10 mincritical
20th July – Threat Intelligence Report
This weekly threat intelligence report covers major breaches including Ernst & Young, Coca-Cola's Fairlife subsidiary, and Nihon Kotsu, along with a Jscrambler npm supply chain compromise. Six critical CVEs were disclosed across Microsoft, WordPress, and SonicWall products, with four under active exploitation by ransomware operators. AI-enabled threats are highlighted including China-linked actors using Claude Code and DeepSeek for automated attack generation, and weaknesses in AI coding assistants exposing source code and credentials. Threat actor campaigns from ShinyHunters, CylindricalCanine/GoldenEyeDog, and Spirals ransomware are also documented.
Sens:■ ImmediateConf:
Detection / Hunteropenrouter
What Happened
Multiple organizations including Ernst & Young, Coca-Cola's Fairlife subsidiary, and Japan's largest taxi operator Nihon Kotsu disclosed breaches or attacks this week. A popular JavaScript tool called Jscrambler was compromised to distribute malware that steals developer credentials. Several critical software vulnerabilities were disclosed in Microsoft, WordPress, and SonicWall products, with some already being used by ransomware groups to break into systems. Researchers also found that AI coding assistants and tools can be misused by attackers to automate hacking, or can accidentally leak sensitive source code and credentials. Organizations should prioritize patching the disclosed vulnerabilities, review third-party software dependencies, and evaluate how AI tools in their environment handle sensitive data.
Key Takeaways
- Microsoft's July 2026 Patch Tuesday addressed 622 vulnerabilities, the largest monthly release ever, with two actively exploited privilege escalation flaws in SharePoint Server (CVE-2026-56164) and ADFS (CVE-2026-56155).
- WordPress issued emergency updates for wp2shell vulnerabilities (CVE-2026-63030, CVE-2026-60137) enabling unauthenticated remote code execution on versions 6.9.0–6.9.4 and 7.0.0–7.0.1.
- SonicWall SMA 1000 Series gateways have two critical unauthenticated RCE vulnerabilities (CVE-2026-15409, CVE-2026-15410) being actively exploited by Inc ransomware operators.
- Jscrambler npm package suffered a supply chain compromise via stolen publishing credentials, distributing malware that targeted developer, cloud, browser, cryptocurrency, and messaging credentials.
- China-linked actors used Claude Code and DeepSeek AI tools to automate attacks including exploit adaptation, credential harvesting page generation, and command execution against government and financial targets.
Affected Systems
- Microsoft SharePoint Server
- Microsoft Active Directory Federation Services
- WordPress Core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1
- SonicWall SMA 1000 Series gateways
- Jscrambler npm package (affected versions removed)
- Anthropic Claude for Chrome extension
- xAI Grok Build coding assistant
- Salesforce environments via OAuth integrations
Vulnerabilities (CVEs)
copy:
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-56164 | Microsoft SharePoint Server | High | Authentication bypass vulnerability in SharePoint Server that allows attackers to elevate privileges; under active exploitation. |
| CVE-2026-56155 | Microsoft Active Directory Federation Services | High | Privilege escalation vulnerability in ADFS that allows attackers to elevate privileges; under active exploitation. |
| CVE-2026-63030 | WordPress Core (versions 6.9.0–6.9.4, 7.0.0–7.0.1) | Critical | Authentication bypass vulnerability enabling unauthenticated remote code execution and website takeover; part of wp2shell. |
| CVE-2026-60137 | WordPress Core (versions 6.9.0–6.9.4, 7.0.0–7.0.1) | Critical | SQL injection vulnerability enabling unauthenticated remote code execution and website takeover; part of wp2shell. |
| CVE-2026-15409 | SonicWall SMA 1000 Series gateways | Critical | Server-side request forgery vulnerability allowing unauthenticated attackers to execute system commands on vulnerable appliances; actively exploited by Inc ransomware. |
| CVE-2026-15410 | SonicWall SMA 1000 Series gateways | Critical | Path traversal vulnerability allowing unauthenticated attackers to execute system commands on vulnerable appliances; actively exploited by Inc ransomware. |
Attack Chain
- Initial Access: Multiple vectors including exploitation of unpatched SharePoint/ADFS vulnerabilities, SonicWall gateway flaws, WordPress wp2shell RCE, npm supply chain compromise, and voice phishing for OAuth approval.
- Execution: Attackers deployed malware via compromised npm packages, used IIS web shells for Spirals ransomware, and leveraged AI tools to generate exploit scripts and credential-harvesting pages.
- Persistence: OAuth application approvals provided persistent API access to Salesforce environments; code-signing certificates stolen from DigiCert enabled trust for malware payloads.
- Lateral Movement: Spirals ransomware used WMI and PsExec to spread across networks; Inc ransomware exploited SonicWall appliances as perimeter entry points.
- Impact: Ransomware encryption halted production at Fairlife and disrupted Nihon Kotsu operations; Spirals achieved full network encryption within 24 hours of initial access.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: Check Point IPS
The article references Check Point IPS protections for CVE-2026-56164, CVE-2026-63030, CVE-2026-60137, CVE-2026-15409, and CVE-2026-15410, but no specific detection rule content is provided in the article itself.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR would detect post-exploitation behaviors like PsExec usage, WMI execution, and web shell activity described in the Spirals ransomware campaign, but initial exploitation of perimeter devices and OAuth abuse may not generate endpoint telemetry. |
| Network Visibility | Medium | Network-based detection could identify exploitation attempts against SharePoint, WordPress, and SonicWall appliances, but OAuth API abuse through legitimate cloud services and AI tool communications would blend with normal traffic. |
| Detection Difficulty | Hard | Multiple attack vectors span perimeter exploitation, cloud OAuth abuse, supply chain compromise, and AI-assisted attacks. Each requires different telemetry sources and detection logic. Legitimate OAuth API access and npm package updates are difficult to distinguish from malicious use without behavioral baselining. |
Required Log Sources
- Web server logs for WordPress and SharePoint
- SonicWall SMA gateway appliance logs
- OAuth application approval audit logs (Microsoft 365 / Salesforce)
- EDR process creation and lateral movement telemetry
- WMI event logs (Microsoft-Windows-WMI-Activity/Operational)
- PowerShell operational logs
- npm package registry audit logs
- Cloud access security broker (CASB) logs for Salesforce API access
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for new OAuth application approvals in your cloud tenant that were authorized outside of normal change management windows, particularly those followed by API data access patterns consistent with CRM data exfiltration. | Azure AD audit logs, Salesforce login history and API usage logs, OAuth grant audit logs | Persistence / Credential Access | Medium — legitimate OAuth app approvals during normal business operations may generate similar events. |
| Consider hunting for IIS web shell activity by looking for unusual HTTP requests to ASPX or other scriptable files in web directories, especially those executing system commands or performing process creation. | IIS W3SVC logs, EDR file creation and process execution telemetry, Windows Event Log for application pool identity process creation | Execution | Low — web shells in production IIS directories are rarely legitimate. |
| Consider hunting for lateral movement via PsExec and WMI originating from web servers or perimeter systems, as described in the Spirals ransomware campaign. | EDR remote thread injection events, Windows Event Log ID 4624 (Type 3 network logons), Sysmon Event ID 1 for PsExec service binary creation, WMI operational logs | Lateral Movement | Medium — PsExec and WMI are used legitimately by IT administrators. |
| Consider hunting for npm package updates that were followed by unexpected network connections to non-standard domains or credential file access patterns, as seen in the Jscrambler supply chain compromise. | Endpoint network connection logs, EDR file access monitoring for credential stores, npm install logs, proxy logs | Initial Access / Execution | High — npm package installations are routine in development environments. |
| Consider hunting for exploitation attempts against SonicWall SMA 1000 Series appliances by monitoring for unauthenticated requests that result in system command execution or unusual outbound connections from the appliance. | SonicWall appliance logs, network firewall logs, SIEM correlation of perimeter appliance traffic with internal lateral movement indicators | Initial Access | Low — unauthenticated command execution on SMA appliances is anomalous. |
Control Gaps
- Perimeter appliance exploitation (SonicWall SMA) may bypass endpoint-focused controls entirely if the appliance is not instrumented with EDR or detailed logging.
- OAuth application abuse through legitimate cloud APIs would not be caught by traditional network security monitoring since traffic uses authenticated cloud service endpoints.
- AI-assisted attack generation (Claude Code, DeepSeek) occurs outside the target environment and would not be visible to defender telemetry until the generated artifacts are deployed.
- Supply chain compromises via npm publishing credentials may not trigger alerts if the package is a legitimate dependency already approved by software composition analysis tools.
- Voice phishing for OAuth approval bypasses email-based phishing controls entirely.
Key Behavioral Indicators
- New OAuth application grants followed by CRM API data access from previously unseen source IPs or user agents.
- IIS worker process (w3wp.exe) spawning child processes such as cmd.exe or powershell.exe, consistent with web shell execution.
- PsExec service binary (PSEXESVC.exe) creation on systems not typically managed via remote administration tools.
- WMI event consumer creation that launches executables or scripts, especially from web server process context.
- Rapid encryption activity across multiple file shares within a 24-hour window, consistent with Spirals ransomware behavior.
- npm package version updates that introduce new post-install scripts or unexpected network connections to non-registry endpoints.
False Positive Assessment
Medium — Several described behaviors (PsExec usage, WMI execution, npm package updates, OAuth approvals) are common in normal enterprise operations and would require behavioral baselining and correlation to distinguish malicious from benign activity.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Prioritize patching Microsoft SharePoint Server (CVE-2026-56164) and ADFS (CVE-2026-56155) as both are under active exploitation.
- If your organization runs WordPress Core versions 6.9.0–6.9.4 or 7.0.0–7.0.1, consider upgrading immediately to 6.9.5 or 7.0.2 to address the wp2shell unauthenticated RCE vulnerabilities.
- If SonicWall SMA 1000 Series gateways are deployed, consider applying the hotfix for CVE-2026-15409 and CVE-2026-15410 and reviewing logs for signs of exploitation, given active Inc ransomware targeting.
- If Jscrambler is used in your development environment, consider auditing npm package versions and rotating any developer, cloud, browser, cryptocurrency, and messaging credentials that may have been exposed.
Infrastructure Hardening
- Consider implementing network segmentation to isolate SonicWall SMA appliances and limit lateral movement opportunities from perimeter devices.
- Evaluate whether OAuth application approval policies in your cloud tenant can be tightened to require admin consent for new applications.
- Consider deploying a cloud access security broker (CASB) or equivalent to monitor and alert on anomalous API access patterns in Salesforce and other SaaS platforms.
- If applicable, consider enabling enhanced logging on IIS web servers to detect web shell installation and command execution activity.
User Protection
- Consider deploying EDR coverage to all endpoints including development machines that install npm packages, to detect post-compromise credential theft behaviors.
- Evaluate whether browser extension policies can restrict or monitor Claude for Chrome and similar AI assistant extensions, given the impersonation vulnerability described.
- Consider implementing conditional access policies that restrict OAuth token usage to compliant devices and expected geographic regions.
Security Awareness
- Consider incorporating voice phishing (vishing) awareness into existing security training programs, emphasizing that attackers may call employees to authorize OAuth application approvals.
- Consider reminding development teams to verify npm package integrity and review post-install scripts when updating dependencies.
- If AI coding assistants are used in your environment, consider training developers on the risk of accidental source code and credential exposure through tool uploads.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping10 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Privilege Escalation
Tactic
Defense Impairment
Tactic
Credential Access
Tactic
