Weekly Threat Briefing — 2026-06-22 to 2026-06-29
32 findings146 articles7 sections
- Critical findings
- 0
- High findings
- 0
- CISA KEV additions
- 0
- First seen in this period
- 146 Articles1,077 CVEs11,318 IOCs
First seen in this period: news articles, each counted once · CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · CISA KEV catalog additions · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.
Priority queue
Act on these first
Critical and high findings from this briefing and its live updates. Most severe first, then newest.
- Critical severitySection Data Breaches & LeaksSource: Breach
- Critical severitySection Data Breaches & LeaksSource: Breach
- Critical severitySection VulnerabilitiesSource: KEV
- Critical severityCVE-2026-12569: PTC Windchill Arbitrary Code ExecutionSection VulnerabilitiesSource: KEV
- Critical severityCVE-2026-53576: Kestra API Authentication BypassSection VulnerabilitiesSource: CVE
- Critical severityCVE-2026-58053: Gitea act_runner Docker Backend EscapeSection VulnerabilitiesSource: CVE
- Critical severitySection Threat ActorsSource: RSS
- Critical severityMultiple pnpm Package Manager Critical VulnerabilitiesSection Tools & TechniquesSource: Manual
- Critical severityCVE-2026-54350: Budibase Unauthenticated MongoDB/DB AccessSection Tools & TechniquesSource: Manual
- High severitySection Data Breaches & LeaksSource: Breach
Executive summary · as of 07:01 UTC
The situation
This week's threat landscape was dominated by significant data breaches affecting millions of users, critical supply-chain attacks targeting the software development ecosystem, and rapidly weaponized vulnerabilities in enterprise infrastructure. The most severe incident involved KDDI Corporation in Japan, where up to 14.2 million ISP email credentials were compromised across six providers. Multiple critical vulnerabilities were added to CISA's KEV catalog, including a Cisco Unified Communications Manager SSRF flaw (CVE-2026-20230) exploited within 24 hours of disclosure. The software supply chain faced sophisticated attacks, including malicious GitHub repositories tricking AI coding agents, a $3 million Polymarket breach via third-party compromise, and numerous pnpm package manager vulnerabilities enabling arbitrary code execution. Ransomware groups maintained aggressive operations with 30 new victims posted, while Russian state-sponsored groups (Turla, Gamaredon) escalated espionage campaigns targeting Ukraine and Signal users. The emergence of sophisticated evasion techniques—including macOS malware embedding fake errors to confuse AI analysis tools and attackers abusing legitimate platforms like Shopify's order-tracking app—signals threat actors' continued adaptation to defensive measures.
Browse the full briefing
32 findings · 7 sections- 9 critical
- 15 high
- 5 medium
- 3 info
- Data Breaches & Leaks4 findingsMajor Data Breaches & Credential Exposures2 critical · 2 high
- Vulnerabilities5 findingsCritical Vulnerabilities & Active Exploitation4 critical · 1 high
- Malware5 findingsMalware & Persistent Threats5 high
- Threat Actors7 findingsState-Sponsored & Organized Threat Activity1 critical · 6 high
- Tools & Techniques4 findingsAttack Techniques & TTPs2 critical · 2 medium
- DFIR Lab3 findingsDFIR & Security Operations1 medium · 2 info
- Policy4 findingsPolicy, Compliance & Industry Developments1 high · 2 medium · 1 info
Major Data Breaches & Credential Exposures
Multiple large-scale breaches exposed millions of credentials and sensitive customer data across telecommunications, healthcare, and financial sectors
- Critical severityKDDI Corporation - 14.2 Million Email Credentials Exposed (opens the source in a new tab)
Japanese telecommunications operator KDDI disclosed a breach where attackers accessed email systems used by six ISPs, potentially exposing up to 14.22 million email addresses and passwords. The incident was confirmed on June 17, 2026, affecting ISP mail services across Japan.
- Critical severitySettra Ransomware - Multiple High-Value Targets (opens the source in a new tab)
The Settra ransomware group disclosed breaches of major organizations including DyStar (1.3TB), PCHome Taiwan (payment data), Doosan/Geith/Bobcat (3.27TB), and others. Leaks include customer databases, financial records, and proprietary manufacturing data.
- High severityAssuranceAmerica - 1.1 Million Records Across Seven States (opens the source in a new tab)
State officials warned that at least 1.1 million people across California, Massachusetts, Nebraska, South Carolina, Texas, Vermont, and Washington may be impacted by an AssuranceAmerica data breach, with notices being sent to affected residents.
Source: Breach - High severityPolymarket - $3 Million Lost in Supply-Chain Attack (opens the source in a new tab)
Polymarket customers lost an estimated $3 million after hackers injected a malicious script into the platform's frontend following a breach at a third-party vendor. The company has committed to fully reimbursing affected customers.
Critical Vulnerabilities & Active Exploitation
CISA added six new vulnerabilities to the KEV catalog, with attackers weaponizing a Cisco flaw within 24 hours of disclosure
- Critical severityCVE-2026-20230: Cisco CUCM SSRF Vulnerability Exploited (opens the source in a new tab)
CISA gave federal agencies until Sunday to patch this SSRF vulnerability in Cisco Unified Communications Manager that allows unauthenticated remote attackers to write files to the underlying OS. Exploited within 24 hours of disclosure.
- Critical severity
- Critical severity
- Critical severityCVE-2026-58053: Gitea act_runner Docker Backend Escape
Gitea act_runner with Docker backend passes workflow container options without proper validation, allowing attackers to bypass security restrictions with --privileged, --pid=host, and other dangerous flags. CVSS 9.9 Critical.
- High severity
Malware & Persistent Threats
Advanced malware campaigns targeting developers, enterprise systems, and secure communications platforms
- High severityAI Coding Agents Tricked by Malicious GitHub Repos (opens the source in a new tab)
Researchers demonstrated how agentic coding tools can be manipulated to execute malicious payloads from seemingly benign GitHub repositories. The malicious code remains invisible to security scanners, AI agents, and human reviewers.
- High severityPhoto ZIP Campaign Delivers Node.js Implant to Hospitality (opens the source in a new tab)
Microsoft identified a multi-stage campaign targeting hospitality organizations in Europe and Asia using photo-themed ZIP archives and fake image shortcuts to deliver persistent Node.js implants while evading detection.
- High severityGaslight: macOS Malware Confuses AI Analysis Tools (opens the source in a new tab)
New macOS malware dubbed 'Gaslight' embeds fake errors and prompt injection strings within executables specifically to confuse AI-assisted malware analysis tools, representing an evolution in anti-analysis techniques.
- High severityChrome Session Cookie Stealer via Malicious Extension (opens the source in a new tab)
Phishing campaign installs malicious Chrome extension to hijack browser sessions and compromise Windows devices by stealing session cookies to take over user accounts without requiring passwords.
- High severityClearFake Malware Campaign Active (opens the source in a new tab)
Multiple ClearFake malware distribution URLs detected across various domains, representing ongoing fake browser update campaigns distributing malware.
State-Sponsored & Organized Threat Activity
Russian APT groups escalated operations targeting Ukraine, Signal users, and critical infrastructure
- Critical severityFBI: Russian Hackers Target Signal Backup Recovery Keys (opens the source in a new tab)
FBI and CISA warn that Russian intelligence-linked phishing campaigns targeting Signal users have evolved to steal Signal Backup Recovery Keys, enabling access to victims' historical encrypted messages.
- High severityTurla APT Deploys StockStay Malware Against Ukraine (opens the source in a new tab)
Google researchers described StockStay, the latest malware from Russian FSB-sponsored Turla group targeting Ukraine in ongoing espionage efforts. The group has significantly improved its malware loading and server concealment capabilities.
- High severityRussian APT Gamaredon Arsenal Upgrade Requires New Defenses (opens the source in a new tab)
FSB state-sponsored Gamaredon operation has significantly improved its malware loading techniques and server infrastructure concealment, requiring updated defensive measures against this persistent Ukraine-targeting threat.
- High severityRussia Used Social Engineering for Messaging Account Breaches (opens the source in a new tab)
Ukraine's SBU described a long-running Russian operation using fake tech-support workers to social engineer victims into surrendering credentials to their messaging applications.
- High severityCL-STA-1062 Targets Southeast Asian Governments (opens the source in a new tab)
Government entities and critical infrastructure in Southeast Asia targeted for espionage using hybrid toolkit including custom TinyRCT backdoor. Campaign demonstrates sophisticated persistent access techniques.
- High severityPolish SIM-Swapping Gang Busted - Crypto Theft Millions (opens the source in a new tab)
Polish authorities arrested four members of organized cybercrime group accused of breaching telecom partners and hijacking email accounts to execute SIM-swapping attacks tied to millions in cryptocurrency theft.
- High severityIranian-Turkish National Arrested on $3.4B Hacking Charges (opens the source in a new tab)
Montenegro arrested a 39-year-old Iranian-Turkish dual national wanted by the US for mass hacking attacks causing $3.4 billion in damages.
Attack Techniques & TTPs
Threat actors demonstrate sophisticated evasion and persistence techniques across multiple platforms
- Critical severityMultiple pnpm Package Manager Critical Vulnerabilities
Extensive vulnerabilities in pnpm including path traversal, git fetch argument injection, integrity bypass, and repository-controlled execution. Multiple CVEs allow attackers to escape sandboxes and execute arbitrary code.
- Critical severity
- Medium severityShopify Order-Tracking App Abused for Callback Phishing (opens the source in a new tab)
Threat actors increasingly abuse Shop, Shopify's legitimate order-tracking app, by injecting fake purchase receipts into users' order histories to trick them into providing sensitive data or installing remote access software.
- Medium severityOpenAI Organization Invites Used in Corporate Targeting (opens the source in a new tab)
Cybersecurity firms targeted by fraudulent OpenAI organization invites impersonating legitimate companies, attempting to trick targets into submitting sensitive company information through chats and projects.
DFIR & Security Operations
Insights on memory acquisition, GRC automation, and emerging security operations challenges
- Medium severityMeeting 2030 Quantum Deadline: Expensive & Complex (opens the source in a new tab)
Analysis of challenges in achieving quantum-readiness by Trump's 2030 deadline, including IT/OT visibility issues, multivendor environments, misaligned update lifecycles, and interoperability gaps.
Source: RSS - Info severityMemory Acquisition: Capturing Volatile Evidence (opens the source in a new tab)
Technical guide on preserving volatile RAM contents to non-volatile storage for forensic analysis. Emphasizes careful execution to prevent corruption from background processes and system reboots.
Source: Blog - Info severityBuilding Your First GRC Agent: Red Teamer's Walkthrough (opens the source in a new tab)
Practical guide for building an AI agent that continuously monitors controls, identifies evidence gaps, and opens remediation tasks. Demonstrates automation of repetitive GRC analyst work.
Source: RSS
Policy, Compliance & Industry Developments
Regulatory actions, compliance challenges, and industry responses to evolving threats
- High severityNAIC Suspends Investment Risk Designations After Cyberattack (opens the source in a new tab)
The National Association of Insurance Commissioners suspended investment risk designations following a cyber attack, impacting state insurance regulators across 50 states and five territories.
- Medium severityFCC Votes to Toughen Rules on Undersea Cable Protection (opens the source in a new tab)
In unprecedented move, FCC mandates that owners and operators of submarine line terminal equipment (SLTE) be licensed, enhancing security of critical undersea cable infrastructure.
Source: RSS - Medium severityUK ICO Report: EdTech Data Protection Findings (opens the source in a new tab)
UK Information Commissioner's Office released 'EdTech examined' report detailing key findings from audits of educational technology companies regarding student data protection practices.
Source: RSS - Info severityMicrosoft Extends Free Windows 10 ESU to October 2027 (opens the source in a new tab)
Microsoft quietly extended free Windows 10 Extended Security Updates for consumers by one year, allowing enrolled devices to receive security updates until October 12, 2027.
Source: RSS
Sources & Attribution
These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.
CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.