Cyber Threat Intelligence Digest: Week 33

Executive Summary -
Highlights of Cyber Threat Intelligence Digest

Vulnerabilities

Ivanti Patches Three Vulnerabilities (CVE-2026-18125, CVE-2026-18127, CVE-2026-18129) in Endpoint Manager - On 11 August 2026, Ivanti patched three high-severity vulnerabilities affecting Ivanti Endpoint Manager (EPM), addressed in EPM 2024 SU7. CVE-2026-18125 is an out-of-bounds read flaw that could allow a threat actor to disrupt the EPM Agent service and trigger a denial-of-service condition.

CVE-2026-18127 is an external control of filename vulnerability that could permit modification of data within an Amazon S3 bucket used by EPM for session recording storage, whilst CVE-2026-18129 is a cleartext transmission vulnerability that could allow an attacker positioned for a man-in-the-middle attack to intercept credentials used for external SQL database connections.

WordPress Patches Critical CVE-2026-15748 Vulnerability in Forminator Forms Plugin - On 17 August 2026, Wordfence disclosed CVE-2026-15748, a critical arbitrary file upload vulnerability in Forminator Forms affecting versions 1.56.1 and earlier. The Forminator team addressed the issue in version 1.56.2, released on 31 July 2026, and the plugin has more than 600,000 active installations. At the time of writing, no active exploitation has been observed in the wild.

The vulnerability affects published Forminator forms containing both a File Upload field and a Select field, allowing a threat actor to introduce crafted upload configuration data through the Select field, which Forminator then processes as valid configuration. This lets the attacker define accepted file extensions and MIME types to bypass the plugin's checks for dangerous file types, enabling the upload of a PHP file. By default, Forminator stores uploaded files in a directory protected by .htaccess rules that prevent PHP execution; however, where an administrator has configured a Custom File Upload Storage root, Forminator may create that directory without the same protection. If a PHP file is uploaded to such an unprotected custom storage location and then requested directly, the server can execute the code, potentially leading to remote code execution and full compromise of the WordPress site, including the deployment of a web shell.

Zoom Patches CVE-2026-53416 Affecting Zoom VDI Client and Plugins - On 11 August 2026, Zoom addressed CVE-2026-53416, a high-severity path traversal vulnerability affecting both the Zoom Workplace VDI Client for Windows and the associated Zoom Workplace VDI Plugins. The flaw impacts versions of these products prior to 7.0.11 and 6.6.15 respectively, meaning organisations running older builds of either component remain exposed until the update is applied. As with many path traversal issues, the underlying weakness stems from insufficient validation of file paths, which can permit access to locations outside the intended directory structure.

Successful exploitation would require the threat actor to already hold valid authentication credentials and local access to the affected system, which somewhat limits the pool of potential attackers to insiders or those who have already gained a foothold through other means.

Potential Threats

ShieldBreak Exploit for High-Severity Link Following Vulnerability in Windows Defender Affecting Multiple Supported Windows Client and Servers - On 12 August 2026, a GitHub user going by INFINITE NIGHTMARE (handle MSNightmare) published a proof-of-concept exploit named ShieldBreak targeting CVE-2026-50656, a high-severity link-following flaw in the Microsoft Malware Protection Engine also known as RoguePlanet. The vulnerability affects engine builds from 1.1.0.0 up to just before 1.1.26060.3008 and was patched by Microsoft during June 2026's Patch Tuesday. ShieldBreak reportedly circumvents that original fix by chaining together Cloud Files placeholder mechanics, Object Manager directories and symbolic links alongside a Microsoft Defender scan operation, allowing a low-privileged local user to redirect a privileged file operation and ultimately obtain a SYSTEM-level shell. Such an outcome could pave the way for full system compromise, credential theft, persistence and further malicious activity.

According to the author's repository, the exploit locates Defender's install path via the registry, loads its client library and calls into its scanning and remediation interfaces before setting up a Cloud Files sync root and object-manager symbolic links to redirect a Defender-initiated scan towards a local administrative share path. Through careful timing and file substitution, it swaps a placeholder file for a purpose-built DLL and attempts to plant it inside the protected System32 directory as an executable image. It then leverages the Windows Error Reporting queue and an existing scheduled task, invoked via the Task Scheduler COM interface, to trigger execution, rather than establishing any new persistence mechanism of its own. The dropped DLL's static strings indicate token manipulation and impersonation-style API calls, suggesting an intended path to a SYSTEM-level process, though the presence of these API references does not by itself confirm successful execution at runtime. The author claims a full success rate against current Windows 11 25H2 Canary builds and Windows Server 2025, whilst Windows 10 and its equivalent server releases are said to remain vulnerable but untested by the PoC.

Akira Affiliate Reboots Compromised Host Into Safe Mode to Disable Endpoint Security - On 12 August 2026, cybersecurity firm Huntress published an analysis of an Akira ransomware intrusion in which an affiliate used Safe Mode with Networking to disable EDR and antivirus protections before executing the ransomware. Akira is a ransomware-as-a-service operation active since March 2023 that employs a double-extortion model, whilst Safe Mode is a Windows diagnostic boot mode that loads only essential drivers and disables most third-party software. Huntress noted this was the first observed instance of an Akira affiliate using the technique. The chain began on 4 August 2026 with a credential-spraying attack against an exposed SonicWall SSL VPN, succeeding at 03:52:42 UTC against an account lacking MFA. The affiliate then accessed the domain controller via RDP, enumerated Active Directory users and computers via PowerShell, and saved the harvested credentials and related data for use in lateral movement.

The affiliate then pivoted to an application server, archived mapped file shares using WinRAR, and exfiltrated the data to a threat actor-controlled Amazon S3 bucket via s5cmd. They installed AnyDesk as a persistent service and, before rebooting, added it to the Safe Mode service registry so it would keep functioning. At 06:29:21 UTC, they forced a reboot into Safe Mode with Networking, disabling Defender's real-time protection whilst preserving remote access, and executed akira.exe. The Safe Mode environment caused the process tree to exhaust virtual memory, producing errors that appear to have prevented successful encryption. A scheduled Defender scan later detected the binary but couldn't remediate it whilst protection was disabled; only after rebooting into normal mode did Defender quarantine akira.exe. Although encryption failed, the affiliate had already exfiltrated the victim's data, leaving them able to pursue extortion.

Weaxor Ransomware Intrusion Abused Microsoft SQL Server as Initial Launcher for Multi-Stage Infection Chain - On 13 August 2026, K7 Security Labs published a technical analysis of a Weaxor ransomware intrusion chain that abused Microsoft SQL Server. Weaxor is a ransomware family evolved from Mallox that targets enterprise systems, encrypting files with the .weax extension. The infection began after actors compromised a SQL Server instance, clearing OS and application logs to obscure the initial access vector. They enabled xp_cmdshell and OLE Automation Procedures, allowing SQL Server to execute OS commands under the sqlservr.exe service account, which spawned cmd.exe and launched an obfuscated PowerShell loader using custom XOR decryption to execute commands in memory via Invoke-Expression. A download cradle retrieved further content that concealed an AMSI bypass through dynamically constructed .NET names and Caesar-shifted byte arrays, before downloading and executing a secondary payload, update.exe.

update.exe directly executed a Cobalt Strike Beacon in memory, using PEB traversal and ROR13 API hashing to resolve functions without conventional imports. The Beacon communicated over WinINet with a legacy user-agent to blend in with browser traffic, then allocated RWX memory and streamed the next-stage payload directly into it. This memory-resident stage used process injection via remote thread creation to run within the legitimate SQLPS.exe utility, from which the primary Weaxor payload was launched. Weaxor encrypts files using an internally implemented ChaCha20 stream cipher rather than native Windows cryptographic APIs, generating keystream blocks through twenty rounds of modular addition, XOR and bit rotation, then XORing them against file contents and appending the .weax extension. It also uses the Windows Event Log APIs to clear logs and hinder investigation.

General News

More than 200 victims of Medusa ransomware identified over the last year, CISA says - Federal cybersecurity agencies warned this week that a substantial number of new Medusa ransomware victims have emerged over the past year. CISA and the FBI updated a March 2025 advisory, noting Medusa actors have now hit more than 500 victims as of April 2026, up from around 300 previously, many within critical infrastructure sectors. The group drew significant attention in April following its attack on the University of Mississippi Medical Center, the state's only children's hospital and Level I trauma centre. The advisory highlights the group's effectiveness at targeting healthcare and weaponising newly disclosed vulnerabilities, sometimes within 24 hours of disclosure or even before it, though Medusa is not believed to develop its own exploits, instead acquiring or quickly leveraging access from third parties. Having shifted from a closed operation to an affiliate model in 2023, the group grants access based on experience, with negotiations for newer affiliates typically handled centrally.

Medusa tends to offer reduced ransoms for prompt payment and researches victims beforehand to calibrate demands against public revenue figures. Whilst stolen data is said to be removed once payment is made, agencies caution there is no way to confirm genuine deletion, and victims are often charged extra to delay publication by a day. One highlighted case involved a victim approached by a separate actor claiming the original negotiator had stolen the payment, potentially pointing to triple extortion or internal disorganisation. The group relies on credential-theft tools before pivoting to legitimate remote access software, including AnyDesk, Atera and ConnectWise, to evade detection. Medusa has not listed a new victim since April, which experts attribute to heightened scrutiny following the Mississippi incident, though researchers note a broader trend of ransomware groups operationalising vulnerabilities at speed, some moving from access to exfiltration within hours.

Hacker claims 3.6 million Azure account records stolen from major companies -A threat actor using the alias TheHatman has been advertising employee databases allegedly stolen from the Azure infrastructure of multiple Fortune 500 companies via compromised credentials. Starting 31 July, the actor posted dumps purportedly from McDonald's, Gap Inc., Vodafone, Tata Consultancy Services, HCL Technologies, IHG and Kyndryl, claiming 3.64 million records combined. The largest, posted Sunday, allegedly holds 1.7 million McDonald's employee records taken directly from an Azure tenant, comprising names, employee IDs, emails, job titles, phone numbers, addresses and service account details. A second dump, said to contain over 800,000 Tata Consultancy Services records, was similarly claimed to have been extracted via compromised credentials, with the actor citing password spraying and MFA fatigue as the attack vector.

However, both Tata and Gap Inc. have disputed the claims. Tata told the National Stock Exchange of India its investigation found no credible evidence of a breach, adding the data appears at least four years old, contains only basic information, and that its defences against the cited techniques have been effective for over two years. Gap Inc. similarly reported no evidence of compromise, describing the data as limited, non-sensitive and several years old. Cybercrime intelligence firm Hudson Rock, which analysed sample data, found genuine corporate directory attributes and tenant-specific structures, including service accounts and global administrator names that could aid social engineering, and expressed high confidence in the data's authenticity, though the access vector remains unconfirmed. BleepingComputer has not independently verified the data, and the affected companies had not responded by publication.

Microsoft’s massive Patch Tuesday releases continue as AI reshapes bug discovery - Microsoft on Tuesday released fixes for 419 security vulnerabilities, one of the largest monthly counts on record and a further sign that AI is dramatically increasing the volume of software flaws security teams must contend with. In May, when Microsoft shipped patches for 137 vulnerabilities, it remarked that AI-powered vulnerability discovery was ceasing to be speculative and becoming an engineering problem. Since then, successive record-breaking releases, including 206 in June and 622 in July, have pushed the company well past its previous annual record of around 1,250. This month's update addresses 62 critical and 357 important-rated issues, roughly five times the typical pre-AI monthly volume, with Microsoft again replacing its itemised CVE list with a summary table by product family and a "Notable CVEs" section.

Three flaws are zero-days, two disclosed publicly before patching, whilst CVE-2026-68820, affecting a Windows networking component, has already been exploited in the wild by Lazarus Group in a campaign targeting job applicants in defence, aerospace and aviation using trojanised PDF readers. A separate flaw, CVE-2026-62832, was credited to an anonymous researcher but matches a proof-of-concept published by Nightmare Eclipse amid an ongoing dispute over Microsoft's disclosure practices. Widespread exploitation of the broader surge has not been observed, though the Five Eyes alliance warned in June that AI would soon transform offensive and defensive cyber capabilities within months, and defenders now face added difficulty piecing together the full picture from underlying advisory feeds given the new clustered format.

Threat Actor Weekly Graph

Over the past 7 days, we have been tracking the following intent and opportunity changes within our Threat Actor Landscape.

Intent represents the potential targets of a group. When a group is observed attacking a different organisation or entity, their intent will increase.

Opportunity represents the various methods and technologies these groups may use. For example, if a group started using a new attack vector, such as a new kind of ransomware, their opportunity would increase.

Both intent and opportunity are scored out of 100 and are responsible for scoring the group's severity. These updates can be seen below.