DFIRLab
All Briefings
weeklyAugust 17, 2026 — August 24, 2026Published 07:02 UTC

Weekly Threat Briefing — 2026-08-17 to 2026-08-24

39 findings144 articles7 sections

Subscribe
Critical findings
0
High findings
0
CISA KEV additions
0
First seen in this period
144 Articles2,170 CVEs9,324 IOCs

First seen in this period: news articles, each counted once · CVEs rated CVSS 7.0+ (NVD, GitHub, WordPress) · CISA KEV catalog additions · new abuse.ch indicators (ThreatFox, URLhaus, Feodo Tracker), dated by abuse.ch.

Priority queue

Act on these first

Critical and high findings from this briefing and its live updates. Most severe first, then newest.

Showing 10 of 27
Browse all 39 findings

Executive summary · as of 07:02 UTC

The situation

This week's intelligence summary reveals a concerning surge in healthcare sector targeting, critical vulnerabilities in widely-used enterprise software, and a major expansion of Android-based malware campaigns. Nine major KEV entries were added by CISA, including actively exploited flaws in Microsoft Entra ID (CVE-2026-55040), TrueConf Server, and Zimbra Collaboration Suite, all requiring immediate federal agency remediation. The ransomware landscape shows intensified healthcare attacks with the Kazu group conducting a coordinated campaign against medical facilities across multiple continents, while over 9,300 exposed AWS keys remain active, presenting critical supply chain risks. Android malware campaigns continue to evolve with ToxicPanda expanding to 349 applications and proxy botnets compromising car head units. Multiple critical RCE vulnerabilities in popular open-source projects (JSONata, NLTK, justhtml) demand urgent patching.

Browse the full briefing

39 findings · 7 sections
Findings by severity
  • 11 critical
  • 16 high
  • 12 medium
Vulnerabilities8 critical · 1 high

Critical Vulnerabilities & Active Exploitation

CISA added 9 vulnerabilities to KEV catalog with active exploitation confirmed. Critical flaws span enterprise collaboration, virtualization, and authentication platforms.

Malware4 high · 1 medium

Evolving Android & Mobile Threats

Multiple Android malware families show significant evolution with expanded capabilities and targeting scope.

Data Breaches & Leaks1 critical · 3 high · 2 medium

Data Breaches & Credential Exposure

Major data breaches affecting healthcare providers, financial services, and technology platforms. Over 3.75 million healthcare records exposed in single incident.

Threat Actors2 critical · 4 high · 1 medium

Threat Actor Activity & Ransomware Operations

Intensified ransomware campaigns targeting healthcare, legal, and critical infrastructure. Kazu group conducting coordinated global healthcare attacks.

Tools & Techniques3 high · 2 medium

Attack Techniques & Security Tools

Novel attack techniques identified in Windows IPC, TSN industrial protocols, and software development supply chains.

Policy1 high · 2 medium

Policy & Regulatory Developments

Congressional oversight of CISA staffing cuts and TikTok safety features, alongside expanded government cyber policing challenges.

DFIR Lab4 medium

Detection, Forensics & Research

New security frameworks and defensive research addressing AI agent constraints, post-quantum cryptography, and phishing detection gaps.

Sources & Attribution

These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.

CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.