Cybersecurity Weekly Report: July 6 – 12, 2026

This cybersecurity weekly report lands at an uneasy moment. Patch volumes keep breaking records, and quietly, the ransomware ecosystem is starting to automate itself. The week’s biggest story was the fallout from the FortiBleed credential-theft campaign, now formally tied to two active ransomware crews. Right alongside it: continued exploitation of a Microsoft SharePoint flaw that CISA has already added to its Known Exploited Vulnerabilities catalog. Qilin and DragonForce affiliates, for their part, kept up an aggressive pace of victim disclosures across manufacturing, telecom, and professional services.

Here’s the strategic piece security leaders shouldn’t scroll past: the emergence of “agentic ransomware,” where an AI agent handled the technical execution of a real intrusion from initial access through encryption. Researchers have since added some important caveats, which we cover below, but the direction of travel is clear enough. Emerging risks this week also include a 15-year-old Linux privilege escalation flaw affecting most distributions, several newly disclosed security vulnerabilities in enterprise networking gear, and a wave of Microsoft 365 device-code phishing that slips past traditional password-based defenses.

The business implications are not complicated. Patch cadence, identity hygiene, and OAuth/device-flow governance all need a fresh look before July’s Patch Tuesday lands. And this week’s data breaches are, once again, a reminder that credential hygiene remains the weakest link across most environments not the exotic zero-day, the reused password.

 

MAJOR INCIDENTS

This week’s cyber attacks ranged from credential-theft campaigns to freshly disclosed ransomware families. The resulting data breaches touched manufacturing, telecommunications, agriculture, and construction alike a reminder that “not my industry” stopped being a valid risk assumption years ago.

1. FortiBleed Campaign Formally Linked to INC Ransom and Lynx

Security researchers confirmed a direct operational link between the FortiBleed credential-theft campaign and two ransomware groups, INC Ransom and Lynx. The connection surfaced almost by accident, after an operational security mistake exposed an initial access broker logged into both groups’ affiliate panels at once. The campaign itself was first disclosed in mid-June. It intercepted SSL VPN authentication hashes from more than 430,000 targeted Fortinet firewalls, cracked them using a GPU cluster, and used the resulting credentials to gain administrative persistence inside victim Active Directory environments. SOC Radar’s threat research unit confirmed admin-level access on 409 targets and full attack-chain execution on 354, tying at least a dozen ransomware intrusions back to the campaign. Read more

• Victim: Fortinet firewall customers across multiple sectors
• Sector: Cross-industry, SSL VPN users
• Attack type: Credential theft leading to ransomware
• Impact: Admin-level Active Directory compromise at hundreds of organizations
• Status: Ongoing remediation; many organizations remain exposed because applying Fortinet’s stronger credential hashing requires an admin re-login step many teams have skipped.
• Why This Matters: A patch existing since early 2025 didn’t close this gap. Why? Because the fix required an operational step, not just an update. That’s a pattern security teams keep missing patched doesn’t always mean protected.

2. SharePoint Deserialization Flaw Still Being Actively Exploited

CVE-2026-45659, a deserialization vulnerability in on-premises Microsoft SharePoint Server, remained under active exploitation this week after CISA added it to the Known Exploited Vulnerabilities catalog. The bar for exploitation is low: an authenticated attacker with only “Site Member” permissions can execute arbitrary code on the server. What makes this one sting is the timeline. Microsoft quietly shipped the fix during May’s Patch Tuesday but failed to publish the associated advisory until weeks later, initially rating exploitation as “less likely.” Read more

• Victim: Organizations running SharePoint Server Subscription Edition, 2019, and Enterprise Server 2016
• Sector: Cross-industry, on-premises deployments
• Attack type: Deserialization RCE
• Impact: Full server compromise
• Status: Federal agencies faced a July 4 remediation deadline under CISA directive; private-sector exposure continues.
• Why This Matters: A disclosure failure delayed defender awareness for weeks, giving attackers a head start most organizations never realized they’d lost.

3. Qilin Ransomware Group’s Multi-Victim Wave

Qilin claimed at least three new victims in a single 24-hour window this week: Century Equities, Retelit SpA, and Carolina Agri-Power, all discovered on July 11. This isn’t a one-off. Qilin has been one of the year’s most prolific ransomware operations, and it continues to add victims across manufacturing, telecommunications, and agriculture at a pace that few defenders can match. Read more

• Victim: Century Equities, Retelit SpA, Carolina Agri-Power
• Sector: Financial services, telecommunications, agriculture
• Attack type: Ransomware / double extortion
• Impact: Data exfiltration claims, undisclosed scope
• Status: Under investigation; claims unverified by victims at time of writing.
• Why This Matters: Qilin’s cadence multiple victims disclosed on the same day reflects how industrialized ransomware-as-a-service affiliate operations have become.

4. DragonForce Hits Access Group International

DragonForce claimed responsibility for a ransomware attack on Access Group International, a privately held provider of access equipment, material handling, and power solutions. The intrusion is estimated to have occurred on July 10, with the claim surfacing the following day. Read more

• Victim: Access Group International
• Sector: Construction / equipment hire
• Attack type: Ransomware
• Impact: Undisclosed at time of writing
• Status: Developing.
• Why This Matters: Mid-market industrial and equipment firms remain soft targets. Flat networks, limited segmentation, and thin monitoring budgets make them easy work for affiliates who need volume, not sophistication.

5. GodDamn Ransomware Deploys PoisonX Driver to Blind Defenses

Researchers flagged a new ransomware family this week, GodDamn, that uses a malicious kernel driver called PoisonX to disable endpoint security software before encryption. It’s a Bring Your Own Vulnerable Driver (BYOVD) technique, and it keeps proving effective against modern EDR tools no matter how many times defenders see it coming. Read more

• Victim: Multiple, primarily US organizations
• Sector: Cross-industry
• Attack type: Ransomware with defense evasion via BYOVD
• Impact: Endpoint protection disabled prior to encryption
• Status: Active, newly documented.

NEW VULNERABILITIES & PATCHES

Five security vulnerabilities stood out this week, spanning antivirus engines, collaboration platforms, networking hardware, and the Linux kernel itself. The security updates below range from routine to genuinely urgent, so triage accordingly.

[CVE] CVE-2026-50656 – “RoguePlanet” Microsoft Defender Elevation of Privilege

Vendor: Microsoft | Product: Malware Protection Engine (mpengine.dll) | CVSS: 7.8 | Exploitation status: Publicly disclosed proof-of-concept; patched July 9.
A race condition in Microsoft’s antivirus engine allows an attacker to spawn a SYSTEM-level shell. Researcher Chaotic Eclipse disclosed it weeks before Microsoft shipped a fix.

Technical Impact: Full privilege escalation on any endpoint running an unpatched Defender engine version.

Business Impact: Since Defender typically self-updates, most organizations are protected automatically, but isolated or air-gapped environments need manual verification.

[CVE] CVE-2026-45659 – SharePoint Deserialization RCE

Vendor: Microsoft | Product: SharePoint Server (Subscription Edition, 2019, Enterprise 2016) | CVSS: 8.8 | Exploitation status: Confirmed active exploitation, CISA KEV listed.

Technical Impact: Authenticated Site Member-level users can achieve remote code execution through insecure deserialization.

Business Impact: Any organization running on-premises SharePoint should treat this as a top remediation priority regardless of the delayed advisory timeline.

[CVE] CVE-2026-50746 – UniFi Connect Improper Access Control

Vendor: Ubiquiti | Product: UniFi Connect, Talk, Access, Protect, and UniFi OS | CVSS: 10.0 | Exploitation status: No known exploitation yet; patched July 8.

Technical Impact: Improper access control across the UniFi application suite could allow privilege escalation and arbitrary command execution.

Business Impact: Managed service providers running UniFi across client networks should prioritize this update given the maximum severity score.

[CVE] GhostLock – 15-Year-Old Linux Privilege Escalation Flaw

Vendor: Multiple Linux distribution maintainers | Product: Linux kernel/userland component | CVSS: Not yet formally assigned in reporting | Exploitation status: Newly disclosed, root and container escape possible.

Technical Impact: Enables root access and container breakout across most mainstream Linux distributions.

Business Impact: Any organization running containerized workloads on affected distributions faces a broad blast radius. This one warrants emergency patch scheduling outside the normal cycle.

[CVE] Writer AI Session Token Exposure

Vendor: Writer (AI platform) | Product: Agent preview feature | CVSS: Not disclosed | Exploitation status: Disclosed vulnerability, vendor-patched.

Technical Impact: Session tokens could leak across tenant boundaries in agent preview environments.

Business Impact: Enterprises piloting third-party AI agent tools should review multi-tenant isolation guarantees before granting access to sensitive data.

RANSOMWARE ACTIVITY

Ransomware activity showed no sign of slowing this week. New variants, fresh victims, and a notable law enforcement action all developed in parallel, which is fairly typical of how the week-to-week rhythm has looked for most of 2026.

New Groups and Variants

GodDamn emerged this week as a newly documented ransomware family, notable for its PoisonX BYOVD defense-evasion driver. Separately, researchers continued tracking a rebrand believed to be linked to the now-diminished Beast ransomware lineage.

Significant Victims and Data Leak Activity

Qilin’s leak site activity remained the heaviest of the week, adding Century Equities, Retelit SpA, and Carolina Agri-Power within a single day. DragonForce claimed Access Group International. Both groups continue to run the classic double-extortion playbook: exfiltrate data first, encrypt second, threaten publication third.

Law Enforcement Actions

A former ransomware negotiator was sentenced to 70 months in federal prison for conspiring with the now-defunct BlackCat ransomware operation to extort victims one of the more notable ransomware-adjacent prosecutions of the year. The case is a reminder that liability increasingly extends beyond the operators themselves, reaching intermediaries who facilitate payment negotiations under duress.

Initial Access and RaaS Trends

The FortiBleed-to-INC/Lynx pipeline illustrates how initial access brokers now function as shared infrastructure, feeding multiple ransomware-as-a-service brands simultaneously. It’s a trend that keeps blurring attribution and complicating defender response.

THREAT INTELLIGENCE

The threat intelligence picture this week points to attackers abusing legitimate platforms rather than building custom malware from scratch. It’s a trend every SOC should be building detections around now, not after the next incident.

Active Campaigns

A Microsoft 365 device-code phishing campaign, tracked by researchers as DEBULL, has been targeting enterprises since late June. Instead of a fake password page, it pushes victims toward Microsoft’s legitimate device-login flow which makes it considerably harder for conventional phishing detection to flag.

[TTP] Device code phishing abusing legitimate OAuth/device authorization flows (MITRE ATT&CK T1528 Steal Application Access Token)

Separately, Datadog Security Labs warned of coordinated campaigns using dormant, years-old GitHub “ghost” accounts and compromised OAuth tokens to systematically enumerate corporate GitHub organizations and map developer infrastructure ahead of follow-on attacks.

[TTP] Reconnaissance via legitimate platform APIs (MITRE ATT&CK T1593 – Search Open Websites/Domains)

New Malware

RedWing, a new Android banking-fraud toolkit, is being rented out through Telegram. It lets low-skill criminals take over victims’ phones, harvest banking credentials, and intercept one-time passcodes no real technical skill required on the renter’s part. Separately, a supply-chain compromise of the Injective Labs SDK GitHub repository was used to publish a malicious npm package designed to exfiltrate cryptocurrency wallet keys and seed phrases. The tainted package was published July 8 and has since been deprecated, though release artifacts remained downloadable from GitHub at time of writing.

[IOC] Malicious npm package: @injectivelabs/sdk-ts@1.20.21 and 17 related packages under the @injectivelabs namespace

APT and Threat Actor Evolution

Chinese security firm QiAnXin detailed a threat cluster it assessed as more organizationally sophisticated than its SEO-poisoning tactics might suggest at first glance. The group distributes counterfeit software installers bundled with Gh0st RAT and WinOS (ValleyRAT) trojan variants across Asia. One campaign delivered a previously undocumented modular remote access trojan dubbed MODBEACON, hosted on Amazon and Cloudflare infrastructure and aimed at technology, education, and state-owned enterprise targets.

Significance

Taken together, this week’s threat intelligence shows attackers increasingly abusing legitimate authentication flows and platform trust device codes, GitHub accounts, npm registries rather than building custom malware from scratch. That shift undercuts detection strategies built around known-bad indicators, and it’s worth revisiting whether your detection stack still assumes malware has to look malicious.

INDUSTRY NEWS

This week’s cybersecurity news outside the incident and vulnerability beat centered on regulation and vendor patch cadence.

Regulations

The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) remains on track for finalization in September 2026, according to the federal government’s Unified Agenda. That follows a four-day town hall series in June that drew more than 1,200 critical infrastructure stakeholders. A companion federal contracting rule standardizing cybersecurity requirements across agencies is also expected the same month.

Government Advisories

CISA formally stood up ANCHOR-CI (Alliance of National Councils for Homeland Operational Resilience – Critical Infrastructure), a new advisory framework intended to broaden information-sharing partnerships between government and critical infrastructure operators across sector-specific and regional councils.

Product Announcements

Adobe confirmed it is moving to twice-monthly security releases – one on Patch Tuesday, a second on the fourth Tuesday of each month – citing rising vulnerability discovery volumes that a single monthly cadence can no longer keep pace with.

Why Security Teams Should Care

Regulatory clarity around CIRCIA reporting timelines will directly affect incident response playbooks once finalized. And Adobe’s accelerated release cadence means patch management teams should start planning for more frequent, smaller deployment windows instead of one large monthly push.

TOOL UPDATES

Commercial Tools

Qualys shipped signature-based mitigations covering 94 vulnerabilities from the June Patch Tuesday release, aimed at teams that can’t patch immediately. The idea is straightforward: reduce exposure through its TruRisk Eliminate capability without waiting on a full patch cycle.

Framework and Detection Updates

JetBrains patched critical authentication bypass, account takeover, and remote code execution vulnerabilities spanning its entire IDE lineup  IntelliJ, PyCharm, WebStorm, GoLand, and related products. That makes this a rare instance of a single vendor advisory touching nearly every developer tool in a typical engineering organization’s stack at once.

Practical Use Cases

Security teams managing mixed developer environments should treat the JetBrains advisory as an inventory exercise first. Confirm which IDEs are actually deployed enterprise-wide before assuming a single patch job covers the exposure.

LOOKING AHEAD

The cyber threats security teams should be watching over the next two weeks are largely extensions of what surfaced this week  plus a major patch cycle on the calendar.

Expected Threats

Expect continued opportunistic scanning against unpatched FortiBleed-affected Fortinet devices and SharePoint servers still missing CVE-2026-45659 remediation. Both remain high-value, well-documented entry points, and attackers know it.

Upcoming Advisories and Patch Cycles

Microsoft’s July 2026 Patch Tuesday lands July 14, with analysts forecasting 100–140 CVEs a step down from June’s record 206-vulnerability release, but still above pre-2026 historical norms. July 14 also marks the Kerberos RC4 hardening Phase 2 enforcement deadline, which will affect authentication across domain environments that haven’t completed the transition. Oracle’s next Critical Patch Update follows on July 21.

Threat Monitoring Priorities

The FortiBleed-to-ransomware pipeline remains unresolved. More than 400,000 devices were originally targeted, and confirmed attack chains are still being traced to INC Ransom and Lynx affiliates. This is a developing story  keep watching it, not filing it as closed.

RECOMMENDED ACTIONS

Immediate Actions

Patch CVE-2026-45659 on any on-premises SharePoint deployment, and confirm Fortinet’s stronger credential hashing has actually been applied  not just made available across every FortiGate device in your estate.

Short-Term Actions

Audit GitHub organization access for dormant accounts and stale OAuth tokens, and review whether your phishing detection can actually catch device-code abuse rather than just password-page lookalikes.

Long-Term Actions

Build patch verification, not just patch deployment, into your vulnerability management program. This week’s incidents show that a fix existing on paper and a fix being operationally effective are two very different things.

BY THE NUMBERS

Metric	Figure	Source Context
Fortinet firewalls targeted in FortiBleed campaign	430,000+	SOC Radar / F5 Labs
Targets with confirmed admin-level access	409	SOC Radar Threat Research Unit
Targets with full attack-chain execution confirmed	354	SOC Radar Threat Research Unit
Ransomware attacks tied to FortiBleed	12+	F5 Labs weekly bulletin
June 2026 Patch Tuesday CVE count (context)	206	Multiple vendor advisories
July 2026 Patch Tuesday forecast	100–140 (estimate)	Industry analyst forecasts, unconfirmed until July 14
Ransomware negotiator prison sentence	70 months	US federal sentencing
UniFi Connect flaw severity	CVSS 10.0	Ubiquiti advisory

Figures for the July 14 Patch Tuesday release remain forecasts as of this report’s publication; verified totals will be confirmed after the release.

CYBERINFOS TAKEAWAY

This week’s most important lesson isn’t a single CVE or a single breach – it’s that “patched” and “protected” are no longer synonyms. FortiBleed’s fix existed for over a year before it stopped an attack. SharePoint’s fix shipped before its advisory did. And BYOVD techniques keep proving that a fully patched endpoint can still be blinded by a malicious driver. Verification, not just deployment, needs to become the standard security teams hold themselves to.

This cybersecurity weekly report was compiled from official vendor advisories, government alerts, and credible security research published during the reporting period. If you found this cybersecurity weekly report useful, CyberInfos.in will continue tracking developing stories, including the FortiBleed ransomware pipeline and July’s Patch Tuesday release, in next week’s cybersecurity weekly report.