# Threat Intel Brief — July 7, 2026

TL;DR

  • Critical vulnerabilities under active exploitation: Adobe ColdFusion (CVE-2026-48282) and Gitea Docker (CVE-2026-20896) are being targeted in the wild; immediate patching required.
  • 16-year-old KVM hypervisor flaw (CVE-2026-53359) enables VM escape on Intel/AMD systems with public proof-of-concept available; critical risk for cloud and virtualization infrastructure.
  • Social engineering campaigns leverage fake job interviews and Microsoft Teams IT support impersonation to deploy credential theft and EtherRAT malware.
  • State-sponsored activity: Iran MOIS-affiliated actors deploy Cavern C2 framework against Israeli targets; China-nexus group conducts Operation DragonReturn against Indian finance sector.

Critical Threats

Adobe ColdFusion Zero-Day Exploitation (CVE-2026-48282)

What happened: A maximum-severity vulnerability in Adobe ColdFusion is now under active exploitation in the wild, confirmed by vulnerability intelligence firm KEVIntel. Technical details remain limited, but the critical CVSS rating indicates likely remote code execution or authentication bypass capabilities.

Impact: Organizations running Adobe ColdFusion face immediate compromise risk. Expect CISA to add this vulnerability to the Known Exploited Vulnerabilities catalog. Affected systems should be considered at critical risk until patched. The active exploitation status means threat actors have working exploits and are scanning for vulnerable instances.

Recommendations:

  • Identify all ColdFusion instances via asset inventory and network scanning within the next 4 hours
  • Apply Adobe security patches immediately upon release; monitor Adobe Security Bulletin (APSB) pages
  • If patches are unavailable, isolate ColdFusion servers from internet exposure or take systems offline
  • Review ColdFusion access logs and web server logs for suspicious POST requests, unusual file uploads, or unexpected administrative access from the past 72 hours
  • Monitor endpoint detection telemetry on ColdFusion hosts for indicators of compromise

---

Linux KVM Hypervisor VM Escape (CVE-2026-53359)

What happened: Researchers disclosed a 16-year-old use-after-free vulnerability in the Linux KVM hypervisor affecting Intel and AMD x86 systems. The flaw, dubbed "Januscape," exists in KVM's shadow MMU code and allows guest virtual machines to corrupt the host kernel's shadow-page state. A public proof-of-concept can crash the hypervisor host, and researchers claim an unreleased exploit may achieve full VM escape.

Impact: Critical risk for multi-tenant cloud environments, virtualization infrastructure, and hosting providers. Successful exploitation allows malicious or compromised guest VMs to crash the hypervisor (denial of service) or potentially escape VM isolation to execute code on the host kernel, compromising all co-located VMs. The 16-year age means widespread deployment across production infrastructure including QEMU/KVM, Proxmox, oVirt, and OpenStack environments.

Recommendations:

  • Apply vendor security patches for CVE-2026-53359 immediately on all KVM hypervisor hosts, prioritizing multi-tenant and untrusted workload environments
  • Audit and restrict VM deployment permissions to trusted users only until patching is complete
  • Monitor hypervisor host logs for unexpected kernel panics or KVM module crashes
  • Consider temporarily migrating high-risk untrusted VMs to isolated hypervisor clusters
  • Verify patch deployment across all KVM hosts including edge deployments, development environments, and disaster recovery sites

---

Gitea Docker Authentication Bypass (CVE-2026-20896)

What happened: Threat actors began probing a critical authentication bypass vulnerability (CVSS 9.8) in Gitea Docker images just 13 days after public disclosure. The flaw allows unauthenticated remote attackers to gain elevated privileges by exploiting improper trust of the X-WEBAUTH-USER HTTP header from any source IP address.

Impact: Unauthenticated attackers can bypass authentication and escalate privileges with low attack complexity. Organizations running Gitea in Docker containers face immediate risk of unauthorized repository access, source code tampering, credential theft, and potential supply chain compromise. The rapid shift from disclosure to active reconnaissance indicates imminent exploitation attempts.

Recommendations:

  • Identify all Gitea Docker deployments and verify versions against vendor security advisories immediately
  • Apply vendor patches or implement WAF rules to strip X-WEBAUTH-USER headers from untrusted sources
  • Review authentication logs for anomalous privilege escalation or suspicious header injection attempts
  • Restrict Gitea access to trusted networks via firewall rules or VPN if patching is delayed
  • Audit user accounts and repository access logs for unauthorized changes since the disclosure date

---

Microsoft Teams Social Engineering Campaign (EtherRAT)

What happened: Threat actors are conducting voice-based social engineering attacks via Microsoft Teams, impersonating IT support staff to trick employees into installing EtherRAT malware. The campaign exploits user trust in IT support interactions rather than technical vulnerabilities in Teams itself.

Impact: Successful attacks result in EtherRAT deployment, granting attackers initial access to corporate networks for lateral movement, credential theft, data exfiltration, and potential ransomware deployment. Detection is difficult because Teams voice calls appear legitimate and bypass traditional email security controls.

Recommendations:

  • Brief all employees immediately: legitimate IT will never request software installation via unsolicited Teams calls
  • Implement internal verification procedures requiring employees to independently confirm IT support requests through official ticketing systems or known phone numbers
  • Configure Microsoft Teams external access policies to restrict or flag calls from outside the organization
  • Monitor EDR tools for EtherRAT indicators and unusual remote access tool installations
  • Review Teams call logs for suspicious patterns, particularly external callers claiming to be internal IT support

Threat Actor Activity

Iran MOIS-Affiliated Group Deploys Cavern C2 Framework

An Iranian threat actor affiliated with Iran's Ministry of Intelligence and Security (MOIS) has deployed a previously undocumented modular command-and-control framework called Cavern (Cav3rn) against Israeli organizations. The campaign, tracked by Check Point Research, primarily targets IT service providers and government sector entities in Israel.

Targeting rationale: The focus on IT service providers suggests supply chain compromise tactics to enable downstream access to multiple clients and sensitive infrastructure. Government sector targeting aligns with traditional espionage objectives seeking policy intelligence and strategic planning information.

Defensive focus: Organizations in Israel and those with Israeli IT service providers should monitor for unusual outbound network connections, particularly to Iranian infrastructure or newly registered domains. Implement enhanced logging for modular malware frameworks and conduct supply chain security assessments of IT vendors with privileged access.

---

Operation DragonReturn: China-Nexus Campaign Against India

A suspected China-nexus threat actor is conducting Operation DragonReturn, a targeted espionage campaign against Indian taxpayers and finance professionals. The multi-stage attack uses spear-phishing emails impersonating the Income Tax Department of India to deliver DcRAT (Dark Crystal RAT) malware.

Objectives: Intelligence collection and data theft from Indian financial and government sectors, consistent with geopolitical tensions between China and India. The campaign seeks financial records, personally identifiable information, tax data, and broader intelligence on Indian economic activities.

TTPs: Multi-stage infection chains initiated via spear-phishing with tax compliance lures. DcRAT provides remote command execution, credential theft, keylogging, screen capture, file exfiltration, and persistence mechanisms.

Geopolitical Context

The Iran-Israel cyber confrontation continues to escalate with MOIS-affiliated actors deploying custom tooling against Israeli critical infrastructure and technology supply chains. This activity reflects Iran's strategic use of cyber operations as a lower-threshold instrument for signaling, espionage, and potential disruption within broader regional tensions.

The China-India cyber rivalry manifests in Operation DragonReturn, targeting Indian government and finance sectors through sophisticated social engineering. This campaign aligns with broader patterns of China-nexus operations against Indian critical infrastructure, particularly following border tensions since 2020 and India's growing alignment with Quad security partnerships.

Both campaigns underscore the persistent use of cyber capabilities by regional powers as instruments of statecraft, with IT service providers and financial sectors serving as high-value intelligence collection targets.

Recommended Actions

Immediate (0-24 hours)

  • Patch Adobe ColdFusion (CVE-2026-48282) or isolate from internet exposure
  • Patch Linux KVM hypervisors (CVE-2026-53359) in multi-tenant environments
  • Patch Gitea Docker instances (CVE-2026-20896) or restrict network access
  • Brief employees on Microsoft Teams IT support impersonation campaign
  • Alert marketing teams about fake job interview phishing targeting Google credentials

Short-term (24-72 hours)

  • Enforce multi-factor authentication on Google Workspace accounts, prioritizing phishing-resistant methods
  • Review authentication logs on ColdFusion, Gitea, and KVM hosts for compromise indicators
  • Audit browser extension inventory on Opera GX endpoints for unauthorized add-ons
  • Implement Teams external access policies to flag calls from outside the organization

This week

  • Conduct supply chain security assessments of IT service providers with privileged access
  • Deploy enhanced logging for modular malware frameworks and C2 beaconing patterns
  • Review email security controls to detect government agency impersonation attempts
  • Implement network segmentation to limit lateral movement from IT service provider access points

Watch List

  • Adobe ColdFusion: Monitor for CISA KEV listing and additional exploitation details
  • KVM hypervisor: Track vendor patch availability across Linux distributions and virtualization platforms
  • Gitea: Monitor for exploitation attempts transitioning from reconnaissance to active compromise
  • Opera GX: Await CVE assignment and detailed version information for vulnerability tracking
  • Iran-Israel tensions: Monitor for escalation in cyber operations following this MOIS campaign disclosure
  • India-China cyber activity: Watch for attribution updates linking Operation DragonReturn to known APT groups

Sources

  • BleepingComputer: Phishing poses as big-brand job interview to steal Google accounts
  • BleepingComputer: Fake IT support calls on Microsoft Teams push EtherRAT malware
  • BleepingComputer: Max severity Adobe ColdFusion flaw now exploited in attacks
  • The Hacker News: Iran-Linked Hackers Use New Cavern C2 Framework to Target Israeli Organizations
  • The Hacker News: 16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems
  • The Hacker News: Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure
  • The Hacker News: Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT
  • The Hacker News: Opera GX Flaw Let Malicious Sites Auto-Install Mods to Steal Data From Visited Pages