux, NAS devices, VMware ESXi, and Nutanix environments. Eclipse Ransomware employs ChaCha20 encryption and Kyber-based key exchange, with configurable modes for speed and stealth, and features automated lateral movement, defense evasion, and process termination. Eclipse Ransomware provides affiliates with management features such as separate Bitcoin and Monero wallets, dedicated Tor .onion addresses, and direct leak-site publishing options. Eclipse Ransomware is distributed through a RaaS model, with affiliates recruited under a 90/10 revenue split for the first 10 extortion cases and a $300 entry fee. Eclipse Ransomware targets hybrid enterprise environments, with the Windows payload developed in Rust and other variants in C++.
Top Vulnerabilities Reported This Week
CVE-2026-45659 actively exploited in Microsoft SharePoint by ransomware gangs
CVE-2026-45659 is a remote code execution vulnerability in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, caused by deserialization of untrusted data, with active exploitation by ransomware gangs. CVE-2026-45659 allows attackers with low privileges to execute arbitrary code on unpatched SharePoint servers, leading to ransomware deployment. Ransomware gangs are actively exploiting CVE-2026-45659, and CISA has mandated Federal Civilian Executive Branch agencies to secure their servers within three days. CISA confirmed exploitation, and Shadowserver reported over 8,500 exposed SharePoint servers, with more than 200 unpatched. Microsoft recommends immediately applying the latest patches, enabling AMSI integration, using Microsoft Defender Antivirus detections, and monitoring for exploitation.
CVE-2026-15409 and CVE-2026-15410 exploited in SonicWall SMA1000 appliances
CVE-2026-15409 is a server-side request forgery (SSRF) vulnerability with a CVSS score of 10.0, and CVE-2026-15410 is a code injection vulnerability with a CVSS score of 7.2, both affecting SonicWall SMA1000 models 6210, 7210, and 8200v. CVE-2026-15409 enables remote, unauthenticated attackers to make unauthorized requests, while CVE-2026-15410 allows code injection after administrator authentication, leading to unauthorized access, data exfiltration, and ransomware deployment. Both vulnerabilities have been actively exploited in ransomware campaigns, with the SSRF serving as an entry point and code injection enabling persistence and payload staging. Researchers identified indicators of compromise including successful HTTP 200 requests to /__api__/login or /__api__/logout, and suspicious /wsproxy requests yielding HTTP 101 responses. SonicWall has released hotfixes for affected versions, and organizations are advised to apply them immediately, preserve logs, and conduct full incident-response assessments.
CVE-2026-59310 actively exploited in VMware vCenter servers
CVE-2026-59310 is a critical path traversal vulnerability in VMware vCenter servers that allows unauthenticated attackers to execute arbitrary code. CVE-2026-59310 has resulted in significant security breaches, with attackers installing a reverse SSH framework for persistent access and compromising hundreds of servers. The vulnerability is actively exploited, with the most affected regions being Germany, the United States, and Turkey. An advanced persistent threat (APT) group is suspected to be behind the attacks, and 361 unique IP addresses have been identified across 47 countries. Broadcom has released security updates to address CVE-2026-59310, and organizations should apply these updates, review server logs, and implement network segmentation.
CVE-2026-48282 rapidly exploited in Adobe ColdFusion
CVE-2026-48282 is a path traversal vulnerability (CWE-22) in Adobe ColdFusion 2025 through Update 9 and ColdFusion 2023 through Update 20, with a CVSS score of 10.0, allowing unauthenticated remote code execution. CVE-2026-48282 enables attackers to execute arbitrary code and potentially compromise supply chains and third-party applications. Exploitation attempts were observed within hours of public disclosure, with activity traced to an India-geolocated IP address, and CISA added CVE-2026-48282 to the Known Exploited Vulnerabilities list. Researchers observed approximately 750-800 ColdFusion servers exposed online, highlighting the urgency for remediation. Adobe recommends applying APSB26-68 and subsequent fixes, reviewing logs for suspicious file writes, disabling RDS if not needed, and segmenting internet-facing servers.
CVE-2026-18577 exploited by Storm-1175 in N-central RMM console
CVE-2026-18577 is a critical supply-chain vulnerability in the N-central RMM console that allows unauthenticated access and full administrative control over N-central servers. CVE-2026-18577 enables attackers to deploy ransomware across managed networks, posing significant risk to managed service providers and their clients. The China-linked Storm-1175 group began exploiting CVE-2026-18577 on August 2, following emergency hotfixes issued on August 2 and August 6, but many servers remain unpatched. The vulnerability was initially detected on July 31, and exploitation has led to widespread ransomware incidents. Organizations should promptly apply the latest hotfixes, consider taking N-central offline in high-risk environments, and monitor for unauthorized access.
CVE-2026-68820 exploited by Lazarus Group in Microsoft Winsock
CVE-2026-68820 is a privilege escalation vulnerability in the Winsock component of Windows systems, actively exploited by the Lazarus Group as part of Operation 'Dream Job'. CVE-2026-68820 allows attackers to escalate privileges after gaining initial access via phishing, potentially leading to complete system compromise. The Lazarus Group targets sectors such as surveillance sensors, drones, and robotics in France, Germany, Brazil, and India, using malicious PDFs and impersonating recruiters from companies like Lockheed Martin and Enveil. Check Point discovered and reported CVE-2026-68820, noting the campaign's use of legitimate-looking infrastructure to bypass detection. Microsoft has released a patch for CVE-2026-68820, and organizations should update and restart all Windows endpoints, enhance detection for phishing and kernel-driver race abuse, and conduct security awareness training.
Top Threat Actors Reported This Week
Lazarus Group exploits Windows zero-day in Operation Dream Job targeting global defense sectors
Lazarus Group (also tracked as Hidden Cobra), a suspected North Korea-linked threat actor primarily motivated by cyber espionage and financial gain, has launched Operation Dream Job exploiting the Windows zero-day CVE-2026-68820. Lazarus Group employs two infection chains: DLL sideloading, which delivers the MISTPEN loader and ForestTiger backdoor, and the SecurityPDF trojanized viewer, which deploys the Troy backdoor capable of file operations, process management, and in-memory DLL injection. Lazarus Group leverages sophisticated social engineering, impersonating recruiters from companies such as Lockheed Martin and Enveil, and uses compromised infrastructure including Roundcube webmail and CMS platforms for command and control via RelayShell. Lazarus Group targets defense, aerospace, and aviation sectors across Europe, Asia, and South America, specifically in France, Germany, Brazil, and India. Lazarus Group initiates attacks through phishing, using malicious PDFs and impersonation websites, followed by privilege escalation via the Winsock vulnerability to achieve SYSTEM-level access. Lazarus Group has a history of high-profile operations, including the Sony Pictures hack and the WannaCry ransomware outbreak.
Storm-1175 exploits N-central RMM vulnerability to deploy ransomware in supply-chain attacks
Storm-1175, a suspected China-linked threat actor believed to be motivated by financial gain and disruption, is actively exploiting the critical CVE-2026-18577 vulnerability in the N-central RMM console. Storm-1175 uses unauthenticated access to N-central servers to gain full administrative control, enabling the deployment of ransomware across managed networks. Storm-1175 began exploiting this vulnerability on August 2, following the release of emergency hotfixes, and continues to target unpatched servers despite available patches. Storm-1175 focuses on managed service providers and their clients, increasing the risk of widespread ransomware incidents in the supply-chain ecosystem. Storm-1175 leverages this supply-chain vulnerability to compromise multiple organizations simultaneously, with exploitation first detected on July 31.
Sandworm targets Ukrainian IT professionals with fake recruitment and malicious VPN apps
Sandworm (also tracked as Unit 74455), a Russian military intelligence-linked threat actor focused on cyber espionage and disruption, is targeting Ukrainian IT workers by posing as recruiters. Sandworm conducts operations by impersonating recruiters from a fake company, Atlas Business Group, and uses legitimate job sites and Telegram to identify and contact victims. Sandworm instructs victims to download a modified VPN app, SopraVPN, which is built on legitimate WireGuard code and allows encrypted command execution on compromised devices. Sandworm specifically targets system administrators and IT professionals in Ukraine, leveraging job platforms and fake interviews to distribute malware. Sandworm hosts the malicious app on SourceForge and links it from a fake company website, making detection challenging.
Kimsuky enhances Operation GitPower with AI-driven espionage against diplomatic and security targets
Kimsuky (also tracked as Thallium), a North Korea-linked threat actor focused on cyber espionage, is enhancing its capabilities by integrating AI tools such as Whisper, Ollama, GPT4All, and Msty to process stolen calls and meetings. Kimsuky uses spear-phishing lures and AI-generated decoy documents, along with LNK files employing custom Base64 decoding and string splitting, to execute malicious payloads. Kimsuky distributes RC4-encrypted payloads disguised as image files via Git repositories, leveraging AI-driven analysis and document retrieval to improve espionage operations. Kimsuky targets foreign diplomatic missions, military and security organizations, and virtual-asset-related entities. Kimsuky continues to use Git-based infrastructure and advanced social engineering to gain initial access and exfiltrate sensitive information.
Frequently Asked Questions
What is Gunra ransomware? Gunra ransomware is a ransomware-as-a-service operation, potentially linked to North Korea and the Lazarus group, that encrypts and exfiltrates sensitive data from compromised systems. Gunra ransomware targets both Windows and Linux environments, employing stealth and defense impairment techniques such as log deletion and off-hours reconnaissance to evade detection.
What is StormEncryptor ransomware? StormEncryptor ransomware is a C++-based ransomware strain deployed by Storm-1175 to encrypt files and disrupt operations, appending the .encrypted extension and dropping a ransom note named !!!README_FIRST!!!.txt. StormEncryptor ransomware leverages remote administration tools like AnyDesk and SimpleHelp, and uses credential theft tools such as Mimikatz to expand access within networks.
What is the npm worm? The npm worm is a self-propagating malware that compromises npm packages to inject a backdoor and autonomously spread across repositories. The npm worm executes via preinstall lifecycle scripts, stages a second payload using Bun, and collects sensitive data such as files and environment variables.
What is Shai-Hulud? Shai-Hulud is a credential-stealing malware injected into widely-used npm packages, targeting secret stores and exfiltrating sensitive tokens and keys. Shai-Hulud uses setup.mjs as a dropper to download the Bun JavaScript runtime and execute Math_Symbol.js, which extracts npm registry auth tokens, GitHub CLI tokens, AWS access keys, and HashiCorp Vault tokens.
What is Eclipse Ransomware? Eclipse Ransomware is a Ransomware-as-a-Service platform that encrypts files on Windows, Linux, NAS devices, VMware ESXi, and Nutanix environments. Eclipse Ransomware employs ChaCha20 encryption and Kyber-based key exchange, with configurable modes for speed and stealth, and features automated lateral movement, defense evasion, and process termination.
What is CVE-2026-45659? CVE-2026-45659 is a remote code execution vulnerability in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition, caused by deserialization of untrusted data. CVE-2026-45659 allows attackers with low privileges to execute arbitrary code on unpatched SharePoint servers, leading to ransomware deployment.
What is CVE-2026-15409? CVE-2026-15409 is a server-side request forgery (SSRF) vulnerability with a CVSS score of 10.0, and CVE-2026-15410 is a code injection vulnerability with a CVSS score of 7.2, both affecting SonicWall SMA1000 models 6210, 7210, and 8200v. CVE-2026-15409 enables remote, unauthenticated attackers to make unauthorized requests, while CVE-2026-15410 allows code injection after administrator authentication, leading to unauthorized access, data exfiltration, and ransomware deployment.
What is CVE-2026-59310? CVE-2026-59310 is a critical path traversal vulnerability in VMware vCenter servers that allows unauthenticated attackers to execute arbitrary code. CVE-2026-59310 has resulted in significant security breaches, with attackers installing a reverse SSH framework for persistent access and compromising hundreds of servers.
What is CVE-2026-48282? CVE-2026-48282 is a path traversal vulnerability (CWE-22) in Adobe ColdFusion 2025 through Update 9 and ColdFusion 2023 through Update 20, with a CVSS score of 10.0, allowing unauthenticated remote code execution. CVE-2026-48282 enables attackers to execute arbitrary code and potentially compromise supply chains and third-party applications.
What is CVE-2026-18577? CVE-2026-18577 is a critical supply-chain vulnerability in the N-central RMM console that allows unauthenticated access and full administrative control over N-central servers. CVE-2026-18577 enables attackers to deploy ransomware across managed networks, posing significant risk to managed service providers and their clients.
What is CVE-2026-68820? CVE-2026-68820 is a privilege escalation vulnerability in the Winsock component of Windows systems, actively exploited by the Lazarus Group as part of Operation 'Dream Job'. CVE-2026-68820 allows attackers to escalate privileges after gaining initial access via phishing, potentially leading to complete system compromise.
What is Lazarus Group? Lazarus Group (also tracked as Hidden Cobra), a North Korea-linked threat actor primarily motivated by cyber espionage and financial gain, has launched Operation Dream Job exploiting the Windows zero-day CVE-2026-68820. Lazarus Group employs two infection chains: DLL sideloading, which delivers the MISTPEN loader and ForestTiger backdoor, and the SecurityPDF trojanized viewer, which deploys the Troy backdoor capable of file operations, process management, and in-memory DLL injection.
What is Storm-1175? Storm-1175, a China-linked threat actor believed to be motivated by financial gain and disruption, is actively exploiting the critical CVE-2026-18577 vulnerability in the N-central RMM console. Storm-1175 uses unauthenticated access to N-central servers to gain full administrative control, enabling the deployment of ransomware across managed networks.
What is Sandworm? Sandworm (also tracked as Unit 74455), a Russian military intelligence-linked threat actor focused on cyber espionage and disruption, is targeting Ukrainian IT workers by posing as recruiters. Sandworm conducts operations by impersonating recruiters from a fake company, Atlas Business Group, and uses legitimate job sites and Telegram to identify and contact victims.
What is Kimsuky? Kimsuky (also tracked as Thallium), a North Korea-linked threat actor focused on cyber espionage, is enhancing its capabilities by integrating AI tools such as Whisper, Ollama, GPT4All, and Msty to process stolen calls and meetings. Kimsuky uses spear-phishing lures and AI-generated decoy documents, along with LNK files employing custom Base64 decoding and string splitting, to execute malicious payloads.