DFIRLab
All Briefings
weeklyJune 29, 2026 — July 6, 2026Published 07:02 UTC

Weekly Threat Briefing — 2026-06-29 to 2026-07-06

37 findings131 articles7 sections

Subscribe
Critical findings
0
High findings
0
CISA KEV additions
0
First seen in this period
131 Articles1,022 CVEs6,624 IOCs

First seen in this period: news articles, each counted once · CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · CISA KEV catalog additions · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.

Priority queue

Act on these first

Critical and high findings from this briefing and its live updates. Most severe first, then newest.

Showing 10 of 27
Browse all 37 findings

Executive summary · as of 07:02 UTC

The situation

This week marks a watershed moment in offensive cybersecurity operations: JadePuffer represents the first documented case of a fully autonomous AI-driven ransomware attack, conducted entirely by a large language model agent without human intervention. This development, coupled with widespread exploitation of critical Microsoft SharePoint and Cisco Unified CM vulnerabilities now added to CISA's KEV catalog, signals an acceleration in both attack automation and adversary capabilities. The FBI's disruption of the NetNut proxy network—cutting off 2 million infected Android devices—demonstrates ongoing efforts to counter residential proxy abuse, while the FortiBleed credential-theft campaign's links to INC and Lynx ransomware operations reveal sophisticated initial access broker ecosystems. Organizations face an evolving threat landscape where AI-enhanced attacks, social engineering techniques like ClickFix/ConsentFix, and supply chain compromises converge with aggressive ransomware operations targeting healthcare, manufacturing, and financial sectors across multiple continents.

Browse the full briefing

37 findings · 7 sections
Findings by severity
  • 8 critical
  • 19 high
  • 4 medium
  • 1 low
  • 5 info
Vulnerabilities2 critical · 3 high

Critical Vulnerabilities Under Active Exploitation

CISA has added multiple high-severity vulnerabilities to the Known Exploited Vulnerabilities catalog, with active exploitation confirmed for Microsoft SharePoint and Cisco Unified CM flaws.

Malware1 critical · 4 high · 1 medium

AI-Automated Attacks and Emerging Malware Families

The discovery of JadePuffer—the first fully autonomous AI-driven ransomware operation—represents a paradigm shift in attack automation. Multiple new malware families and delivery mechanisms continue to emerge.

Tools & Techniques1 critical · 3 high · 1 info

Social Engineering and Attack Technique Evolution

ClickFix and ConsentFix techniques have become the dominant malware delivery methods, bypassing MFA and hijacking Microsoft 365 accounts in seconds through sophisticated social engineering.

Threat Actors1 critical · 3 high

Infrastructure Disruption and Threat Actor Operations

Law enforcement actions disrupted major criminal infrastructure including the NetNut proxy network, while threat actor campaigns continue with FortiBleed linked to ransomware operations.

Data Breaches & Leaks3 critical · 5 high

Data Breaches and Credential Exposures

Major data breach incidents this week exposed millions of records including Moody Bible Institute's 2.3M donor records via ShinyHunters extortion, healthcare breaches at AdaptHealth and Baraga County Memorial Hospital, and multiple ransomware leak-site victims.

DFIR Lab4 info

Research and Analysis Tools

New research into Windows event log forensics, automated malware analysis using AI agents, and WebAuthn implementation advances provide defenders with enhanced capabilities.

Policy1 high · 3 medium · 1 low

Legal and Regulatory Developments

Key policy developments include Google's €4.1 billion EU antitrust fine upheld, Supreme Court decision threatening EU-US data sharing, and UK cyber action plan delayed amid political uncertainty.

Sources & Attribution

These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.

CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.