Threat Intel Report - July 2026

Executive summary

July 2026 was characterized by a significant increase in identity-focused attacks, AI-assisted malware, supply-chain compromises, cloud credential theft, and exploitation of internet-facing infrastructure. Threat actors increasingly targeted authentication systems, enterprise VPNs, Microsoft 365 environments, CI/CD platforms, and cloud services to gain persistent access while minimizing traditional malware deployment. Financially motivated ransomware groups continued to prioritize data theft and extortion, whereas state-sponsored actors focused on long-term cyber espionage against government and critical infrastructure.

The period also highlighted the growing operational use of AI in offensive cyber operations, with campaigns such as JADEPUFFER demonstrating autonomous attack capability. Sophisticated phishing campaigns targeting Microsoft passkey enrollment, software supply-chain attacks, dark web data sales, and large-scale credential theft continued to reshape the enterprise threat landscape.

Modern adversaries are adopting identity-first strategies and using trusted cloud services, legitimate administration tools, and AI-enabled capabilities to evade traditional controls. Organizations should take a defense-in-depth approach: stronger identity security, faster vulnerability remediation, better monitoring of cloud environments, proactive threat hunting, and enterprise-wide cyber awareness.

Global threat overview

Top 5 target sectors: finance, technology, government, healthcare, and aerospace.

Top 5 risks: ransomware, vulnerability exploitation, data breach, DDoS, and supply chain.

The full report PDF includes a chart of the most active malware families.

Notable campaigns and events

Qilin ransomware exploits Palo Alto GlobalProtect (CVE-2026-0257)

Researchers confirmed that the Qilin ransomware-as-a-service group is actively exploiting a critical authentication bypass in the Palo Alto Networks PAN-OS GlobalProtect portal and gateway (CVE-2026-0257) for initial access. Investigators identified multiple intrusions in June 2026 in which attackers exploited vulnerable internet-facing GlobalProtect VPN appliances before deploying Qilin ransomware. Attacks ranged from rapid encryption to full double-extortion with data theft, showing ransomware affiliates' growing focus on VPN gateways and firewalls as entry points.

Threat actor: Qilin (ransomware-as-a-service)

Target verticals: financial services, government, manufacturing, healthcare, technology, critical infrastructure, and any organization with internet-facing GlobalProtect appliances

Attack technique: affiliates use the bypass to establish VPN connections without valid credentials, then perform reconnaissance, establish persistence, move laterally, escalate privileges, and deploy ransomware. Organizations with unpatched appliances, authentication override cookies enabled, or insecure certificate configurations are at increased risk and should apply vendor updates and mitigations immediately.

Targeted attack on government entities in the Middle East

A cyber-espionage campaign in July 2026, linked to an East Asia-based actor, targeted government organizations in the Middle East. Researchers analyzed post-compromise activity and identified three previously undocumented malware families: TELESHIM, MIXEDKEY, and BINDCLOAK, used in a multi-stage attack with different roles in maintaining access and controlling systems. TELESHIM communicates through the Telegram API, so its traffic blends in with legitimate Telegram use.

Attack technique: TELESHIM and MIXEDKEY use multiple obfuscation techniques. TELESHIM also checks for virtual machines and analysis environments and exits if it finds one. BINDCLOAK is encrypted with the infected system's disk volume serial number, so it only decrypts and runs on the intended victim's machine.

Post-compromise activity: observed command-and-control activity included system, user, and network reconnaissance, file discovery in key directories, creation of a scheduled task that runs every 10 minutes to launch the next stage, and connectivity checks. Most activity occurred between 7 and 9 July 2026, always between 04:00 and 12:00 UTC, concentrated between 07:00 and 11:00 UTC. The lures were archive and ISO files named as bilateral cooperation and border-office agreements.

Dark web broker advertises hotel FortiGate access

A seller on a dark web forum offered what they describe as full super-administrator access to the FortiGate firewall of a hotel property in Bahrain, with screenshots of the management interface as proof. The claim is unverified and the property has not addressed it. A firewall is the boundary everything else sits behind: super-admin access would expose the internal network layout and allow policy changes, and the ability to create VPN accounts persists because those credentials survive remediation elsewhere. Edge-appliance access is a standard opening move in ransomware intrusions, which is what such listings are typically sold for.

Bank of Baroda breach claimed by Triple X

On 24 July 2026, the Triple X ransomware group claimed to have exfiltrated 1 TB of data from the Indian public-sector bank. The full dump was reportedly publicly accessible on Tor, with over 92,000 files observed in initial analysis, including customer KYC records, security reports, and internal audit documents.

According to the group, the breach was enabled by a weak password. The likely sequence was compromised credentials for initial access, lateral movement through the internal network, access to SharePoint and file-server infrastructure, extended exfiltration of about 1 TB of documents, and public publication. The dump reportedly covers customer KYC, legal and audit documents, loan records, vulnerability assessment reports, network and firewall configurations, employee workspaces, international operations, and transaction data. The compromised file server reportedly held operational data from 62 top-level branches and more than 12 international locations, so virtually any customer could be affected. These figures are indicative and analysis was ongoing.

JADEPUFFER agentic ransomware campaign

JADEPUFFER is described as the first publicly reported Agentic Threat Actor (ATA): it autonomously ran a complete ransomware and database extortion operation using a large language model (LLM). Unlike traditional ransomware that relies on human operators, it exploited vulnerable AI infrastructure, performed reconnaissance, harvested credentials, moved laterally, established persistence, and encrypted production databases with minimal human intervention.

The campaign targeted internet-facing Langflow instances vulnerable to CVE-2025-3248, an unauthenticated remote code execution flaw, and ultimately compromised downstream MySQL and Alibaba Nacos servers. Researchers saw the AI agent adapt its steps, rewrite failed commands, and generate self-narrating payloads. The ransom note artifacts did not match known MySQL ransomware conventions, raising questions about whether the campaign was manually operated or partly generated by LLMs. Persistence was a cron job beaconing to the attacker's server every 30 minutes.

Threat actor: JADEPUFFER (agentic threat actor, AI-driven ransomware)

Target verticals: organizations deploying AI/LLM infrastructure, technology, cloud service providers, software development, AI/ML platforms, financial services, manufacturing, and enterprises with internet-facing Langflow or exposed database services

Malaysian tax authority data offered for sale

A threat actor using the alias "dezetat" is offering what is claimed to be a database stolen from Malaysia's Inland Revenue Board (LHDN/IRBM) through its MyTax portal. The listing advertises about 10 million taxpayer records, allegedly exfiltrated in June 2026, for US$20,000. The seller claims it holds sensitive personal and financial information, and that about 5.29 million records also include bank account details. The authenticity of these claims has not been independently verified.

Pro-Iran hacktivist groups launch DDoS and hack-and-leak attacks

Coordinated disruption campaigns by multiple pro-Iran hacktivist groups increased against critical infrastructure, government organizations, technology providers, and entities seen as supporting US, Israeli, or Western interests. The campaigns focus on DDoS attacks, website defacements, credential-focused operations, hack-and-leak activity, and disinformation. Rather than a central command structure, the groups collaborate through Telegram channels, shared target lists, commercial DDoS-for-hire services, and coordinated social media campaigns. Reporting also highlights the Handala Hack Team's claimed destructive activity against Stryker through compromised privileged credentials and legitimate Microsoft Intune remote management, showing a reliance on trusted administrative tools instead of custom malware.

Threat actors: Cyber Fattah, Fatimiyoun (FAD Team), Dark Storm, Keymous+, DieNet, RipperSec, Cyb3rDrag0nz, Handala Hack Team, NoName057(16), Killnet, and other Iran-aligned hacktivist collectives

Target verticals: government, critical infrastructure, telecommunications, healthcare, financial services, logistics, cloud service providers, technology organizations, open-source infrastructure, and organizations aligned with US, Israeli, or Western interests

FSB Center 16 router compromise campaign

Researchers and several government agencies identified ongoing activity by FSB Center 16, a Russian state-sponsored actor (also tracked as Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, and Static Tundra), against vulnerable network infrastructure worldwide. The campaign exploits weak SNMP credentials, Cisco Smart Install (including devices vulnerable to CVE-2018-0171), and insecure protocols such as TFTP to compromise routers, establish persistence, and enable follow-on attacks. A joint advisory from the NSA, CISA, FBI, and international partners urges organizations to harden router configurations, disable unnecessary management services, use secure protocols, and keep firmware current.

Target verticals: communications, telecommunications, defense, energy, financial services, government, healthcare, critical infrastructure, ISPs, and enterprises operating network infrastructure

Attack technique: attackers abuse SNMP Set-Requests and default community strings to retrieve or modify configurations, use spoofed IP addresses to hide their origin, and move configuration files over TFTP or compromised intermediaries. Routers often lack EDR visibility, which makes persistent access and collection of network configuration data harder to detect.

Mitigations: disable Cisco Smart Install where not required, use SNMPv3 with authentication and privacy (authPriv), replace default community strings, restrict management interfaces to trusted networks, disable TFTP and other unneeded services, apply firmware updates, monitor for unauthorized configuration changes and anomalous SNMP or TFTP activity, and segment the network.

RapidFort allegedly breached in the CanisterWorm campaign

A threat actor, xpl0itrs, is advertising data they claim to have taken from RapidFort, a US container hardening and software supply-chain security vendor. The listing attributes the intrusion to a campaign called CanisterWorm carried out with TeamPCP, and describes 569 GB across 140,061 files from 48 S3 buckets, including hardening pipelines, a vulnerability database pipeline, scanner backends, DevOps infrastructure, and billing exports. The seller claims the data includes plaintext cloud credentials, Kubernetes kubeconfigs, and private keys, dates to March, and that customers were never notified. The asking price is $40,000, negotiable. The claim is unverified.

Armored Likho APT and the BusySnake stealer

Armored Likho is a previously undocumented threat actor running targeted espionage and financially motivated campaigns against government agencies, electric power organizations, and private individuals, mainly in Russia, Kazakhstan, and Brazil. It relies on spear-phishing emails posing as official government communications, humanitarian assistance, and social program documents. A key component is BusySnake Stealer, a newly discovered Python-based information stealer with advanced obfuscation, anti-analysis, and persistence. Researchers also saw evidence of AI-generated loaders and stagers in the early stages of infection, letting the attackers diversify delivery quickly.

Threat actor: Armored Likho (with overlaps to the Eagle Werewolf cluster)

Target verticals: government, electric power, critical infrastructure, public sector, defense-related organizations, and selected private individuals

Attack technique: emails deliver malicious RAR archives, executables, or LNK files disguised as government or financial documents. AI-assisted loaders retrieve and deploy BusySnake while showing a decoy document. The malware persists through scheduled tasks, uses PyArmor Pro obfuscation, and steals browser credentials, cookies, Telegram sessions, cryptocurrency wallet data, OTP secrets, screenshots, keystrokes, and files. It also enables remote access via reverse SSH tunnels or RustDesk.

Defenses: strengthen email security, deploy EDR, enforce phishing-resistant MFA, monitor scheduled tasks, PowerShell and Python activity, reverse SSH and RustDesk usage, and hunt proactively for BusySnake.

AI-powered Microsoft 365 phishing with the Jalisco and OmegaLord toolkits

Researchers identified phishing campaigns against Microsoft 365 users using the Jalisco and OmegaLord toolkits. Jalisco abuses Microsoft's OAuth device code authentication flow to steal access and refresh tokens. OmegaLord harvests credentials and phone numbers by masquerading as a PDF reader. Researchers also saw increased use of AI to generate lures and automate campaigns at scale. Successful attacks give persistent access to Outlook, Teams, OneDrive, and SharePoint without the victim's password after the token is compromised.

Threat actors: cybercriminals and phishing-as-a-service operators using the Jalisco and OmegaLord toolkits

Target verticals: government, financial services, healthcare, technology, manufacturing, education, professional services, critical infrastructure, and any organization using Microsoft 365

Pink vishing campaign targeting Microsoft Entra passkey enrollment

O-UNC-066 (Pink), a financially motivated group conducting vishing-based account takeover and data extortion, targets organizations using Microsoft Entra ID and Microsoft 365. Attackers impersonate IT support and trick victims into enrolling attacker-controlled passkeys through fake Entra registration pages. This gives persistent account access without breaking the cryptographic security of passkeys, showing that social engineering remains effective even against phishing-resistant authentication.

Target verticals: automotive, aviation, construction, food and beverage, healthcare, technology, government, financial services, and any organization using Entra ID and Microsoft 365 with passkey enrollment enabled

Threat analysis: the campaign uses target-specific phishing subdomains that mimic each organization's Entra sign-in page and branding. Unlike traditional adversary-in-the-middle kits, it relies on an operator-controlled panel that interacts with victims in real time and adapts the flow to the MFA method in use: TOTP, push notifications with number matching, or SMS codes. The operator captures the password within seconds and enters it at the legitimate Microsoft sign-in page.

Passkey deception: after the victim approves the attacker's access, the kit sends them to a fake passkey registration page that asks them to save an attacker-controlled BIP-39 recovery phrase, resembling cryptocurrency wallet seed generation, and displays a fake "setup complete" page. In reality the attacker registers their own passkey directly with Microsoft. Since April 2026, an actor linked to O-UNC-066 has operated a data leak site named Pink for data extortion. Phishing infrastructure was hosted on DDoS-Guard and IQWeb FZ-LLC.

The Gentlemen ransomware campaign

The Gentlemen is a financially motivated ransomware-as-a-service operation (also tracked by Microsoft as Storm-2697) that emerged in late 2025 after a public dispute between its suspected administrator and members of the Qilin affiliate program. It then launched an independent operation and began recruiting affiliates in underground communities. Analysis of leaked internal communications shows a structured affiliate business model combining credential acquisition, remote access abuse, ransomware deployment, and double extortion, with an advertised profit share of up to 90% for affiliates. The platform includes tools for creating and tracking victim engagements, which suggests a mature affiliate-driven business rather than an informal collective. It runs both Tor-based and clear-web leak sites with victim names, industry information, descriptions of allegedly stolen data, and countdown timers for release if negotiations fail. A partnership announcement with BreachForums was also observed.

Target verticals: manufacturing, healthcare, government, energy, financial services, telecommunications, transportation, critical infrastructure, technology, education, retail, and enterprises worldwide

Everest ransomware group claims breach

Everest has been active since late 2020 and is known for double extortion. It has increasingly shifted toward data extortion without encryption, using phishing, stolen credentials, and exploitation of public-facing vulnerabilities, and publishes stolen data on a Tor leak site. The group claimed an attack on Al-Futtaim, one of the Middle East's largest business groups, alleging about 307 GB and more than 161,000 files, including corporate and financial records, HR files, customer information, identity documents, SAP data, email archives, engineering drawings, and operational documentation. The claims have not been independently verified. Everest's victim list spans government agencies, healthcare providers, financial institutions, manufacturers, and technology companies across multiple regions.

Vulnerability and exploit intelligence

Enterprise network and infrastructure

Microsoft July 2026 Patch Tuesday

Microsoft's July security update addresses 663 vulnerabilities, including 59 critical flaws and three actively exploited zero-days. It resolves remote code execution, elevation of privilege, authentication bypass, and information disclosure issues across Windows, Office, SharePoint, Hyper-V, AD FS, and other products. Several are in the CISA KEV catalog, so organizations should prioritize immediate deployment.

Open source and enterprise applications

MITRE ATT&CK mapping

Recommendations

Cloud and identity security

• Enforce phishing-resistant multi-factor authentication and adopt passkey-based authentication where appropriate.
• Monitor OAuth applications, authentication tokens, and Microsoft 365 sign-in anomalies.
• Rotate exposed credentials, API keys, VPN certificates, and cloud service accounts immediately after suspected compromise.
• Use IP allowlisting for access to internet-facing production assets.
• Apply least-privilege access across cloud identities, repositories, and CI/CD environments.
• Delete cloud resources that are not in use.

Infrastructure and vulnerability management

• Prioritize remediation of internet-facing vulnerabilities, particularly VPN appliances, SharePoint, Active Directory Federation Services, Chrome, Fortinet, and network infrastructure devices.
• Disable unnecessary management services, enforce secure router configurations, and replace default SNMP credentials.
• Continuously monitor for exploitation attempts against publicly exposed applications and network devices.
• Maintain a comprehensive asset inventory and keep internet-facing systems patched.
• Adopt a Zero Trust approach: least-privilege access, network segmentation, and periodic reviews of user and service account permissions.

Email and endpoint protection

• Strengthen email security controls to detect phishing, vishing, malicious attachments, and credential harvesting.
• Deploy EDR that can identify credential theft, reverse SSH activity, scheduled task abuse, and Python and PowerShell execution.
• Run periodic awareness training on device-code phishing, passkey enrollment abuse, and AI-generated social engineering.

Appendix

Threat actors observed

Malware families observed

Indicators of compromise (file hashes, IP addresses, domains, and URLs) for the East Asia-linked campaign, JADEPUFFER, Armored Likho, and the Jalisco, OmegaLord, and Pink phishing infrastructure are in the downloadable PDF.

Methodology

Collection period

July 2026

Data source

Prepared by the EnCyb Cyber Threat Intelligence team as a monthly overview of significant incidents, threat actor activity, and security developments, with a focus on events linked to geopolitical tension and emerging threats. The source report is marked TLP:GREEN.

Limitations

Many incidents are based on threat-actor claims published on leak sites or dark web forums, or on media reports, and several remain unverified or unconfirmed by the affected organizations. Attribution is as reported and may change.

Frequently asked questions

Which threat actors were most active in July 2026?

Ransomware and extortion groups led the month: Qilin, The Gentlemen, Everest, Triple X, and the AI-driven JADEPUFFER. TeamPCP continued its supply-chain activity, the O-UNC-066 (Pink) group ran passkey-enrollment vishing, FSB Center 16 compromised routers, and Iran-aligned hacktivist groups ran DDoS and hack-and-leak campaigns.

Which sectors were targeted most in July 2026?

The top five targeted sectors were finance, technology, government, healthcare, and aerospace.

What are the most important defensive actions from this report?

Enforce phishing-resistant MFA and monitor OAuth apps and Microsoft 365 sign-in anomalies, patch internet-facing VPNs, SharePoint, AD FS, Fortinet, and Chrome first, harden routers (disable Smart Install, use SNMPv3), and train users on device-code phishing, passkey-enrollment abuse, and AI-generated social engineering.