HelloNet Campaign: A Sophisticated Supply Chain Attack on Russian OrganizationsHelloNet Campaign: A Sophisticated Supply Chain Attack on Russian Organizations
In July 2026, an advanced threat actor initiated a sophisticated cyber-espionage campaign, dubbed 'HelloNet,' targeting Russian organizations across government, energy, transport, education, and logistics sectors. The attackers exploited the update mechanism of ViPNet, a widely used Russian information-security product suite, by placing a malicious DLL file within the local ViPNet Update System directory. This file, named 'wtsapi32.dll' or 'HelloInjector,' was sideloaded at system startup via the legitimate 'itcsrvup64.exe' executable. Once executed, HelloInjector injected a payload into the 'svchost.exe' process, granting elevated privileges and persistence across reboots. Subsequent payloads, including 'HelloProxy' and 'HelloExecutor,' facilitated command execution, network reconnaissance, and data exfiltration. Kaspersky researchers tentatively attributed the campaign to an unidentified Chinese-speaking advanced persistent threat (APT) group, based on limited evidence such as an unused string referencing the Chinese website 'sina.com' and a malware download mirror hosted by the University of Science and Technology of China. However, this attribution remains low-confidence, with the possibility of a false flag operation not being ruled out. The campaign underscores the critical need for organizations to monitor systems running ViPNet software, particularly traffic on ports 5003, 5060, and 443, to detect and mitigate potential threats.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
SonicWall SMA Zero-Day Exploits Grant Root Access
In June 2026, a previously unidentified threat actor, designated UTA0533, exploited zero-day vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances. The vulnerabilities, CVE-2026-15409 (CVSS 10.0) and CVE-2026-15410 (CVSS 7.2), were actively exploited prior to public disclosure, allowing attackers to execute arbitrary commands and gain root access to affected devices. The attackers deployed custom malware, including ROOTRUN and ORANGETAIL, to establish persistence and facilitate further network intrusion. SonicWall released patches for these vulnerabilities in July 2026.
This incident underscores the critical importance of timely vulnerability management and the need for organizations to monitor and secure remote access infrastructure. The exploitation of these zero-days highlights the evolving tactics of threat actors targeting network edge devices to gain unauthorized access.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
UAC-0145's Use of ClickFix CAPTCHAs: A New Cyber Threat in Ukraine
In July 2026, the Russian state-sponsored hacking group UAC-0145, also known as Sandworm or APT44, launched a campaign targeting Ukrainian organizations. The attackers employed a technique called ClickFix, which involves fake CAPTCHA prompts on compromised websites. These prompts instructed users to execute PowerShell commands, leading to the installation of data-stealing malware such as GHETTOVIBE and SCOUTCURL. The campaign compromised at least ten websites and utilized tools like SMARTAXE to dynamically alter web content, displaying deceptive CAPTCHA checks. Additionally, the attackers distributed malicious Android APK files via messaging apps, deploying the COWARDDUCK backdoor to exfiltrate sensitive information from infected devices.
This incident underscores the evolving tactics of state-sponsored threat actors, who are increasingly adopting social engineering techniques traditionally associated with financially motivated cybercriminals. The use of ClickFix by UAC-0145 highlights the need for heightened vigilance and user education to recognize and avoid such deceptive tactics.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Surge in ACR Stealer Attacks: Protecting Your Enterprise
Between late April and mid-June 2026, Microsoft observed a significant increase in attacks utilizing the ACR Stealer malware, targeting enterprise customers to exfiltrate browser-stored passwords, authentication tokens, and sensitive documents. The attackers employed social engineering tactics, notably the 'ClickFix' method, to deceive users into executing malicious commands. These campaigns leveraged WebDAV servers and the MSHTA utility to deliver the info-stealing payloads, with some variants utilizing blockchain services for command-and-control communication. The impact includes unauthorized access to confidential information and potential compromise of enterprise systems.
This surge underscores the evolving sophistication of cyber threats, particularly the use of social engineering combined with advanced delivery mechanisms. Organizations must enhance their security posture by implementing robust user education programs, restricting the execution of untrusted scripts, and monitoring for unusual network activities to mitigate such risks.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Inc Ransomware's Exploitation of SonicWall SMA Zero-Days in 2026
In July 2026, SonicWall disclosed two critical vulnerabilities in its Secure Mobile Access (SMA) 1000 Series appliances: CVE-2026-15409, a server-side request forgery flaw, and CVE-2026-15410, a code injection vulnerability. These vulnerabilities were actively exploited by the Inc ransomware group, allowing unauthenticated attackers to gain root-level access to the appliances. The attackers leveraged these flaws to infiltrate enterprise networks, exfiltrate credentials, and deploy ransomware payloads, leading to significant operational disruptions.
This incident underscores the escalating threat posed by sophisticated ransomware groups targeting critical infrastructure through zero-day vulnerabilities. Organizations must prioritize timely patching, conduct thorough forensic analyses post-patching, and implement robust monitoring to detect and mitigate such advanced persistent threats.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
CISA Issues Urgent Directive on Fortinet FortiSandbox Vulnerabilities
In July 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent directive for federal agencies to patch two critical vulnerabilities in Fortinet's FortiSandbox platform, identified as CVE-2026-39808 and CVE-2026-25089. These flaws, disclosed in April and June 2026 respectively, allow unauthenticated attackers to execute arbitrary code remotely via command injection attacks. Despite Fortinet's initial advisories, threat intelligence firm Defused observed active exploitation of these vulnerabilities in mid-June 2026, prompting CISA to mandate immediate remediation by July 19, 2026. The exploitation of these vulnerabilities underscores a growing trend of attackers targeting critical infrastructure components. FortiSandbox, integral to many organizations' security architectures, has become a focal point for cyber threats. This incident highlights the necessity for organizations to promptly apply security patches and maintain vigilant monitoring to mitigate emerging threats.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Understanding the 'LegacyHive' Windows Zero-Day Vulnerability
In July 2026, a security researcher known as 'Nightmare Eclipse' disclosed a zero-day vulnerability named 'LegacyHive' affecting fully patched Windows systems. This local privilege escalation flaw in the Windows User Profile Service allows attackers with local access to load other users' registry hives, including those of administrators, potentially leading to unauthorized access and control over sensitive data. The researcher released a proof-of-concept (PoC) exploit, which, while requiring additional user credentials, still poses a significant security risk.
The release of 'LegacyHive' underscores a growing trend of public disclosure of zero-day vulnerabilities, often as a form of protest against perceived mishandling by software vendors. This incident highlights the critical need for organizations to implement robust security measures, including timely patch management and monitoring for unusual system activities, to mitigate the risks associated with such vulnerabilities.
Medium impact
Kill Chain
ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Understanding the HollowByte OpenSSL DoS Vulnerability
In July 2026, a critical vulnerability known as 'HollowByte' was identified in OpenSSL, allowing unauthenticated attackers to induce a denial-of-service (DoS) condition on servers by sending a mere 11-byte payload. This flaw exploits the TLS handshake process, where the server allocates memory based on the declared size in the handshake header without verifying the actual payload size. Consequently, attackers can cause excessive memory allocation, leading to server instability or crashes. The OpenSSL team has addressed this issue in version 4.0.1 and backported fixes to earlier versions. Organizations are urged to update their OpenSSL installations promptly to mitigate potential disruptions. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hollowbyte-ddos-flaw-bloats-openssl-server-memory-with-11-byte-payload/?utm_source=openai))
The HollowByte vulnerability underscores the persistent risks associated with foundational internet security protocols. As cyber threats evolve, it is imperative for organizations to remain vigilant, ensuring timely updates and robust security practices to safeguard against emerging vulnerabilities.
Medium impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
OpenSSL HollowByte Flaw: Critical DoS Vulnerability Discovered
In July 2026, a vulnerability named 'HollowByte' was discovered in OpenSSL, allowing unauthenticated attackers to trigger a denial-of-service (DoS) condition on servers by sending a malicious 11-byte payload. This flaw causes the server to allocate significant memory for a message that never arrives, leading to potential service disruptions. The OpenSSL team has silently patched this vulnerability without assigning a CVE identifier or issuing an advisory. Organizations relying on OpenSSL for secure communications should prioritize updating to the latest patched versions to mitigate this risk. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hollowbyte-ddos-flaw-bloats-openssl-server-memory-with-11-byte-payload/?utm_source=openai))
The HollowByte vulnerability underscores the critical importance of timely patch management and the need for organizations to stay vigilant about silent fixes in widely used libraries. As cyber threats continue to evolve, ensuring that foundational security components like OpenSSL are up-to-date is essential to maintain robust defense mechanisms.
Medium impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Salt Typhoon Cyberattack 2024: A Wake-Up Call for Surveillance System Security
In October 2024, the Salt Typhoon cyberattack, allegedly backed by China, targeted U.S. wiretap systems, granting attackers access to sensitive intelligence and law enforcement communications collected by major U.S. internet service providers such as Verizon, AT&T, and Lumen Technologies. The breach exploited systems designed for lawful surveillance, highlighting vulnerabilities in government-mandated surveillance infrastructure. This incident underscores the critical need for robust cybersecurity measures to protect sensitive communication channels from state-sponsored cyber espionage. The Salt Typhoon attack is part of a broader pattern of advanced persistent threats linked to Beijing, raising significant national security concerns regarding foreign access to critical U.S. surveillance infrastructure.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
BoryptGrab Malware Campaign Exploits Fake GitHub Repositories in 2026
In July 2026, cybersecurity researchers uncovered a large-scale malware campaign involving 292 fake GitHub repositories impersonating legitimate software projects. These repositories distributed a variant of the BoryptGrab infostealer, which targets sensitive data from web browsers, cryptocurrency wallets, and messaging applications. The malware was delivered through trojanized installers that exploited DLL side-loading techniques, allowing attackers to harvest credentials and financial information from unsuspecting users. The campaign primarily targeted users in the United States, Germany, Romania, and Venezuela, leading to significant data breaches and financial losses.
This incident underscores the growing trend of cybercriminals leveraging trusted platforms like GitHub to distribute malware. The sophistication of the campaign, including the use of search engine optimization to promote malicious repositories, highlights the need for enhanced vigilance and verification processes when downloading software from online sources.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
ACR Stealer's ClickFix Campaign: A Wake-Up Call for Cybersecurity
In mid-2026, the ACR Stealer malware exploited ClickFix social engineering tactics to infiltrate enterprise networks. By deceiving users into executing commands via fake verification prompts, attackers deployed two primary infection chains: one utilizing WebDAV and PowerShell scripts, and another employing mshta.exe with obfuscated PowerShell. Both methods aimed to exfiltrate browser-stored credentials, session tokens, and sensitive Microsoft 365 documents, including files from OneDrive and SharePoint.
This incident underscores a significant shift towards sophisticated social engineering attacks that bypass traditional security measures. The reliance on user interaction highlights the critical need for enhanced user awareness and robust endpoint protection strategies to mitigate such threats.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
