This Cybersecurity weekly report covers a week where the real risk sat at the perimeter, not on the endpoint. Credential abuse was the theme that tied everything together. Researchers formally linked the FortiBleed campaign against Fortinet firewalls to two active ransomware operations, while Google and the FBI dismantled the NetNut residential proxy botnet that criminal groups had been renting to hide their password-spraying attacks.
A new Microsoft SharePoint deserialization flaw landed in the CISA Known Exploited Vulnerabilities catalog with a two-day patch window. And law enforcement notched a genuine win: the extradition of an alleged Scattered Spider member to face federal charges.
Here’s the pattern worth sitting with. Attackers don’t need a fresh zero-day when a valid, reused credential does the same job with far less noise. That shows up in three different places this week FortiGate firewalls, SimpleHelp remote management software, and SharePoint servers were all exploited not through exotic tradecraft, but through gaps most security teams already knew existed.
For CISOs, the takeaway is blunt: credential hygiene, MFA enforcement, and patch velocity on internet-facing systems now carry as much weight as any single piece of security tooling. That’s the thread running through this week’s cybersecurity news and threat intelligence, and it’s worth carrying into planning for the second half of 2026.
MAJOR INCIDENTS
1. FortiBleed Credential Campaign Formally Linked to Ransomware Operations
- Victim: Global – organizations running internet-facing Fortinet FortiGate firewalls and SSL-VPN gateways
- Sector: Cross-sector, with concentration in telecommunications, government, energy, and financial services
- Attack type: Mass credential harvesting via configuration-file exfiltration and offline hash cracking
- Impact: Verified working credentials for more than 86,000 FortiGate devices across 194 countries
- Current status: Active and ongoing
SOCRadar confirmed this week what many analysts suspected: an operator with access to FortiBleed’s infrastructure was logged into negotiation panels for both the INC Ransom and Lynx ransomware-as-a-service operations. That’s not a coincidence. It’s direct evidence tying a mass credential-harvesting campaign to real extortion. Scanning activity hit roughly 11,250 FortiGate portals in more than 150 countries.
Confirmed admin-level access followed on 409 targets, and a completed attack chain on 354 of them resulting in at least 12 ransomware deployments. Investigators are also chasing a possible zero-day in the Nextcloud collaboration platform, which turned up in some of these intrusions, alongside a Golang-based traffic-sniffing tool installed on thousands of Fortinet devices.
Why This Matters: This isn’t a story about a new product flaw. It’s a story about credential reuse producing full network compromise anyway. Any organization with internet-exposed FortiGate management interfaces should treat its environment as potentially compromised until credentials are rotated and MFA is enforced full stop. READ MORE
2. Google and FBI Dismantle NetNut Residential Proxy Network
- Victim: Approximately 2 million compromised home devices worldwide (smart TVs, streaming boxes, routers); indirectly, every organization targeted through NetNut-obscured attacks
- Sector: Cross-sector the botnet was rented out to cybercriminal and espionage groups
- Attack type: Residential proxy botnet used to mask password-spraying and credential-stuffing campaigns
- Impact: Millions of devices removed from the attacker-controlled pool; hundreds of domains seized
- Current status: Disrupted, not eliminated
On July 2, Google’s Threat Intelligence Group working with the FBI, the IRS Criminal Investigation division, Lumen, and the Shadowserver Foundation disrupted NetNut, also tracked as the Popa botnet. The network traces back to publicly traded Israeli firm Alarum Technologies and had grown past 2 million hijacked devices.
In a single week in June, 316 distinct threat clusters used it to run password-spray attacks and disguise their access to victim environments. Google’s response was layered: disable the accounts NetNut used for command and control, flag its SDK in Play Protect, and share technical intelligence with platform providers and law enforcement.
Why This Matters: Residential proxy networks matter because they make malicious traffic look like ordinary home browsing that’s the whole business model. Security teams leaning on geolocation or IP-reputation filtering to catch these cyber attacks should reassess that control now that a major supplier has been degraded. Expect adversaries to migrate to alternative proxy providers fairly quickly. READ MORE
3. Alleged Scattered Spider Member Extradited to Face U.S. Charges
- Victim: Multiple prior corporate targets, including an unnamed luxury jewelry retailer that faced an $8 million ransom demand
- Sector: Retail, gaming, hospitality, and technology (historical victim list)
- Attack type: Social engineering, help-desk impersonation, MFA fatigue
- Impact: Group has been tied to over 100 network intrusions and more than $100 million in ransom payments
- Current status: Defendant in custody, case ongoing
The Department of Justice announced on July 1 that 19-year-old Peter Stokes, a dual U.S.-Estonian citizen, was extradited from Finland to face conspiracy, computer intrusion, and fraud charges tied to his alleged membership in Scattered Spider. He was arrested in April under an Interpol Red Notice. Prosecutors say he’s connected to at least four intrusions, including the 2025 breach of a jewelry retailer where attackers used spoofed help-desk calls and the tunneling tool ngrok to hold onto access.
Why This Matters: This is the latest in a growing list of Scattered Spider prosecutions, following recent guilty pleas from UK members Thalha Jubair and Owen Flowers. Social engineering, not just exploit-driven cyber attacks, is clearly on law enforcement’s radar now a useful, concrete example for any security-awareness program that needs to show real consequences actually happen. READ MORE
4. Fake Interpol Ransomware Campaign Targets Small Businesses Globally
- Victim: Small and midsize businesses across the US, Europe, Asia, and the Middle East
- Sector: Pharmaceuticals, food and agriculture, legal services, media, and technology
- Attack type: Phishing-led ransomware delivery disguised as a law-enforcement investigation notice
- Impact: Custom-built ransomware payload delivered via password-protected Proton Drive archives
- Current status: Active
Bitdefender’s Antispam Lab flagged a campaign this week that impersonates Interpol’s cybercrime unit. The email tells recipients their company is under investigation and urges them to download “evidence” which is, of course, ransomware disguised as a video file. Unlike the big ransomware-as-a-service operations, this one skips the dark-web negotiation portal entirely. Victims are told to reach the attacker directly through Tox, with ransom amounts negotiated one victim at a time.
Why This Matters: Unsophisticated, custom-built ransomware paired with convincing social engineering is apparently all it takes to disrupt a small business now. CrowdStrike’s SMB research backs that up: 29% of companies with fewer than 25 employees have already been hit by ransomware, even though most of them still see themselves as too small to be worth targeting. READ MORE
5. Ongoing Wave of Ransomware Data-Leak Disclosures Continues Into July
- Victim: Dozens of organizations across manufacturing, healthcare, logistics, government, and SaaS
- Sector: Cross-sector, global
- Attack type: Double-extortion ransomware and data-leak site postings
- Impact: Victims listed by groups including INC Ransom, Anubis, Bashe, WorldLeaks, Qilin, and SafePay
- Current status: Ongoing, new victims posted daily
Breach-tracking services logged dozens of new victims on ransomware leak sites in the first few days of July logistics firms, municipal governments, healthcare staffing agencies, SaaS platforms, spread across multiple continents. INC Ransom and Anubis were especially active, which lines up with the FortiBleed-linked activity described above.
Why This Matters: No single headline-grabbing breach drove this. It was the steady drumbeat of leak-site postings that mattered and it’s exactly why ransomware activity remains the most consistent driver of incident-response workload for SOC teams. Prevention at the initial-access stage still matters more than any single detection control. READ MORE
ANALYST INSIGHT : Look across this week’s incidents and one pattern jumps out: initial access increasingly comes from valid, stolen, or reused credentials rather than novel exploitation. FortiBleed, the NetNut proxy takedown, and the continuing SMB ransomware wave are three different flavors of the same underlying problem identity and credential hygiene at the network edge. Software vulnerabilities still matter, sure. But the biggest exposure this week was organizational, not technical.
NEW VULNERABILITIES & PATCHES
[CVE] CVE-2026-45659 – Microsoft SharePoint Server Deserialization RCE Vendor: Microsoft | Product: SharePoint Server | CVSS: Not yet finalized (High) | Exploitation status: Actively exploited, added to CISA KEV July 1
Microsoft actually patched this deserialization-of-untrusted-data flaw back in the May 2026 release cycle. It just didn’t publish the advisory until May 21 weeks after the fix had already shipped. CISA has now confirmed active exploitation and set a July 4 remediation deadline for federal agencies. An attacker only needs baseline “Site Member” permissions to trigger remote code execution, which is a low bar in most enterprise SharePoint deployments.
Technical Impact: Full server compromise via deserialization, opening the door to lateral movement into connected Microsoft 365 and on-premises environments. Business Impact: SharePoint often holds sensitive corporate documents and functions as an identity-trust anchor for internal collaboration. Compromise here tends to cascade.
[CVE] CVE-2026-48558 – SimpleHelp RMM Authentication Bypass Vendor: SimpleHelp | Product: Remote Monitoring and Management software | CVSS: 10.0 | Exploitation status: Actively exploited, CISA KEV deadline July 2
This OIDC authentication-bypass flaw lets a remote, unauthenticated attacker submit a forged identity token and land a fully authenticated technician session in some configurations, bypassing MFA entirely. SimpleHelp is used by managed service providers, so exploiting one instance can cascade into every downstream customer network at once. Threat actors have been seen deploying the TaskWeaver loader right after exploitation.
Technical Impact: Full remote administrative access to endpoints managed through the compromised RMM instance. Business Impact: This is textbook MSP supply-chain risk. One exploited RMM platform, dozens or hundreds of customer environments exposed.
[CVE] CVE-2026-35616 – Fortinet FortiClient EMS Vulnerability Vendor: Fortinet | Product: FortiClient Enterprise Management Server | CVSS: 9.1 | Exploitation status: Actively exploited
eSentire observed this one being exploited this week to deploy an information-stealer called EKZ Stealer against an energy-sector customer. The malware harvests saved credentials from Chromium-based browsers and Firefox, then exfiltrates the data via PowerShell.
Technical Impact: Credential theft from endpoint browsers, feeding straight into follow-on account-takeover attacks. Business Impact: For energy, utilities, and other critical-infrastructure operators, credential theft from management endpoints is a direct path toward operational technology exposure.
[CVE] CVE-2026-33825 – Windows Defender “BlueHammer” Privilege Escalation Vendor: Microsoft | Product: Windows Defender | CVSS: High (formal score pending) | Exploitation status: Confirmed used in active ransomware campaigns
CISA confirmed this week that a privilege-escalation flaw in Microsoft’s built-in antivirus engine publicly nicknamed BlueHammer is being used in live ransomware intrusions. Defender runs with SYSTEM-level privileges on nearly every Windows endpoint, so successful exploitation effectively hands attackers full control of the machine.
Technical Impact: Local privilege escalation to SYSTEM, undermining the very tool meant to catch the intrusion in the first place. Business Impact: A compromised security control is close to a worst-case scenario for detection engineering. Assume reduced visibility on any endpoint suspected of exploitation.
[CVE] Adobe ColdFusion – Six Critical CVSS 10.0 Flaws Vendor: Adobe | Product: ColdFusion 2025 and 2023 | CVSS: 10.0 (six of eleven patched flaws) | Exploitation status: No confirmed in-the-wild exploitation yet; patch urgently recommended
Adobe shipped fixes for eleven critical ColdFusion vulnerabilities this week, six of them carrying the maximum CVSS 10.0 score and enabling unauthenticated arbitrary code execution. Sixteen previous ColdFusion CVEs already sit in the CISA KEV catalog, so Adobe assigned its highest priority rating and recommended patching within 72 hours not a suggestion worth ignoring given the platform’s track record.
Technical Impact: Unauthenticated remote code execution on ColdFusion application servers. Business Impact: Given ColdFusion’s exploitation history, rapid weaponization is likely. Government and financial-services deployments should treat this as an emergency patch cycle, not a routine one.
PRIORITY ACTION : Patch or isolate internet-facing SharePoint, SimpleHelp, and ColdFusion instances this week. Rotate every Fortinet administrative and VPN credential, whether or not you’ve confirmed FortiBleed exposure. Credential rotation plus MFA enforcement closes more of this week’s attack paths than any single patch will.
RANSOMWARE ACTIVITY
New Groups and Variants: No brand-new ransomware family surfaced this week. But “The Gentlemen” kept expanding its footprint, and researchers noted INC Ransom’s continued dominance following the collapse of ALPHV/BlackCat and LockBit. INC has now claimed more than 800 victims since 2023 a number that keeps climbing.
Significant Victims: Breach-tracking services recorded dozens of newly disclosed victims in the first days of July across logistics, healthcare, government, and SaaS. INC Ransom, Anubis, Bashe, and WorldLeaks were the most active data-leak-site operators.
Data Leak Activity: Postings continued at a steady daily pace, consistent with the FortiBleed-enabled access described earlier. A single mass credential-harvesting campaign can clearly feed multiple ransomware operations at once, and that’s exactly what appears to be happening.
Law Enforcement Actions: The extradition of an alleged Scattered Spider member, plus continued prosecutions of UK-based members Jubair and Flowers, shows sustained international pressure on ransomware-adjacent extortion crews. Even so, new, simpler operators like the fake-Interpol SMB campaign are already filling the gap left behind by disrupted major players.
Double extortion remains the default model here: data theft paired with encryption, maximizing leverage on both fronts. Initial access keeps trending toward credential abuse (FortiBleed, residential proxies) and help-desk social engineering (Scattered Spider), rather than pure software exploitation. That pattern should shape where security teams put their detection budget for the rest of 2026.
THREAT INTELLIGENCE
Active Campaigns: FortiBleed remains the week’s dominant campaign, now formally linked to ransomware deployment. Researchers also found a parallel Golang-based traffic sniffer installed on thousands of FortiGate devices [TTP] passive credential collection at the network perimeter, consistent with MITRE ATT&CK T1557 (Adversary-in-the-Middle).
New Malware: EKZ Stealer, deployed via CVE-2026-35616 in FortiClient EMS, targets browser-stored credentials in Chromium and Firefox before exfiltrating data via PowerShell [TTP] mapping to MITRE ATT&CK T1555.003 (Credentials from Web Browsers) and T1059.001 (PowerShell).
APT Activity: Fortinet perimeter devices remain a favorite target for state-associated actors. Researchers noted overlap between FortiBleed post-exploitation tooling the Chisel and Neo-reGeorg tunneling utilities and techniques previously seen in the Volt Typhoon campaign, though attribution for this specific activity is still under investigation.
Threat Actor Evolution: The NetNut disruption is a good reminder of how commercial residential-proxy providers have quietly become foundational infrastructure for both cybercriminal and espionage-linked threat clusters. [IOC] indicators tied to suspected NetNut/Popa exit nodes are now being shared by Google’s Threat Intelligence Group with industry partners.
Put it all together and a bigger picture emerges: threat actors are consolidating around shared infrastructure proxy networks, RMM platforms, edge-device credentials instead of building bespoke tooling for every single operation. That’s actually good news for defenders in one narrow sense. A single disruption, like the NetNut takedown, can meaningfully degrade multiple unrelated cyber attacks at once.
INDUSTRY NEWS
Regulations and Government Advisories: CISA’s KEV catalog additions this week SharePoint and SimpleHelp each carry BOD 26-04 remediation deadlines for federal agencies, reinforcing the binding directive’s role in prioritizing government patch cycles. Separately, the U.S. House Rules Committee cleared cyber-incident-reporting and AI provisions in the fiscal 2027 NDAA for floor consideration, though a critical infrastructure cyber grant program didn’t make the cut this round.
Acquisitions: Accenture’s previously announced majority-stake acquisition of Dragos alongside full acquisitions of runZero and NetRise, a combined $4.175 billion OT cybersecurity push kept generating industry commentary this week. Analysts framed it alongside Mitsubishi Electric’s earlier acquisition of Nozomi Networks as evidence that consolidation in operational technology security is accelerating.
Supply Chain Disclosures: Salesforce disabled its Klue app integration this week after OAuth token abuse was found exposing customer data across multiple downstream companies, including previously reported exposure at HackerOne and LastPass tied to the same supply-chain incident.
Research Reports: Intel 471 data cited this week shows extortion-related cyber attacks rose roughly 63% year-over-year, to 6,800 incidents. Consulting firms and manufacturers were most frequently posted to ransomware leak sites which reinforces supply-chain compromise as the growth vector security teams should be watching most closely right now.
Why should security teams care about any of this? Because it shapes both the regulatory patch-prioritization landscape, through CISA’s binding directives, and the vendor ecosystem CISOs will lean on for OT and identity security investment decisions over the next year.
TOOL UPDATES
Open Source: Researchers continue refining detection content for FortiGate credential-harvesting indicators. Shadowserver has been publishing scan data on exposed FortiOS management interfaces, giving network defenders something concrete to cross-reference against internal asset inventories.
Commercial Tools: Google Play Protect now automatically flags and disables Android applications carrying the NetNut proxy SDK an immediate detection and remediation path for consumer and BYOD devices that may be unknowingly enrolled in the botnet.
Detection Content: Bitsight and SOCRadar both published updated indicators tied to FortiBleed infrastructure this week, including credential-dataset fingerprints organized by sector and revenue band. Useful inputs if you’re feeding a threat-intelligence platform tracking third-party exposure.
Framework Updates: MITRE ATT&CK references worth prioritizing given this week’s activity: T1557 (Adversary-in-the-Middle), T1555.003 (Credentials from Web Browsers), and T1078 (Valid Accounts).
Here’s the practical takeaway: teams without automated FortiGate configuration-backup credential rotation should treat this as a near-term detection-engineering priority. Manual rotation at scale was the most common gap researchers cited in FortiBleed remediation efforts and it’s the kind of gap that’s easy to overlook until it isn’t.
LOOKING AHEAD
Expected Threats: Expect continued downstream ransomware activity as buyers work through the FortiBleed credential dataset before organizations finish rotating. Researchers explicitly flagged this as a multi-month risk window, not something that ends when this reporting period does.
Upcoming Advisories: Watch for a possible CVE tied to the suspected Nextcloud zero-day referenced in FortiBleed reporting. Researchers are still coordinating with the vendor on that one.
Patch Cycles: The SimpleHelp KEV deadline (July 2) and the SharePoint KEV deadline (July 4) both landed this week. Expect a compliance scramble among MSPs and federal contractors racing to meet BOD 26-04 timelines.
Threat Monitoring Priorities: FortiGate credential rotation, SharePoint patching, and Adobe ColdFusion remediation should top the list heading into next week.
[WATCH] The open question carrying into next week is the scope of that suspected Nextcloud zero-day tied to FortiBleed post-exploitation activity. No CVE has been assigned yet, and vendor coordination is still described as ongoing. If you’re running Nextcloud alongside FortiGate infrastructure, keep a close eye on vendor channels for a forthcoming advisory.
BY THE NUMBERS
| Metric | Figure | Source |
|---|---|---|
| FortiGate devices with verified working credentials exposed | 86,644+ across 194 countries | SOCRadar / Bitsight |
| Confirmed ransomware deployments tied to FortiBleed access | At least 12 | SOCRadar |
| Devices disrupted in NetNut/Popa proxy takedown | 2 million+ | Google Threat Intelligence Group |
| Distinct threat clusters using NetNut exit nodes (one week in June) | 316 | Google GTIG |
| Ransom payments attributed to Scattered Spider historically | $100 million+ | U.S. Department of Justice |
| Increase in extortion-related cyber attacks, year-over-year | ~63% (6,800 incidents) | Intel 471 |
| SMBs with fewer than 25 employees hit by ransomware | 29% | CrowdStrike State of SMB Cybersecurity Survey |
| Critical Adobe ColdFusion flaws patched this week | 11 (6 at CVSS 10.0) | Adobe Security Bulletin |
Verified public data unavailable at reporting time for total ransom payments collected during this specific reporting window; figures above reflect the most recent verified statistics tied to this week’s incidents.
CYBERINFOS TAKEAWAY : Here’s the lesson for security leaders this week, and it’s an easy one to underinvest in: the biggest cyber attacks didn’t start with a brand-new exploit. They started with credentials, sessions, and proxies that already existed. FortiBleed, the NetNut botnet, a fake Interpol email aimed at a small business different targets, same root cause. Initial access rode on identity, not innovation. Prioritize credential rotation and MFA enforcement on internet-facing systems this week. It will close more doors than any single patch.
This Cybersecurity weekly report is produced by CyberInfos.in for SOC analysts, security engineers, CISOs, and IT leaders tracking cybersecurity news, threat intelligence, ransomware activity, security vulnerabilities, cyber attacks, security updates, cyber threats, and data breaches shaping the global threat landscape.
