Identity Attacks Surpass Exploits as Leading Ransomware Cause in 2026Identity Attacks Surpass Exploits as Leading Ransomware Cause in 2026
In 2026, identity-based attacks emerged as the leading cause of ransomware incidents, surpassing traditional vulnerability exploits. According to Sophos' State of Ransomware 2026 report, malicious emails (26%) and phishing (24%) accounted for half of all ransomware attack vectors, while exploited vulnerabilities declined to 18%. Notably, 67% of victims identified the ransomware attack as their most significant identity-related breach of the year. Despite the deployment of multifactor authentication (MFA) in 97% of credential-based attacks, these measures failed to prevent compromises, highlighting gaps in implementation and the evolving sophistication of attackers.
This shift underscores the critical need for organizations to enhance their identity security frameworks. The prevalence of identity-driven attacks necessitates a reevaluation of current security protocols, emphasizing advanced email filtering, comprehensive MFA deployment, and regular phishing awareness training to mitigate the rising threat landscape.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
CISA Highlights Critical Vulnerabilities in Latest KEV Catalog Update
On July 15, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2023-4346 and CVE-2026-46817. CVE-2023-4346 pertains to the KNX Protocol's overly restrictive account lockout mechanism, potentially allowing attackers to purge devices and set unauthorized keys. CVE-2026-46817 affects Oracle E-Business Suite's Payments component, enabling unauthenticated attackers to compromise the system via HTTP, leading to potential full system takeover. Both vulnerabilities pose significant risks to federal enterprises and have been actively exploited.
The inclusion of these vulnerabilities in the KEV Catalog underscores the persistent threat posed by unpatched systems. Organizations are urged to prioritize remediation efforts, especially for vulnerabilities known to be actively exploited, to mitigate potential breaches and maintain system integrity.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Critical Vulnerability in NASA's cFS Health & Safety Application: CVE-2026-15352
In July 2026, a critical vulnerability (CVE-2026-15352) was identified in NASA's Core Flight System (cFS) Health & Safety (HS) Application. This flaw allows attackers to trigger a segmentation fault by sending a routine Housekeeping Telemetry request, leading to a denial-of-service condition. The vulnerability affects versions of the HS application prior to v7.0.1. NASA has released an update to address this issue and recommends users upgrade to v7.0.1 to mitigate the risk. ([software.nasa.gov](https://software.nasa.gov/software/GSC-18476-1?utm_source=openai))
This incident underscores the importance of timely software updates in mission-critical systems. As space exploration technologies become increasingly reliant on software, ensuring the security and reliability of these systems is paramount to prevent potential disruptions and maintain operational integrity.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
PhantomEnigma: Cyberattack Compromises Brazilian Government Websites
In July 2026, cybersecurity analysts uncovered a campaign named PhantomEnigma, which exploited over 20 Brazilian government websites to distribute malware targeting banking and public-sector organizations. Attackers compromised legitimate .gov.br domains and email accounts, enabling them to bypass security protocols and deliver malicious payloads through trusted channels. This operation utilized modular malware and frequently rotated infrastructure, complicating detection and mitigation efforts. The campaign's sophistication underscores the critical need for robust cybersecurity measures to protect sensitive government and financial data.
The PhantomEnigma incident highlights a growing trend of cybercriminals leveraging trusted government infrastructure to conduct attacks, increasing the difficulty of detection and response. This case serves as a stark reminder for organizations to enhance their security postures, particularly in monitoring and securing official digital platforms against such sophisticated threats.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
TELEPUZ Malware Exploits ClickFix to Compromise Systems
In late April 2026, a new modular malware named TELEPUZ began spreading through websites compromised with ClickFix lures. This malware, written in C, is lightweight and modular, indicating active development by a small team or solo developer. The infection chain starts with a ClickFix social engineering lure that downloads and executes a second-stage VIDAR Go variant, leading to the deployment of TELEPUZ. The malware employs various obfuscation techniques, including garbage instructions, import name hashing, string encryption, and indirect system calls, to evade detection. It also performs anti-VM and geolocation checks to avoid execution in sandboxed environments or unauthorized geographic locations. Once active, TELEPUZ disables security monitoring by unhooking NTDLL, turning off Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW), and removing third-party DllNotification callbacks. The malware's modular design allows it to download additional components, such as keyloggers, stealers, and web injectors, enhancing its capabilities to steal sensitive data and execute arbitrary commands on infected systems. The rapid pace of updates and the steady volume of daily builds uploaded to VirusTotal suggest that TELEPUZ is likely offered under a malware-as-a-service (MaaS) model, posing a significant threat to organizations and individuals alike.
The emergence of TELEPUZ highlights the evolving sophistication of malware campaigns leveraging social engineering techniques like ClickFix. The use of modular malware-as-a-service models enables rapid development and deployment of new threats, making it imperative for organizations to stay vigilant and implement robust security measures to detect and prevent such infections.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Critical n8n Token Exchange Flaw (CVE-2026-59208) Exposes User Accounts
In June 2026, a critical vulnerability (CVE-2026-59208) was identified in n8n's Enterprise instances, specifically affecting configurations that trust multiple external token issuers. The flaw allowed attackers to authenticate as users from different issuers by exploiting the platform's reliance on the 'sub' claim in JSON Web Tokens (JWTs) while ignoring the 'iss' claim. This oversight enabled unauthorized access to user accounts without requiring their passwords. n8n addressed the issue with a patch released on June 24, 2026.
This incident underscores the importance of robust identity verification mechanisms in multi-issuer environments. As organizations increasingly integrate third-party authentication systems, ensuring comprehensive validation of token claims becomes crucial to prevent unauthorized access and potential data breaches.
Medium impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Cato Networks' 2026 Research Highlights the Importance of AI Harnesses in Cybersecurity
In July 2026, Cato Networks conducted research demonstrating the significant impact of integrating Large Language Models (LLMs) with bespoke cybersecurity harnesses. By pairing OpenAI's ChatGPT 5.5 and GPT 5.5-Cyber models with their proprietary tool, Cato Networks achieved complete end-to-end attack chains, including domain administrator privileges and Active Directory access, in as little as 40 minutes. This research underscores the critical role of technical harnesses in guiding LLMs to perform complex cybersecurity tasks autonomously. The findings highlight the necessity for organizations to develop and implement tailored AI harnesses to effectively manage and direct LLMs in cybersecurity operations. As AI-enabled hacking becomes more prevalent, the ability to control and optimize these models through specialized harnesses is essential for maintaining robust security postures.
Low impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
SonicWall SMA1000 Zero-Day Exploitation: CVE-2026-15409 & CVE-2026-15410
In July 2026, SonicWall disclosed two critical zero-day vulnerabilities—CVE-2026-15409 and CVE-2026-15410—affecting its Secure Mobile Access (SMA) 1000 Series appliances. These vulnerabilities, a server-side request forgery (SSRF) and a code injection flaw, were exploited in tandem by attackers to achieve unauthenticated remote code execution. The exploitation began on June 22, 2026, and was primarily aimed at deploying ransomware, though some attacks were thwarted before data exfiltration and encryption occurred. SonicWall promptly released patches and urged customers to update their systems and monitor for indicators of compromise. ([cyberscoop.com](https://cyberscoop.com/sonicwall-zero-day-vulnerabilities-exploited/?utm_source=openai))
This incident underscores the persistent threat posed by zero-day vulnerabilities in critical network infrastructure. The rapid exploitation of these flaws highlights the need for organizations to maintain vigilant patch management practices and implement robust monitoring to detect and respond to such attacks promptly.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Microsoft's July 2026 Patch Tuesday: A Record 570 Security Flaws Fixed
In July 2026, Microsoft released a record-breaking Patch Tuesday update, addressing 570 security vulnerabilities across its software products. This unprecedented volume, nearly triple the previous month's count, includes 59 critical flaws and three zero-day vulnerabilities actively exploited in the wild. Notably, CVE-2026-56155 affects Active Directory Federation Services, and CVE-2026-56164 impacts Microsoft SharePoint, both allowing privilege escalation. Additionally, CVE-2026-50661 is a BitLocker bypass that could grant attackers access to encrypted data if they have physical device access. Microsoft attributes this surge in identified vulnerabilities to advancements in artificial intelligence, which have accelerated the discovery and analysis of security flaws.
This significant increase underscores the evolving cybersecurity landscape, where AI not only aids defenders in identifying vulnerabilities but also empowers attackers to develop exploits more rapidly. Organizations must prioritize timely patch management and adopt proactive security measures to mitigate the risks associated with these newly disclosed vulnerabilities.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Critical 'PromptFiction' Vulnerability in Claude Desktop Exposes AI to Malicious Prompts
In July 2026, a critical vulnerability named 'PromptFiction' was discovered in Anthropic's Claude Desktop application. This flaw allowed attackers to automatically submit malicious prompts to the AI assistant without any user interaction, leveraging a custom URI scheme ('claude://') to execute commands upon clicking a crafted link. Exploiting this, attackers could exfiltrate sensitive user data and potentially execute remote code on the victim's machine. The vulnerability was promptly patched in Claude Desktop version 1.1.2321. This incident underscores the evolving nature of prompt injection attacks, highlighting the need for robust security measures in AI applications to prevent unauthorized access and data breaches.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Urgent: SonicWall SMA1000 Zero-Day Vulnerabilities Under Active Exploitation
In July 2026, SonicWall disclosed two critical zero-day vulnerabilities in its Secure Mobile Access (SMA) 1000 series appliances: CVE-2026-15409 and CVE-2026-15410. CVE-2026-15409 is a server-side request forgery (SSRF) vulnerability allowing unauthenticated attackers to make the appliance send requests to unintended locations. CVE-2026-15410 is a code injection flaw enabling authenticated administrators to execute arbitrary operating system commands. Both vulnerabilities have been actively exploited in the wild, potentially leading to unauthorized access and control over affected systems. SonicWall has released patches to address these issues and urges immediate updates to mitigate risks. ([sonicwall.com](https://www.sonicwall.com/ja-jp/support/notices/product-notice-sma-1000-series-affected-by-multiple-vulnerabilities/kA1VN000001nv6D0AQ?utm_source=openai))
The exploitation of these vulnerabilities underscores a growing trend of attackers targeting remote access solutions to gain initial footholds into organizational networks. This incident highlights the critical importance of promptly applying security patches and maintaining vigilant monitoring of network appliances to prevent unauthorized access and potential data breaches.
Critical impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Security Researcher Releases 'LegacyHive' Windows Zero-Day Exploit Post Patch Tuesday
On July 15, 2026, security researcher Chaotic Eclipse, also known as Nightmare-Eclipse, released a proof-of-concept (PoC) exploit named 'LegacyHive.' This exploit targets a vulnerability in the Windows User Profile Service (ProfSvc), allowing an authenticated attacker to load registry hives associated with other user accounts, potentially leading to privilege escalation. The PoC requires another standard user credential and a third username, which can be an administrator account. If successful, it mounts the target user hive in the current user's classes root. Notably, this vulnerability affects all supported desktop and server versions of Windows, including those running the latest July 2026 Patch Tuesday update.
The release of 'LegacyHive' underscores the ongoing tensions between independent security researchers and major software vendors regarding vulnerability disclosure practices. This incident highlights the critical need for organizations to implement robust privilege escalation defenses and to stay vigilant about applying security updates promptly to mitigate potential exploitation risks.
High impact
Kill Chain
ICInitial Compromise(low)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
