Weekly Threat Briefing — 2026-06-15 to 2026-06-22
36 findings96 articles7 sections
- Critical findings
- 0
- High findings
- 0
- CISA KEV additions
- 0
- First seen in this period
- 96 Articles1,332 CVEs6,676 IOCs
First seen in this period: news articles, each counted once · CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · CISA KEV catalog additions · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.
Priority queue
Act on these first
Critical and high findings from this briefing and its live updates. Most severe first, then newest.
- Critical severitySection VulnerabilitiesSource: KEV
- Critical severitySection VulnerabilitiesSource: KEV
- Critical severitySection VulnerabilitiesSource: CVE
- Critical severitySection VulnerabilitiesSource: CVE
- Critical severitySection VulnerabilitiesSource: CVE
- Critical severitySection Data Breaches & LeaksSource: Breach
- Critical severitySection Data Breaches & LeaksSource: RSS
- Critical severityFortiBleed Leak Exposes 74,000 Fortinet Firewall and VPN Credentials (opens the source in a new tab)Section Data Breaches & LeaksSource: RSS
- Critical severitySection Threat ActorsSource: RSS
- High severitySection VulnerabilitiesSource: RSS
Executive summary · as of 07:02 UTC
The situation
This week's threat landscape reveals significant enterprise risks spanning supply chain attacks, data breaches, and active exploitation of critical vulnerabilities. North Korean state-sponsored actors (Sapphire Sleet/BlueNoroff) compromised the Mastra AI supply chain, affecting over 140 npm packages—a serious reminder that AI development tools remain high-value targets. Multiple healthcare and government sectors experienced major data breaches, including Texas Parks and Wildlife (3+ million driver's licenses exposed), Amazon-owned One Medical (8.8TB claimed stolen by ShinyHunters), and numerous ransomware incidents. CISA has mandated federal agencies patch critical Splunk Enterprise and Fortinet vulnerabilities by Sunday, both actively exploited. The SocGholish botnet disruption cleaned nearly 15,000 infected websites, marking a rare operational success against Russia-linked cybercrime infrastructure. Organizations should prioritize patching CISA KEV entries, reviewing OAuth token security following the Klue breach, and implementing enhanced monitoring for supply chain risks in AI/development toolchains.
Browse the full briefing
36 findings · 7 sections- 9 critical
- 13 high
- 9 medium
- 1 low
- 4 info
- Vulnerabilities7 findingsCritical Vulnerabilities & Active Exploitation5 critical · 2 high
- Data Breaches & Leaks7 findingsData Breaches & Leaks3 critical · 2 high · 2 medium
- Malware7 findingsMalware Campaigns & Botnets5 high · 2 medium
- Threat Actors4 findingsThreat Actor Activity & Attribution1 critical · 3 high
- Tools & Techniques4 findingsAttack Techniques & Defensive Research1 high · 3 medium
- Policy4 findingsPolicy, Regulation & Legal Actions2 medium · 1 low · 1 info
- DFIR Lab3 findingsDFIR Research & Tooling3 info
Critical Vulnerabilities & Active Exploitation
CISA has added four vulnerabilities to the Known Exploited Vulnerabilities catalog with mandatory federal remediation deadlines, while NVD published multiple critical-severity CVEs affecting widely deployed software.
- Critical severityCVE-2026-20253: Splunk Enterprise Missing Authentication (CISA Deadline: Sunday) (opens the source in a new tab)
CISA mandates federal agencies patch this critical Splunk Enterprise vulnerability by Sunday. The flaw allows unauthenticated attackers to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint, enabling potential remote code execution.
- Critical severityCVE-2026-20262: Cisco Catalyst SD-WAN Manager Path Traversal Under Active Exploitation (opens the source in a new tab)
Authenticated remote attackers can create or overwrite any file on affected Cisco SD-WAN Manager systems through directory traversal, potentially leading to complete system compromise.
- Critical severityCVE-2026-56397: SiYuan Bazaar XSS Leading to Remote Code Execution (opens the source in a new tab)
Critical XSS vulnerability in SiYuan (before v3.6.1) allows malicious package authors to inject arbitrary HTML/JavaScript in the Bazaar marketplace, achieving remote code execution on any user browsing the marketplace.
- Critical severityCVE-2026-56265: Crawl4AI Hardcoded JWT Key Enables Authentication Bypass (opens the source in a new tab)
Crawl4AI (before 0.8.7) contains a hardcoded default JWT signing key in the Docker API server. Attackers knowing the default key can forge valid authentication tokens for any user, completely bypassing authentication.
- Critical severityCVE-2024-58351: Flowise Configuration Injection Vulnerability (opens the source in a new tab)
Flowise (before 2.1.4) allows attackers to inject configuration during Chainflow execution via the overrideConfig option, enabled by default with no variable allow-list. This can lead to arbitrary code execution.
- High severityFortiBleed: CISA Warns Fortinet Customers After 74,000 Credentials Leaked (opens the source in a new tab)
Nearly 74,000 Fortinet firewall and VPN credentials exposed in a data leak dubbed 'FortiBleed.' CISA urges immediate credential rotation and device hardening to prevent unauthorized access to enterprise perimeter defenses.
- High severityHackers Exploit Gravity SMTP WordPress Plugin Information Disclosure Bug (opens the source in a new tab)
Threat actors actively exploiting unauthenticated information disclosure vulnerability in Gravity SMTP WordPress plugin, installed on 100,000 sites. Attackers can retrieve sensitive configuration data including SMTP credentials.
Data Breaches & Leaks
Major data breaches this week exposed millions of records across healthcare, government, and enterprise sectors, with several high-profile incidents involving sensitive personal information and credentials.
- Critical severityTexas Parks and Wildlife: 3+ Million Driver's Licenses Exposed (opens the source in a new tab)
One of the largest Texas state government data breaches exposed driver's license information and passport numbers for more than 3 million individuals through a license system vendor compromise. Represents significant identity theft risk.
- Critical severityAmazon-Owned One Medical: ShinyHunters Claims 8.8TB Data Theft (opens the source in a new tab)
ShinyHunters cybercriminal group claims to have stolen 8.8 terabytes of data from One Medical (acquired by Amazon in 2023), threatening to publish unless negotiations begin by June 22. Affects primary care provider with significant patient data holdings.
- Critical severityFortiBleed Leak Exposes 74,000 Fortinet Firewall and VPN Credentials (opens the source in a new tab)
Massive credential leak dubbed 'FortiBleed' exposes nearly 74,000 Fortinet firewall and VPN credentials, creating immediate risk for enterprise perimeter security. CISA issues urgent guidance for device hardening.
- High severityKlue OAuth Breach: Icarus Extortion Group Claims Salesforce Token Theft (opens the source in a new tab)
Market intelligence platform Klue confirms security incident where threat actors stole OAuth tokens used to connect to customers' Salesforce environments. New 'Icarus' extortion group publicly claims the attack, expanding victim list. Third OAuth-based Salesforce data theft incident recently.
- High severityGo2Joy (Vietnam): Complete Database Released by RansomEXX (opens the source in a new tab)
RansomEXX released the complete database of Go2Joy, Vietnam's leading platform for hourly and short-stay hotel bookings, exposing customer booking records and personal information.
- Medium severitySpencer Gifts Health Plan: $450K HHS Settlement After Ransomware Incident (opens the source in a new tab)
HHS Office for Civil Rights settles ransomware investigation with Spencer Gifts LLC health plan for $450,000 plus corrective action plan, highlighting HIPAA compliance failures that enabled the breach.
- Medium severityNintendo Confirms Data Stolen in WebMD Subsidiary TinyPulse Breach (opens the source in a new tab)
Nintendo of America confirms threat actors stole survey data from third-party TinyPulse service used internally, though Nintendo systems themselves were not compromised. Highlights third-party vendor risk.
Malware Campaigns & Botnets
Multiple malware operations disrupted or discovered this week, including a major botnet takedown and new ransomware variants with novel techniques.
- High severitySocGholish Botnet Disrupted: 15,000 Infected Websites Cleaned (opens the source in a new tab)
Global law enforcement operation targeted the SocGholish botnet linked to Russia's Evil Corp, cleaning nearly 15,000 infected websites used for fake browser update scams. Major disruption to widespread malware distribution network.
- High severityAryStinger Botnet Compromised 4,000+ D-Link Routers for Malicious Proxies (opens the source in a new tab)
Previously undocumented AryStinger malware botnet has infected over 4,000 outdated D-Link routers worldwide, converting them into proxies for malicious traffic. Demonstrates continued exploitation of unpatched consumer network devices.
- High severityPrinz Eugen Ransomware: Novel File Selection Algorithm Targets Recent Files (opens the source in a new tab)
New 'Prinz Eugen' ransomware operation prioritizes recently modified files for encryption and leaves no ransom note on the system, representing an evolution in ransomware tactics focused on maximizing victim impact.
- High severityGentlemen RaaS Maintains Multiple EDR Killers for Affiliate Operations (opens the source in a new tab)
Gentlemen ransomware-as-a-service actively develops and maintains a suite of endpoint detection and response (EDR) killers to help affiliates evade detection during attacks. Demonstrates ongoing arms race in defense evasion.
- High severityOxLoader: New Obfuscated Loader Delivers CASTLESTEALER Infostealer (opens the source in a new tab)
Elastic Security Labs analyzed a new highly obfuscated loader (OxLoader) that abuses the .reloc section, employs five anti-VM/language checks, and uses MBA obfuscation to deliver CASTLESTEALER infostealer malware via malicious Google Ads.
- Medium severityUSB Worm Distributes Cryptocurrency-Stealing Malware via LNK Files (opens the source in a new tab)
Self-spreading malware targets cryptocurrency wallets using USB worms that propagate via Windows shortcut (LNK) files, incorporating clipboard hijacking and Tor-based C2 communications for stealth.
- Medium severityMirai and Mozi Botnet Activity Continues Across Multiple Architectures (opens the source in a new tab)
Abuse.ch URLhaus data shows continued distribution of Mirai and Mozi botnet malware variants targeting multiple architectures (MIPS, ARM, x86), primarily focused on IoT device exploitation.
Threat Actor Activity & Attribution
North Korean state-sponsored actors and established cybercrime groups conducted significant supply chain and extortion operations.
- Critical severityMicrosoft Attributes Mastra AI Supply Chain Attack to North Korea's Sapphire Sleet (opens the source in a new tab)
Microsoft links the recent Mastra AI supply chain compromise affecting 140+ npm packages to North Korean state-sponsored group Sapphire Sleet (BlueNoroff). Attack demonstrates DPRK's continued focus on software supply chain as an initial access vector.
- High severityPopa Botnet Linked to Publicly-Traded Israeli Firm (opens the source in a new tab)
Krebs on Security investigation reveals the Popa Android-based botnet, which has forced millions of consumer TV boxes into relaying traffic for ad fraud and account takeovers, is linked to a publicly-traded Israeli company. Represents significant corporate-linked cybercrime operation.
- High severitySocGholish Infrastructure Disrupted: Evil Corp Connections Confirmed (opens the source in a new tab)
International police operation targeted SocGholish botnet infrastructure tied to Russia-based Evil Corp cybercrime group, disrupting fake browser update distribution network affecting thousands of websites.
- High severityShinyHunters Claims 8.8TB Theft from Amazon-Owned One Medical (opens the source in a new tab)
Established data extortion group ShinyHunters claims massive data theft from One Medical with deadline for negotiations, continuing their pattern of targeting healthcare organizations for high-value data.
Attack Techniques & Defensive Research
Security researchers published new attack primitives and defensive guidance covering AI agent security, authentication bypass methods, and credential attack mitigation.
- High severityAutoJack: Single Webpage Can Achieve RCE on AI Agent Host (opens the source in a new tab)
Microsoft Security disclosed AutoJack, a novel exploit chain demonstrating how a single malicious webpage can turn an AI browsing agent into a remote code execution vector on the host machine by abusing localhost trust, missing authentication, and unsafe parameter handling.
- Medium severityUnit 42: Guidance for Mitigating Large-Scale Credential Attacks (opens the source in a new tab)
Palo Alto Networks Unit 42 provides comprehensive threat brief on preparing for and mitigating large-scale credential attacks, focusing on recent campaigns targeting security vendors' devices. Includes defensive recommendations.
- Medium severityAzure AD Graph Activity Logs: Closing the Visibility Gap with Detection Rules (opens the source in a new tab)
Elastic Security Labs announces Azure AD Graph Activity Logs now available in Elastic with full ECS parsing, plus ready-to-use detection rules for identifying ROADrecon and AADInternals enumeration attacks against Azure environments.
- Medium severityWebinar: How Attackers Bypass MFA Including Device Code Phishing (opens the source in a new tab)
BleepingComputer webinar explores modern phishing techniques including Device Code phishing that undermine MFA protections, with focus on how behavioral AI can detect compromised accounts faster and automate response.
Policy, Regulation & Legal Actions
Legal and regulatory developments included HHS enforcement actions, international surveillance tech concerns, and hacktivist prosecutions.
- Medium severityHHS OCR Settles Ransomware Case with Spencer Gifts for $450K (opens the source in a new tab)
U.S. Department of Health and Human Services Office for Civil Rights announces $450,000 settlement with Spencer Gifts health plan over HIPAA violations that enabled ransomware attack, including mandatory corrective action plan.
Source: RSS - Medium severityBulgaria Allowed Surveillance Tech Sales to Repressive Regimes (opens the source in a new tab)
Human Rights Watch obtains export licensing records (2018-2023) showing Bulgarian government permitted surveillance firm Circles to sell technology to law enforcement and intelligence agencies in countries known for human rights abuses.
Source: RSS - Low severityCanadian Hacker Pleads Guilty to Texas Republican Party Cyberattack (opens the source in a new tab)
Aubrey Cottle, linked to hacktivist group Anonymous, pleaded guilty to three charges stemming from cyberattack on Texas Republican Party website, including obtaining corporate emails and Active Directory credentials.
Source: RSS - Info severityUK Information Commissioner Resigns Over Inappropriate Humor Investigation (opens the source in a new tab)
UK's information commissioner resigns amid investigation into inappropriate behavior, acknowledging the position has become untenable despite disagreeing with how the investigation was conducted.
Source: RSS
DFIR Research & Tooling
Digital forensics and incident response community published research on memory forensics fundamentals and Windows event logging best practices.
- Info severityUnderstanding Memory Forensics Fundamentals (opens the source in a new tab)
Introduction to memory forensics as an emerging discipline within digital forensics, exploring how investigators recover and analyze volatile memory evidence to uncover critical artifacts that traditional disk forensics might miss.
- Info severityWhy Windows Event Logging Is Essential for Incident Response (opens the source in a new tab)
Analysis of the critical role Windows event logs play in DFIR work and why proper logging configuration is no longer optional in modern enterprise environments for effective threat detection and investigation.
Source: Blog - Info severityForensic Focus Digest: AI in Digital Forensics Best Practices (opens the source in a new tab)
Forensic Focus publishes digest covering best practices for using AI in digital forensics, featuring interviews with industry experts and case studies including investigation of world's largest crash test.
Source: RSS
Sources & Attribution
These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.
CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.