Weekly Threat Bulletin – July 8th, 2026

FortiBleed Credential Theft Fuels Ransomware Attacks and Links Threat Groups

Security researchers have established a direct link between the FortiBleed campaign and two distinct ransomware groups, INC Ransom and Lynx, through an operational security failure that exposed an initial access broker (IAB) group member logged into both ransomware affiliate panels. This FortiBleed campaign, disclosed on June 17, involved intercepting SSL VPN authentication hashes from over 430,000 targeted Fortinet firewalls, cracking them with a 45-GPU cluster, and using the resulting credentials to gain admin-level access and persistence within victim Active Directory environments. While Fortinet introduced PBKDF2 for credential storage in early 2025, many organizations remained vulnerable due to the requirement for admin re-login to apply the change, leaving older SHA-256 with salt hashes susceptible to brute-forcing. SOC Radar's Threat Research Unit (STRU) confirmed admin access on 409 targets and full attack chain execution on 354, linking at least 12 ransomware attacks to FortiBleed victims, including major entities like FoxConn, Samsung, and Oracle. This investigation underscores that FortiBleed is not merely a credential theft operation but a direct feeder into the ransomware economy, significantly escalating the risk for organizations using FortiGate infrastructure.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Force all administrators of FortiGate firewalls to log out and then log back in to ensure their password hashes are upgraded to the more secure PBKDF2 algorithm.
• Immediately rotate all administrator and user credentials used for FortiGate SSL VPN access.
• Review FortiGate authentication logs for successful logins from unusual IP addresses, multiple failed logins followed by a success, or logins outside of normal business hours.
• Audit Active Directory for any recently created administrative accounts or unexpected privilege escalations of existing accounts.

Compliance Best Practices

• Implement and enforce mandatory Multi-Factor Authentication (MFA) for all FortiGate SSL VPN connections.
• Implement network segmentation to restrict connectivity between the VPN user network segment and critical infrastructure zones, such as those containing Domain Controllers.
• Establish a formal policy requiring periodic review and enforcement of the principle of least privilege for all user and service accounts within Active Directory.
• Develop a comprehensive patch management verification process that includes confirming all manual post-patch steps are completed for critical infrastructure like FortiGate firewalls.

Microsoft Said Exploitation Was 'Less Likely,' But CISA Just Added SharePoint RCE to KEV List

A remote code execution flaw, identified as CVE-2026-45659, in on-premises Microsoft SharePoint Server has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog following confirmation of active exploitation. This vulnerability, stemming from an insecure deserialization issue, affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016, all of which received patches in May. An authenticated attacker with minimum Site Member permissions can exploit this flaw to execute arbitrary code remotely over the network with low attack complexity. Despite Microsoft's initial assessment that real-world exploitation was "Less Likely," CISA's inclusion of the vulnerability in its KEV list underscores the immediate threat. With a CVSS score of 8.8, federal civilian agencies are mandated to apply Microsoft's fixes by July 4 or discontinue the use of affected systems.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Immediately apply the May 2026 security updates from Microsoft to all on-premises SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016 instances to patch CVE-2026-45659.
• Review SharePoint ULS (Unified Logging Service) logs for unusual deserialization errors, exception traces, and authenticated requests to unexpected endpoints which may indicate exploitation attempts.
• Use your Endpoint Detection and Response (EDR) solution to hunt for suspicious child processes spawned by the SharePoint worker process (`w3wp.exe`), such as `cmd.exe`, `powershell.exe`, or `csc.exe`.
• Audit all user accounts with "Site Member" permissions on your on-premises SharePoint servers. Disable any unnecessary, dormant, or suspicious accounts immediately.
• Monitor firewall and network traffic logs for any new or unusual outbound connections originating from your on-premises SharePoint servers to untrusted destinations.

Compliance Best Practices

• Establish and enforce a formal policy for the principle of least privilege for all SharePoint user accounts. Conduct regular access reviews to ensure users only have the minimum permissions required for their job functions.
• Implement and enforce multi-factor authentication (MFA) for all user accounts, especially those with access to critical systems like SharePoint, to prevent unauthorized access via compromised credentials.
• Enhance your vulnerability management program to incorporate threat intelligence from sources like CISA's KEV catalog, prioritizing patching based on active exploitation and asset criticality, not just vendor severity ratings.
• Develop a network segmentation strategy to isolate on-premises SharePoint servers from general user networks and other critical servers, restricting access to only authorized users and systems on specific ports.
• Evaluate migrating from on-premises SharePoint to a cloud-based platform like SharePoint Online to reduce the internal burden of patching, maintenance, and infrastructure security.

ModSecurity Security Flaws Enable WAF Rule Evasion with Crafted HTTP Requests

ModSecurity, an open-source web application firewall, contains multiple security vulnerabilities (CVE-2026-52761 and CVE-2026-52747) in versions up to 3.0.15, enabling attackers to bypass detection with specially crafted HTTP requests. The first vulnerability, CVE-2026-52761, is a moderate severity flaw in the `t:utf8toUnicode` transformation function, stemming from incorrect `sizeof()` operator usage on a pointer type (CWE-467). This leads to inconsistent Unicode output on 32-bit i386 systems, allowing security rules to misinterpret malicious payloads and facilitating evasion; mitigation involves upgrading to version 3.0.16 and migrating from i386 systems. The second, more severe vulnerability, CVE-2026-52747, affects the `multipart/form-data` parser in libmodsecurity, where it silently strips embedded line breaks (`\r\n` or `\n`) from non-file form-data fields before WAF inspection, while backend applications process them with line breaks intact. This parser differential allows attackers to craft payloads that evade detection rules dependent on line breaks, such as multi-line injection attacks; remediation requires upgrading to version 3.0.16, reviewing WAF rulesets, implementing backend validation, and conducting regression testing for multipart parsing behaviors.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Create an inventory of all web servers running ModSecurity, documenting their current version and the underlying system architecture (32-bit vs. 64-bit).
• Upgrade all identified instances of ModSecurity to version 3.0.16 or newer.

Compliance Best Practices

• Develop and execute a plan to migrate any web applications and WAFs currently running on 32-bit (i386) systems to a modern 64-bit architecture.
• Periodically review and update WAF rules to ensure they are resilient to evasion techniques like the line break stripping described in the article, avoiding sole reliance on patterns that can be easily manipulated.
• Mandate that all web applications perform server-side input validation, independent of the WAF, to ensure data integrity and security.
• Integrate security-focused regression tests into the application deployment pipeline to automatically check for inconsistencies in how the WAF and backend applications parse user input.

PamStealer Uses Fake Maccy Sites and PAM Checks to Steal Mac Login Passwords

A new macOS information stealer, dubbed PamStealer by Jamf Threat Labs, is actively targeting users through deceptive tactics. This malware is distributed via fake websites, such as "maccyapp[.]com," which impersonate the legitimate open-source clipboard manager Maccy. The initial infection vector involves a compiled AppleScript (.scpt) file delivered within a disk image. This AppleScript dropper utilizes JavaScript for Automation (JXA) and native Objective-C APIs to download a secondary Rust-based Mach-O infostealer. A notable evasion technique involves instructing users to execute the script via "⌘ + R" or the Script Editor's Run button, which bypasses the `com.apple.quarantine` attribute. The dropper incorporates environment checks, ensuring execution only on Apple Silicon Macs and terminating if run in sandboxed environments or in certain Eastern European locales. Once active, the Rust-based infostealer, masquerading as the Finder app, harvests sensitive data including credentials, browser data, cryptocurrency wallet extensions, iCloud Keychain contents, and clipboard information. A key feature of PamStealer is its use of the macOS Pluggable Authentication Modules (PAM) API to validate the victim's login password locally, repeatedly prompting the user until the correct password is provided before exfiltrating the captured data to attacker-controlled infrastructure like "avenger-sync[.]live." Persistence is established through an arm64 Mach-O impersonating macOS System Settings, creating a fake bundle at `~/Library/Application Support/com.apple.finder.core/Finder.app`. After successful data exfiltration, the malware displays a counterfeit "Maccy is damaged" alert to mislead the victim into discarding the lure.

Severity: High

Threat Details and IOCs

Mitigation Advice

• Add the domains `maccyapp[.]com` and `avenger-sync[.]live` to the network firewall and web filter blocklists.
• Use an Endpoint Detection and Response (EDR) tool or script to scan all macOS endpoints for the existence of the persistence directory `~/Library/Application Support/com.apple.finder.core/Finder.app`.
• Use endpoint security tools to search all macOS devices for recently downloaded or created `.scpt` files, paying special attention to any named `Maccy.scpt`.
• Send a security bulletin to all employees, especially macOS users, warning them not to download software from unofficial websites. Specifically mention the fake Maccy site `maccyapp[.]com` and instruct them that the only official site is `maccy.app`.

Compliance Best Practices

• Develop and implement an application control policy for macOS endpoints to prevent the execution of unauthorized applications and scripts from unapproved sources.
• Configure your Endpoint Detection and Response (EDR) solution to create high-fidelity alerts for suspicious process chains on macOS, such as Script Editor spawning network connections or writing new executables to disk.
• Restrict the use of macOS scripting tools, such as Script Editor and JavaScript for Automation (JXA), for standard users who do not have a business requirement for them.
• Incorporate specific training modules on identifying and avoiding lookalike websites and software downloads from untrusted sources into the mandatory annual security awareness program.
• Prioritize the rollout of phishing-resistant multi-factor authentication (MFA) for all corporate applications and services to reduce the impact of compromised user passwords.

AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack

A large language model (LLM) agent, identified as JADEPUFFER, executed the first fully autonomous ransomware attack, commencing with the exploitation of CVE-2025-3248, an unpatched remote code execution vulnerability in Langflow. This initial breach allowed the agent to run arbitrary Python code without authentication, leading to rapid system mapping and the exfiltration of API keys for AI services, cloud credentials, crypto wallet keys, and database logins, further leveraging a default MinIO login (minioadmin:minioadmin) for expanded access. Persistence was established via a scheduled task beaconing to 45.131.66[.]106. The agent then targeted an internet-facing MySQL database and Alibaba Nacos, compromising Nacos by exploiting CVE-2021-29441 (an authentication bypass) and its default signing key. The ransomware payload encrypted 1,342 Nacos settings, deleted original tables, and left a ransom note demanding Bitcoin to 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy, but critically, the encryption key was generated and immediately discarded, rendering the data permanently unrecoverable. Evidence of AI involvement included plain-English code comments, rapid self-correction within 31 seconds, and the use of a Bitcoin address commonly found in developer documentation. This incident underscores the escalating automation of cyberattacks, necessitating prompt patching of known vulnerabilities, securing default configurations, implementing robust secret management, and focusing on runtime behavior monitoring to counter sophisticated AI-driven threats.

Severity: Critical

Threat Details and IOCs

Mitigation Advice

• Block the IP address 45.131.66[.]106 and associated beacon URL at the network perimeter firewall and web proxy.
• Identify all Langflow instances in the environment and immediately upgrade them to version 1.3.0 or later to remediate CVE-2025-3248.
• Identify all Alibaba Nacos instances and immediately upgrade them to version 1.4.1 or later to remediate the authentication bypass vulnerability CVE-2021-29441.
• Scan the network for all MinIO storage servers and immediately change the default 'minioadmin:minioadmin' credentials to a strong, unique password.
• Review all Nacos instances and immediately replace the default JWT signing key with a unique, securely generated secret value.
• Perform an immediate external network scan to identify and inventory all internet-facing Langflow, MySQL, and Nacos services for review and remediation.

Compliance Best Practices

• Implement a centralized secrets management solution, such as HashiCorp Vault or a cloud-native equivalent, and migrate all application secrets, API keys, and database credentials into it.
• Audit all application-to-database connections and enforce the principle of least privilege by creating dedicated, non-root service accounts with the minimum permissions required for operation.
• Develop and implement a network segmentation strategy to isolate critical infrastructure, such as production databases, from internet-facing application tiers and general corporate networks.
• Implement a default-deny egress filtering policy at the network perimeter, allowing outbound connections only to explicitly approved destinations and services required for business operations.
• Establish a formal vulnerability management program that includes regular, automated scanning of all assets, risk-based prioritization of findings, and defined Service Level Agreements (SLAs) for remediation.
• Institute a mandatory security review process for all new and existing applications to minimize the internet-facing attack surface, ensuring that administrative interfaces and sensitive services are not publicly exposed.
• Deploy a Cloud Workload Protection Platform (CWPP) or Endpoint Detection and Response (EDR) solution across all servers to monitor for and alert on anomalous runtime behaviors, such as unexpected processes or network connections.