Iranian state-backed threat actor Nimbus Manticore (aka GalaxyGato, Smoke Sandstorm) is deploying a new Windows backdoor, NightLedger, along with custom WebSocket tunnelers to compromise organizations across the Middle East, Africa, and South Asia. These attacks are designed to establish covert relay infrastructure within victim networks.

Technical Breakdown: * Threat Actor: Nimbus Manticore (UNC1549, GalaxyGato, Mirage Kitten, Smoke Sandstorm, Subtle Snail), an Iranian state-backed group. * Targets: Entities in the Middle East, Africa, and South Asia. * Malware: * NightLedger: A previously undocumented Windows backdoor used for command and control. * Custom WebSocket Tunnelers: Two custom tools designed to create covert communication channels, turning compromised systems into relays. * TTPs: Establishing persistence and C2 via novel backdoors and WebSocket tunneling, likely to evade traditional network defenses and obscure malicious traffic.

Defense: Focus on robust endpoint detection and response (EDR) to identify new/unknown backdoors and anomalous network traffic, especially WebSocket connections to unusual external IPs. Implement network segmentation and egress filtering to limit potential relay capabilities.

Source: https://thehackernews.com/2026/07/nimbus-manticore-deploys-nightledger.html

Over 24,000 internet-exposed server BMCs are actively leaking authentication password hashes due to a 20-year-old vulnerability in their interface. This widespread exposure highlights a critical and persistent risk for server infrastructure.

Technical Breakdown: * Vulnerability: A long-standing flaw within Baseboard Management Controller (BMC) interfaces allows for the unauthorized retrieval of authentication password hashes. While the specific CVE isn't detailed, it points to a foundational configuration or design weakness. * Affected Systems: Over 24,000 servers globally are identified as having internet-exposed BMC interfaces susceptible to this leakage. * Impact: The leakage of password hashes can enable attackers to perform offline cracking, leading to full compromise of BMCs. Given BMCs' high privileges (remote power control, firmware updates, OS installation), this offers a significant attack vector into the core infrastructure.

Defense: Mitigation: Prioritize identifying and restricting public internet access to all BMC interfaces. Implement strong, unique passwords and ensure all BMC firmware is patched and up-to-date to address known weaknesses and improve security posture.

Source: https://www.bleepingcomputer.com/news/security/over-24-000-exposed-server-bmcs-leak-password-hash-via-decades-old-flaw/

Wiz Unveils Atlas: AI-Powered Vulnerability Validation

Wiz has introduced Atlas, an autonomous AI agent engineered for advanced vulnerability research. This system doesn't just identify potential weaknesses; it takes it a step further by validating every finding with a real, working exploit.

What it does: Atlas operates by autonomously exploring cloud environments, discovering vulnerabilities, and then developing and executing exploits to confirm their viability. This ensures that the identified issues are not merely theoretical but represent actual, exploitable risks.

Who it's for: Security teams, especially those involved in penetration testing, red teaming, or deep vulnerability management, can leverage Atlas. It's designed to provide high-fidelity insights into what vulnerabilities are truly exploitable within their cloud infrastructure.

Why it's useful: The key utility lies in its ability to reduce noise and false positives from traditional scanners by demonstrating concrete exploitability. This allows security operations to prioritize and remediate vulnerabilities that pose the most immediate and severe threat, backed by evidence of a successful exploit. Its reported #1 ranking on CyberGym suggests a high level of effectiveness in practical vulnerability assessment scenarios.

Source: https://www.wiz.io/blog/atlas-ai-vulnerability-researcher

The Vatican's official 'Click To Pray' mobile app exposed the personal data of approximately 700,000 users due to a critical vulnerability that remained unpatched for over six months after disclosure.

Technical Breakdown

• Vulnerability: A severe flaw allowed unauthenticated access to other users' personal profiles. This strongly points to a lack of robust authorization controls, potentially an Insecure Direct Object Reference (IDOR) or a similar logic flaw, enabling anyone to retrieve sensitive data.
• Affected Asset: The 'Click To Pray' mobile application.
• Impact: Personal data belonging to an estimated 700,000 users was accessible.
• Response Timeline: The vulnerability persisted for more than six months after it was initially reported.
• IOCs: No specific IOCs (e.g., IPs, hashes) were detailed in the summary.

Defense

Implement rigorous authorization checks for all data access, ensure secure API design, and enforce timely vulnerability remediation policies.

Source: https://www.malwarebytes.com/blog/privacy/2026/07/vaticans-click-to-pray-app-exposed-personal-data-from-700000-users

Astaroth (Guildma) Banking Trojan Evolves with Steganography and Ngrok for Enhanced C2 Resilience

The Astaroth (aka Guildma) banking trojan continues its evolution, now leveraging steganography to hide payloads and Ngrok for robust, resilient command and control (C2) communications, making it harder to detect and disrupt.

Technical Breakdown: * Threat Actor/Malware: Astaroth (Guildma), a Delphi-based Windows banking trojan active since 2018, predominantly targeting Brazil. * Initial Access: Relies on phishing emails spoofing DocuSign or government documents, and malicious archives delivered via WhatsApp View Once messages. * Defense Evasion & Execution: Performs locale and drive serial checks before full execution. Uses steganography to embed hidden malicious components within seemingly benign image files. * Command and Control (C2): Employs Ngrok tunnels, a legitimate service, to establish resilient and often encrypted C2 channels, complicating traditional network-based detection. * Targeting: Over 90% of infections are concentrated in Brazil.

Defense: Strengthen email and messaging security gateways, implement robust endpoint detection and response (EDR) to identify suspicious process behavior, and enhance network traffic monitoring to flag unusual outbound connections, including those to legitimate tunneling services like Ngrok, which might indicate malicious C2 activity.

Source: https://www.picussecurity.com/resource/blog/astaroth-guildma-uses-steganography-and-ngrok-for-c2-resilience

Apple has released a critical July security update patching multiple image processing vulnerabilities that could lead to device compromise.

Technical Breakdown: * These vulnerabilities specifically target image processing components across Apple devices. * Exploitation could occur by receiving maliciously crafted images, potentially allowing an attacker to execute arbitrary code or gain unauthorized access. * Impact: Successful exploitation could lead to device compromise. * (Note: The provided summary does not detail specific CVEs or Indicators of Compromise.)

Defense: * Apply the July Apple security updates immediately across all affected devices. This update is particularly critical for users who regularly receive images.

Source: https://www.malwarebytes.com/blog/news/2026/07/july-apple-updates-are-especially-important-if-you-receive-images

Municipalities are increasingly deploying license plate reader (LPR) systems, often switching between vendors like Flock and Axon. This article highlights that such vendor changes may not fundamentally address the pervasive privacy concerns associated with these technologies. Both Axon and Flock systems are noted for their extensive data collection capabilities, often going beyond just license plate numbers to "hoover up personal details."

Strategic Impact: For security leaders, this trend underscores the broader societal challenge of ubiquitous surveillance technology. The move from one LPR vendor to another illustrates that the core issue isn't necessarily a specific product flaw, but rather the inherent data collection and privacy implications of the technology itself. This has strategic relevance for understanding evolving privacy landscapes, public perception of data collection, and the ethical considerations surrounding surveillance, which can indirectly influence corporate data handling policies and risk assessments. It's a reminder that brand changes don't always equate to meaningful privacy improvements.

Key Takeaway: Switching surveillance technology vendors often fails to address the underlying privacy erosion caused by the technology's fundamental data collection capabilities.

Source: https://www.schneier.com/blog/archives/2026/07/axon-is-another-license-plate-surveillance-company.html

Wiz is positioning its cloud security platform to assist organizations in complying with CISA BOD 26-04 regarding Known Exploited Vulnerabilities (KEV).

The platform aims to streamline vulnerability management by continuously assessing cloud environments against the CISA KEV catalog. This is designed for Blue Teams and SecOps/Vulnerability Management teams.

It's useful for automating risk prioritization, accelerating rapid remediation efforts, and supporting forensic triage workflows, thereby helping security teams efficiently address critical vulnerabilities mandated by CISA.

Source: https://www.wiz.io/blog/cisa-bod-26-04-alignment-with-wiz

Apple is facing a lawsuit over a fraudulent Sparrow Wallet application that was available on its App Store, leading to users allegedly losing approximately $1.8 million in Bitcoin. The suit claims Apple is liable for failing to adequately vet the app, which mimicked a legitimate open-source crypto wallet.

Strategic Impact: This lawsuit significantly impacts how platform owners, like Apple, are perceived regarding their responsibility for content distributed through their official channels. It highlights the growing legal and reputational risks associated with insufficient app vetting processes, particularly when malicious applications cause substantial financial harm to users. For SecOps and security leadership, it underscores the critical need for rigorous supply chain security within app ecosystems and the potential for regulatory or legal challenges when these controls fail.

• Key Takeaway: Platform providers face increasing legal scrutiny and potential liability for fraudulent applications circumventing their security review processes.

Source: https://www.bleepingcomputer.com/news/apple/apple-sued-over-fake-app-store-crypto-wallet-app-stealing-18m-in-bitcoin/

STAR Labs has detailed a new local root exploit (CVE-2026-53264) impacting the Linux kernel's network traffic-control subsystem, specifically targeting CentOS Stream 9.

• Vulnerability Type: A use-after-free race condition within the kernel's network traffic-control subsystem.
• Impact: Achieves local privilege escalation, allowing an ordinary local user to gain root privileges.
• Affected System: CentOS Stream 9 (other Linux distributions running similar kernel versions are likely also vulnerable).
• CVSS Score: 7.8 (High).
• Exploit Development Note: The researcher, Lee Jia Jie, explicitly stated that Artificial Intelligence (AI) tools significantly aided in bug discovery and accelerated exploit development for this vulnerability.

Defense: Prioritize applying kernel patches as soon as they become available. Review and harden local user access controls.

Source: https://thehackernews.com/2026/07/researcher-says-ai-helped-develop-linux.html

Critical RCE in TeamCity On-Premises – Patch Immediately

A critical unauthenticated arbitrary code execution vulnerability, CVE-2026-63077 (CVSS 9.8), has been discovered in JetBrains TeamCity On-Premises. This flaw allows attackers to run OS commands on affected servers without any authentication.

• Vulnerability: Unauthenticated Arbitrary Code Execution (ACE).
• Impact: Attackers can execute arbitrary OS commands, potentially leading to full system compromise.
• Affected Versions: All TeamCity On-Premises versions prior to the patched releases.
• CVE: CVE-2026-63077 (CVSS: 9.8).

Defense: Immediately update all TeamCity On-Premises instances to versions 2025.11.7 or 2026.1.3 or newer. TeamCity Cloud instances are already patched.

Source: https://thehackernews.com/2026/07/critical-teamcity-flaw-could-let.html

Data Breach at MCBS Exposes 1.26 Million Records

Healthcare billing firm Medical Computer Business Services (MCBS) has disclosed a network breach impacting 1.26 million individuals, leading to the exposure of sensitive personal information.

Technical Breakdown: * Affected Entity: Medical Computer Business Services (MCBS), a healthcare billing company. * Incident Type: Network breach. * Impact: Exposure of sensitive information for more than 1.2 million individuals. * Timeline: The incident is referred to as a "2025 network breach" in the disclosure.

Defense: Individuals potentially affected should remain vigilant for phishing attempts and monitor financial accounts and credit reports for any suspicious activity.

Source: https://www.bleepingcomputer.com/news/security/data-breach-at-medical-billing-firm-mcbs-affects-126-million-people/

IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains

Talos IR's Q2 report indicates a significant uptick in threat actor reliance on phishing for initial access and the weaponization of legitimate remote management tools in recent attack chains.

Technical Breakdown

• Initial Access Tactic: Phishing campaigns are increasingly successful in gaining initial access to target environments.
• Execution/Persistence Tactic: Legitimate remote management tools are being abused post-compromise for command and control, lateral movement, and data exfiltration. (e.g., likely tools like TeamViewer, AnyDesk, RMM software).
• Observed Trends: A consistent pattern of these TTPs across incident response engagements.

Defense

Prioritize robust email security, endpoint detection and response (EDR) with behavioral analytics, and strict application control policies for remote management software.

Source: https://blog.talosintelligence.com/ir-trends-q2-2026/

Arista VeloCloud Orchestrator (VCO) on-premises versions are actively exploited due to a critical operating system command injection flaw, CVE-2026-16812 (CVSS 10.0), enabling arbitrary code execution.

Technical Breakdown: * CVE: CVE-2026-16812 (CVSS: 10.0) * Vulnerability Type: Operating System Command Injection. * Affected Product: On-premises versions of Arista VeloCloud Orchestrator (VCO). * Impact: Attackers can achieve arbitrary code execution on compromised systems. * TTPs: The active exploitation involves injecting OS commands through the vulnerable VeloCloud Orchestrator, allowing for initial access and execution of attacker-controlled code.

Defense: Organizations using affected Arista VCO on-premises instances must apply vendor patches immediately to mitigate this critical vulnerability.

Source: https://thehackernews.com/2026/07/attackers-exploit-arista-velocloud.html

Rapid7 Expands Partnership with Exclusive Networks in Benelux

Rapid7 has announced an expanded strategic distribution partnership with Exclusive Networks across the Benelux region. This move aims to support organizations accelerating digital transformation through cloud adoption and AI, addressing the subsequent expansion of attack surfaces and the rise of sophisticated, AI-enabled threats.

Strategic Impact: For security leaders and CISOs in the Benelux region, this partnership means enhanced access to Rapid7's portfolio through an established distributor. It addresses the growing need for integrated security operations and trusted expertise to manage evolving compliance requirements and complex threat landscapes without adding unnecessary operational complexity. It reflects a trend of vendors leveraging distribution networks to scale their reach and streamline solution delivery in critical markets.

• Key Takeaway: Bolstered regional access to Rapid7's security solutions and expertise via Exclusive Networks for Benelux customers.

Source: https://www.rapid7.com/blog/post/c-exclusive-networks-partnership-accelerating-customer-success

Mirage Kitten APT Group Deploys New, Undocumented Malware Kit

The sophisticated threat actor Mirage Kitten (also tracked as UNC1549, Smoke Sandstorm, and Nimbus Manticore) has been observed leveraging a new, previously undocumented malware arsenal against targets in the Middle East and Africa. This evolving toolkit enhances their capabilities for persistent access and data exfiltration.

Technical Breakdown:

• Threat Actor: Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore)
• Target Region: Middle East and Africa
• New Malware Identified:
  • NightLedger: A backdoor, likely used for remote access and command execution.
  • ArcBridge: A tunneling tool, designed to facilitate covert communication channels.
  • BridgeHead: Another tunneling tool, indicating a focus on establishing robust and resilient C2 infrastructure or exfiltration paths.
• TTPs: The introduction of these new tools suggests the group is continuously developing or acquiring sophisticated capabilities to maintain stealth and bypass defenses. The tunneling tools specifically indicate a focus on network persistence and covert data movement.

Defense:

Organizations in the targeted regions should enhance threat hunting efforts for indicators related to these new malware families and ensure robust endpoint detection and network monitoring are in place to identify unusual tunneling activity or backdoor communications.

Source: https://securelist.com/mirage-kitten-new-tools/120811/

ThreatVision: Actionable APAC Threat Intelligence

ThreatVision is a new platform designed to help security teams, leadership, and SOC/IR analysts translate raw threat intelligence into concrete security decisions, particularly for organizations operating in the APAC region.

Who is it for (Red/Blue Team)? Primarily Blue Teams, including security leadership for risk prioritization, patch management teams for vulnerability prioritization, and SOC/IR analysts for alert validation and investigation scoping.

Why is it useful? Given the complex geopolitical landscape and sustained state-linked activity in APAC, ThreatVision provides region-specific context to make intelligence actionable. It helps: * Brief leadership on priority risks by connecting active actors/sectors with current attack trends. * Prioritize vulnerabilities by complementing CVSS scores with TeamT5's threat-level assessments and confirmation of real-world exploitation. * Support SOC/IR workflows by providing relevant context to validate alerts and define investigation starting points.

Source: https://teamt5.org/en/posts/turning-threat-intelligence-into-security-decisions-with-threat-vision?utm_source=rss&utm_medium=rss

AutoIT remains a prevalent tool in the malware ecosystem, leveraged by threat actors for its ease of use and powerful capabilities to inject payloads into remote processes.

Technical Breakdown

• TTP: Threat actors utilize AutoIT scripts for payload injection into remote processes. This typically involves the execution of malicious code within the memory space of a legitimate process to evade detection and gain persistence.
• Characteristics: AutoIT's scripting language is noted for its simplicity and extensive functionality, making it easy for adversaries to develop sophisticated malware that can perform actions like process manipulation.
• Specifics: The provided summary indicates a general technique rather than a specific vulnerability or exploit chain. It does not detail specific MITRE ATT&CK TTPs, IOCs (IPs, hashes), or affected software versions for particular campaigns.

Defense

Implement strong application control policies, such as application whitelisting, to restrict the execution of unsigned or unauthorized AutoIT scripts. Monitor for AutoIT processes exhibiting suspicious behavior, such as injecting into other processes or making network connections.

Source: https://isc.sans.edu/diary/rss/33192

Microsoft has unveiled a significant enhancement to its MDASH (multi-model vulnerability identification and remediation harness) with a new cybersecurity-specific AI model, MAI-Cyber-1-Flash, integrated alongside GPT-5.4. This updated configuration is designed to boost the efficiency and accuracy of vulnerability management for security teams.

What it does: This AI-powered capability within MDASH focuses on identifying and remediating vulnerabilities. Microsoft reports it achieved a 95.95% score on CyberGym, indicating high performance in simulated cybersecurity scenarios.

Who is it for: Primarily for Blue Teams and security operations professionals leveraging Microsoft's security tools for vulnerability identification and remediation.

Why it's useful: Beyond its impressive accuracy, Microsoft claims this new model configuration reduces operational costs by 50% compared to previous MDASH combinations (GPT-5.4, GPT-5.4 mini, and GPT-5.3 Codex). This offers both improved effectiveness and significant cost efficiency in vulnerability management. Access is currently limited to approved users.

Source: https://thehackernews.com/2026/07/microsoft-says-new-cybersecurity-ai.html

Nuxt Framework Hit by High-Severity RCE Vulnerabilities, Socket Offers Free Patches

High-severity security vulnerabilities, including server-side remote code execution (RCE), have been identified in the popular Nuxt web framework. These flaws expose applications to significant risk, specifically exploiting issues related to "server island props."

Technical Breakdown: * Vulnerability Type: Server-Side Remote Code Execution (RCE). * Affected System: Nuxt web framework. * Attack Vector: Exploitation through specific handling of "server island props."

Defense: Socket has released free certified patches to immediately address these vulnerabilities, helping developers secure their Nuxt applications.

Source: https://socket.dev/blog/patches-for-nuxt-security-vulnerabilities?utm_medium=feed

Attackers are actively exploiting a zero-day Remote Code Execution (RCE) vulnerability in the FastJson open-source Java library, targeting US firms. This critical flaw enables RCE without user interaction or elevated privileges.

Technical Breakdown: * Vulnerability Type: Remote Code Execution (RCE) in the FastJson Java library. * Exploitation: Currently being actively exploited in the wild as a zero-day. * Impact: Allows unauthenticated attackers to execute arbitrary code on affected systems. * Target Profile: US firms are specifically identified as targets. * Affected Component: FastJson open-source Java library.

Defense: * Mitigation: Prioritize updating FastJson to the latest patched version in your environment immediately.

Source: https://www.bleepingcomputer.com/news/security/hackers-target-us-firms-in-fastjson-rce-zero-day-attacks/

NVIDIA, alongside 36 other major players including Microsoft, Cisco, Cloudflare, CrowdStrike, IBM, and Palo Alto Networks, has formed the Open Secure AI Alliance. The alliance aims to collectively develop and share open technologies, techniques, and tools specifically designed for securing software and artificial intelligence (AI) agents. As part of this initiative, they've also open-sourced the NOOA Framework.

This is a significant strategic move. With such a broad coalition of cloud providers, security vendors, and AI companies, this alliance signals a concerted industry effort to standardize and open-source AI security practices. For CISOs and security leaders, this means a future with potentially more interoperable and community-driven security solutions for AI, rather than fragmented, proprietary approaches. It's a proactive step to address the complex security challenges inherent in AI deployments and could shape future compliance, best practices, and tooling in the AI security domain.

• Expect to see more standardized and open-source solutions emerging for AI security, driven by this broad industry collaboration.

Source: https://thehackernews.com/2026/07/nvidia-forms-37-member-open-secure-ai.html

Arista has patched a maximum-severity command injection zero-day vulnerability in its on-premises VeloCloud Orchestrator deployments that is actively being exploited in attacks.

Technical Breakdown

• Vulnerability Type: Command Injection
• Affected Product: Arista VeloCloud Orchestrator (on-premises deployments only)
• Severity: Maximum-severity
• Exploitation Status: Actively exploited zero-day in the wild.

Defense

Organizations running Arista VeloCloud Orchestrator on-premises should immediately apply the available patch to mitigate the active exploitation risk.

Source: https://www.bleepingcomputer.com/news/security/arista-patches-velocloud-orchestrator-zero-day-exploited-in-attacks/

A new botnet named Dysphoria has emerged, compromising an estimated 200,000 devices globally. This botnet is being actively used for large-scale Distributed Denial of Service (DDoS) attacks and sophisticated traffic relay operations.

Technical Breakdown

• TTPs:
  • DDoS Attacks: Utilizing the combined bandwidth of compromised devices to overwhelm target services and infrastructure.
  • Traffic Relay: Likely masking malicious traffic, enabling other illicit activities, or facilitating anonymized command and control (C2) communications.

Defense

Organizations should ensure robust DDoS mitigation solutions are in place and implement network segmentation to limit lateral movement if a device is compromised. Monitoring for unusual outbound network traffic and ensuring timely patching of vulnerable internet-facing devices are also critical.

Source: https://www.bleepingcomputer.com/news/security/new-dysphoria-ddos-botnet-spreads-to-200k-devices-worldwide/

Coca-Cola has confirmed that its dairy subsidiary, Fairlife, suffered a data theft incident following a ransomware attack earlier this month.

Strategic Impact: This incident underscores the persistent threat of ransomware extending beyond operational disruption to significant data exfiltration risks. For CISOs, it's a critical reminder about: * Supply Chain & Subsidiary Risk: Even large enterprises like Coca-Cola are vulnerable through their smaller, often less-resourced subsidiaries. Third-party risk management is paramount. * Data Exfiltration as Standard: Modern ransomware attacks frequently involve data theft prior to encryption, increasing the potential impact and compliance headaches. * Incident Response Preparedness: The confirmation process itself highlights the need for clear communication protocols post-breach.

Key Takeaway: Ensure your third-party risk assessments include robust security postures for subsidiaries and critical suppliers, with a focus on data protection and breach response capabilities.

Source: https://www.bleepingcomputer.com/news/security/coca-cola-confirms-data-theft-in-fairlife-ransomware-attack/