Threat Intel Report - August 2026

Executive summary

August 2026 was characterized by continued growth in ransomware, cloud and identity-focused attacks, exploitation of internet-facing infrastructure, data extortion, and increasingly AI-assisted cyber operations. Threat actors showed a strong preference for abusing trusted services, exposed remote-access infrastructure, cloud identities, and legitimate administrative tools rather than relying solely on conventional malware. Ransomware operations such as Gunra and Medusa continued to combine initial-access exploitation, credential theft, data exfiltration, and encryption, while emerging extortion groups such as ExfilSquad increasingly relied on data theft and public disclosure without traditional ransomware deployment.

The vulnerability landscape remained equally significant. August reporting included actively exploited and critical vulnerabilities affecting Fortinet products, macOS Screen Sharing, PostgreSQL, GitLab AI Gateway, Metabase, ServiceNow's AI Platform, and other enterprise technologies. Rapidly weaponized vulnerabilities combined with exposed internet-facing infrastructure reinforce the need for continuous asset discovery, risk-based vulnerability management, identity hardening, and threat-informed detection.

Overall, August's landscape shows a shift toward identity-centric, cloud-enabled, and automation-assisted attacks. Organizations should prioritize phishing-resistant MFA, cloud identity protection, rapid vulnerability remediation, endpoint monitoring, and detection of data exfiltration and legitimate-tool abuse.

Global threat overview

Top 5 target sectors: finance, technology, government, healthcare, and education.

Top 5 risks: vulnerability exploitation, supply chain, data breach, ransomware, and DDoS.

The full report PDF includes a chart of the most active malware families.

Notable campaigns and events

Gunra ransomware exploits Fortinet flaws and bypasses MFA

A joint advisory from US and South Korean cybersecurity agencies warned of Gunra ransomware attacks on critical infrastructure and organizations globally. Gunra is a ransomware-as-a-service (RaaS) operation derived from leaked Conti source code. It exploits known vulnerabilities in internet-facing Fortinet FortiOS and FortiProxy appliances for initial access, then steals credentials, moves laterally, exfiltrates data, bypasses MFA, and deploys ransomware in a double-extortion model.

Threat actor: Gunra ransomware group (Gunra RaaS)

Target verticals: critical infrastructure, healthcare, financial services, government services, manufacturing, transportation, and professional and nonprofit services

Attack technique: the actors exploit the authentication-bypass vulnerabilities CVE-2024-55591 and CVE-2025-24472 in FortiOS and FortiProxy. After compromising an SSL-VPN appliance they intercept credentials and session cookies for session hijacking and internal access. Gunra has also modified VDI authentication-processing files so that a designated OTP value bypasses MFA. They then use tools such as Impacket for lateral movement and credential dumping, steal data from Microsoft OneDrive, SharePoint, and MEGA, delete backups, and encrypt critical systems.

Behavior of the ransomware

• Creates a process named gunraransome.exe and deletes shadow copies using WMI.
• Encrypts files and appends the ".ENCRT" extension.
• Drops a ransom note named "R3ADM3.txt" in every encrypted directory.
• Gives victims about five days to respond and negotiates through Tor portals styled like messaging apps, with assigned roles such as "Manager."

ExfilSquad targets new victims and distributes stolen data via torrents

ExfilSquad, identified in mid-2026, is an emerging financially motivated group conducting large-scale data breaches and extortion. It generally does not encrypt systems; it steals data and threatens to publish it on its Tor-based leak site unless a ransom is paid. In August 2026 it announced multiple victims across the US, UK, and Sweden in government, education, aviation, technology, and other sectors, with a negotiation deadline of August 5, 2026.

Threat actor: ExfilSquad

Target verticals: government, education, financial services, aviation, technology, manufacturing, retail, and public sector

Attack technique: targets misconfigured cloud and SaaS portals, CRM platforms, employee portals, and consumer-facing systems. The group also distributes stolen data by torrent, assigning each victim unique trackers and web seeds so the data spreads across peer-to-peer networks. That makes leaked data difficult to remove and raises the reputational and privacy impact.

OctLurk-linked BINDCLOAK targets Middle East governments

A suspected threat group, OctLurk, has been linked to the modular backdoor BINDCLOAK through shared infrastructure and code similarities. It used BINDCLOAK for post-compromise activity against government entities in the Middle East, an expansion from earlier targeting in Central Asia, with recent activity focused on the energy sector. BINDCLOAK includes evasion techniques that prevent detection of API calls originating from unbacked executable memory, generates host identifiers from hostnames and volume serial numbers, and supports core and plugin modules delivered from its command-and-control (C2) infrastructure over encrypted, structured messages on TLS.

Threat actor: OctLurk (suspected cyber-espionage group)

Target verticals: government organizations and the energy sector in the Middle East

AI-fueled attackers shrink patching windows

AI is accelerating adversary operations and shortening patching windows. CrowdStrike reported an 89% year-over-year increase in AI-enabled adversary activity, with threat actors using AI for reconnaissance, credential theft, and evasion, and targeting AI infrastructure through LLMjacking and cost-harvesting. In the first half of 2026, 88% of exploitation involving vulnerabilities with public proof-of-concept code occurred within 48 hours of release, and the groups VAULT PANDA and GENESIS PANDA exploited vulnerabilities within 24 hours. Famous Chollima used AI-generated personas, and Altered Spider compromised over 300 software dependencies in a single day. With 48,200 CVEs published in 2025 and around 43,000 by late July 2026, exposure keeps growing.

Threat actors: Famous Chollima, Altered Spider, VAULT PANDA, and GENESIS PANDA

Target verticals: organizations running AI workloads, cloud environments, software development infrastructure, and enterprise applications

Takeaway: remediation windows need to shrink from days or weeks to hours.

DriveSurge hijacks legitimate websites to deliver malware

DriveSurge is a newly identified actor running large-scale malware delivery through thousands of compromised legitimate websites. It injects obfuscated JavaScript that loads the zTDS traffic distribution system, which profiles visitors by IP, ASN, user agent, and referrer and then redirects selected users to FakeUpdates or ClickFix lures on both Windows and macOS. ClickFix uses fake CAPTCHA or browser-error prompts to trick victims into pasting commands into PowerShell or Terminal. Nopal Cyber assesses DriveSurge as an initial access broker operating a pay-per-install model, with compromised endpoints potentially sold to downstream actors.

Kimsuky (APT43) scales AI-driven espionage

Kimsuky, a North Korean state-sponsored group, expanded Operation GitPower by integrating AI into its established infrastructure. Researchers saw continued use of spear-phishing emails, malicious LNK files, obfuscated PowerShell loaders, scheduled-task persistence, and GitHub-based C2, along with local AI environments using Ollama, GPT4All, and Msty, RAG and agent frameworks, Semantic Kernel, LangChain, and Whisper. The group also uses AI-generated decoy documents and retrieves encrypted payloads disguised as image files from GitHub repositories. It appears to be building an AI-enabled ecosystem for phishing, malware development, intelligence analysis, and automation.

Target verticals: policy organizations, academia, international cooperation organizations, diplomatic missions, military, security and security research, and virtual assets

Lazarus Group exploits a Windows zero-day in Operation Dream Job

Lazarus Group was seen exploiting CVE-2026-68820, a previously undisclosed Windows AFD.sys local privilege-escalation zero-day, in its long-running Operation Dream Job. Attacks begin with fake job offers and impersonation of recruiters from defense and technology organizations, followed by malicious PDFs or trojanized PDF viewers. Researchers identified two infection chains: DLL sideloading to deploy MISTPEN and ForestTiger, and a trojanized SecurityPDF viewer delivering the Troy backdoor. After gaining SYSTEM privileges, Lazarus deploys the FudModule rootkit and uses compromised webmail, WordPress, and other legitimate infrastructure for C2. The campaign targeted defense, aerospace, and aviation organizations in France, Germany, Brazil, and India.

Target verticals: defense, aerospace, aviation, and defense-related technology organizations

ShinyHunters claims Metabase breach through SQL injection

ShinyHunters claimed responsibility for compromising Metabase after exploiting a previously unknown vulnerability. Metabase confirmed that attackers abused a chained vulnerability beginning at the password-reset endpoint, using SQL injection to create an authenticated session and then generate an API key for bulk data access. Metabase said under 3% of its cloud customers were compromised before remediation, with some self-hosted and open-source installations also affected. Fixes were released on August 6 and customers were urged to upgrade immediately. The ShinyHunters attribution is a claim by the group and has not been independently confirmed by Metabase.

Target verticals: organizations using Metabase for business intelligence, data analytics, and cloud-based data services

LiteLLM supply-chain attack exposes developer and cloud secrets

Researchers reported that the LiteLLM compromise was part of the wider TeamPCP campaign that began with the compromise of Aqua Security's Trivy vulnerability scanner. LiteLLM's CI/CD pipeline automatically installed a compromised Trivy release, which let attackers publish malicious LiteLLM versions 1.82.7 and 1.82.8 to PyPI. The package ran automatically through a Python .pth file and harvested Git credentials, CI/CD tokens, AWS, GCP, and Azure credentials, Kubernetes secrets, SSH keys, API keys, environment variables, and cryptocurrency credentials.

CloudSEK estimated exposure across more than 2,500 organizations and about 434,000 CI/CD pipelines. These figures are reconstructed exposure, not confirmed compromise of every organization. Later analysis found more than 95% of the identified organizations were exposed before the malicious LiteLLM packages were published, indicating that the broader Trivy compromise accounted for most of the exposure.

Threat actor: TeamPCP

Target verticals: software development, cloud services, AI/ML infrastructure, technology, financial services, healthcare, government, and organizations using CI/CD pipelines

Jewelbug breaches government webmail while running parallel crypto fraud

Jewelbug (also tracked as Earth Alux and REF7707) was linked to a campaign combining government espionage with cryptocurrency fraud. Researchers saw it compromise a shared webmail platform used by more than 15 government tenants, injecting malicious JavaScript into common templates to steal browser cookies and identify targeted accounts. The campaign collected more than 580,000 browser cookies, several thousand credentials, and over 2,300 email bodies. Jewelbug also used the Antino, ClientKing, and XG-Web tooling against Windows, Linux, ARM64 systems, and ASUS routers, and used public Google Docs to host obfuscated payloads so malicious traffic blends with legitimate cloud services. It also ran SEO poisoning and click fraud to direct cryptocurrency users to fraudulent exchanges.

Target verticals: government, military, telecommunications, defense, education, aviation, and critical infrastructure

TheHatman raids large-enterprise Azure directories

TheHatman, a financially motivated actor, claimed access to Microsoft Azure/Entra environments of multiple large organizations and is selling internal employee-directory data. The datasets reportedly include employee names, corporate email addresses, job titles, departments, reporting relationships, group memberships, service accounts, and privileged account information, which is valuable reconnaissance for spear-phishing, business email compromise, and social engineering. Reported volumes include more than 1.7 million records from McDonald's, about 800,000 from TCS, 425,000 from Vodafone, 250,000 from HCL Technologies, and 185,000 from IHG, with other organizations also listed.

Hudson Rock identified infostealer-compromised Microsoft credentials tied to several of these organizations, but the exact initial access method has not been established, and some affected organizations have disputed or questioned how recent the data is. The activity window ran from August 1 to August 12, 2026, with a total claimed exposure of more than 3.6 million records across 9 organizations.

Target verticals: retail, IT services, telecommunications, hospitality, logistics, and large enterprises

Medusa ransomware expands attacks on critical sectors

Medusa has impacted more than 500 victims as of April 2026, according to an updated joint advisory from CISA, FBI, and HHS issued on August 18, 2026. It operates as a RaaS with double extortion and has primarily affected healthcare and public health, while also targeting the defense industrial base, critical manufacturing, government services, information technology, and financial services. Affiliates gain initial access through phishing and exploitation of vulnerabilities in ScreenConnect, Fortinet EMS, Fortra GoAnywhere, and BeyondTrust, and abuse legitimate remote-access tools such as AnyDesk, Atera, ConnectWise, eHorus, N-able, SimpleHelp, and Splashtop to maintain access and blend in. The advisory notes affiliates can exploit new vulnerabilities within 24 hours of public disclosure.

On its leak site, a recent post included a video of files allegedly from a victim, captioned "Medusa Media Team," which may indicate a branch managing the group's public image. Medusa's victims are broadly distributed across industries and regions, which points to opportunistic targeting.

Saudi automotive marketplace Speero allegedly leaked

A newly registered actor using the alias UNC2030 is allegedly offering a data dump from speero.net, a Riyadh-based automotive parts and maintenance marketplace. The claimed dataset has 83 tables and about 11 GB of CSV data, with a user table of over 1 million records. Exposed fields allegedly include passwords, email verification tokens, password reset codes, and one-time account restoration tokens, plus addresses, wallet balances and transactions, invoices, payment records, and messaging logs. The token fields are the most concerning because, if still valid, they could enable account takeover without passwords. The small payment-card table counts suggest mass card exposure is unlikely. The claim is unverified.

DragonForce ransomware leaks alleged VIP Imaging data

DragonForce publicly claimed an attack on VIP Imaging, a mobile nuclear imaging company in Southern California, and published roughly 8.67 GB of allegedly stolen data after threatening to leak it unless negotiations began. Because the data appears on an active leak site, exposure has likely already occurred. As a healthcare provider handling cardiac imaging, any authentic exposure would carry risks of medical identity theft, insurance and billing fraud, and privacy harm that cannot be undone by changing a password. The claim is unverified and VIP Imaging has not publicly addressed it.

Khilafah Hackers deface Israeli websites

The hacktivist group Khilafah Hackers claimed it defaced five Israeli .co.il websites, reportedly in association with an umbrella group called the Cyber Ummah Alliance. The sites displayed an identical "HACKED" page with religious and political messaging. The operation focuses on defacement and ideological messaging, with no evidence of data theft despite "Data Exposed" claims on the pages. The identical design could indicate a shared access vector such as compromised administrative credentials, a common hosting panel, or shared CMS components.

Indonesia tax data: 100,000 records leaked by K3LLLEAKERS

The hacktivist group K3LLLEAKERS reportedly published a database of more than 100,000 records attributed to Indonesia's Directorate General of Taxes. The dataset allegedly includes tax identification numbers, names, residential addresses, phone numbers, email addresses, occupations, and tax compliance status for individuals across Indonesia. The claim has not been confirmed.

Manchester Airports Group cyberattack exposes data of 8.7 million customers

Manchester Airports Group (MAG), which operates Manchester, London Stansted, and East Midlands airports, disclosed a cyberattack in August 2026 that exposed customer information tied to airport Wi-Fi registrations and parking, lounge, and Fast Track bookings. About 8.7 million customers were affected. Exposed data included names, email addresses, telephone numbers, postcodes, vehicle registration numbers, residential IP addresses, browser information, and booking-related data. MAG said banking and payment information was not compromised and that airport operations, passenger safety, and aviation security were not affected.

The FulcrumSec extortion group claimed responsibility and published about 550 GB of allegedly stolen data after MAG reportedly refused to pay a ransom. FulcrumSec has been active since about September 2025 and specializes in fast exfiltration of cloud-hosted databases by exploiting unrotated API keys and misconfigured cloud permissions rather than deploying encryption. The group also claimed to have obtained MAG platform configuration data, which has not been independently verified.

Vulnerability and exploit intelligence

Open source and enterprise applications

Enterprise network and infrastructure

MITRE ATT&CK mapping

Recommendations

Cloud and identity security

• Enforce phishing-resistant MFA using FIDO2 and passkeys for privileged, remote-access, and cloud identities, particularly Microsoft Entra ID, VPN, administrative, and service accounts.
• Restrict cloud directory and API permissions with least privilege, Privileged Identity Management, conditional access, and regular entitlement reviews.
• Monitor OAuth applications, refresh tokens, session cookies, and third-party integrations for unauthorized persistence and token abuse.
• Protect service accounts and cloud workload identities: remove unnecessary privileges, use short-lived credentials, and block interactive logins where not required.
• Delete cloud resources that are not in use.

Infrastructure and vulnerability management

• Prioritize remediation of internet-facing vulnerabilities, particularly Fortinet FortiOS, FortiProxy, FortiWeb, and FortiManager, macOS Screen Sharing, PostgreSQL, GitLab AI Gateway, Metabase, and other externally accessible enterprise applications.
• Treat actively exploited and KEV-listed vulnerabilities as emergency items, with remediation measured in hours or days rather than normal patch cycles.
• Keep a continuously updated inventory of internet-facing assets: VPN gateways, firewalls, cloud portals, SaaS applications, databases, APIs, and remote-management infrastructure.
• Monitor for exploitation of public-facing applications through WAF, firewall, IDS/IPS, EDR, and application logs, with attention to authentication bypass and RCE attempts.
• Disable unnecessary services and insecure protocols, including exposed management interfaces and legacy network-management mechanisms.
• Segment internet-facing infrastructure, identity services, production systems, databases, and backup environments.
• Continuously assess AI infrastructure and APIs for unauthorized access, excessive permissions, exposed credentials, SSRF, and cloud-resource abuse.
• Prioritize remediation by exploitability: active exploitation, public proof-of-concept code, exposed attack surface, or ransomware association.

Email and endpoint protection

• Strengthen email security against spear-phishing, fake recruitment campaigns, malicious PDFs, credential harvesting, vishing, and AI-generated social engineering.
• Deploy and tune EDR detections for PowerShell, Python, Terminal, DLL sideloading, suspicious PDF-reader execution, credential theft, reverse SSH tunnels, and ransomware behavior.
• Detect ClickFix-style attacks by monitoring PowerShell or Terminal execution that originates from browsers, fake CAPTCHA pages, browser error pages, and clipboard-based commands.
• Block or restrict unapproved remote-management tools such as AnyDesk, Atera, ConnectWise, eHorus, N-able, SimpleHelp, and Splashtop unless explicitly approved and monitored.
• Run recurring phishing simulations and awareness training on fake job offers, device-code phishing, vishing, ClickFix, malicious documents, and AI-generated lures.

Appendix

Threat actors observed

Malware families observed

Indicators of compromise (IP addresses, domains, file hashes, and URLs) for the Gunra, ExfilSquad, OctLurk, DriveSurge, Kimsuky, and Jewelbug campaigns are in the downloadable PDF.

Methodology

Collection period

August 2026

Data source

Prepared by the EnCyb Cyber Threat Intelligence team as a monthly overview of significant incidents, threat actor activity, and security developments, with a focus on events linked to geopolitical tension and emerging threats. The source report is marked TLP:GREEN.

Limitations

Many incidents are based on threat-actor claims published on leak sites or dark web forums, or on media reports, and several remain unverified or unconfirmed by the affected organizations. Attribution is as reported and may change.

Frequently asked questions

Which threat actors were most active in August 2026?

Ransomware and extortion groups led the month: Gunra, Medusa, ExfilSquad, TheHatman, FulcrumSec, DragonForce, and ShinyHunters. State-linked activity included Lazarus Group, Kimsuky, OctLurk, and Jewelbug, alongside the DriveSurge initial access broker.

Which sectors were targeted most in August 2026?

The top five targeted sectors were finance, technology, government, healthcare, and education.

What are the most important defensive actions from this report?

Enforce phishing-resistant FIDO2/passkey MFA for privileged and cloud identities, treat actively exploited and KEV-listed vulnerabilities as emergency items measured in hours or days, keep a current inventory of internet-facing assets, restrict unapproved remote-management tools, and detect ClickFix-style execution from browsers.