# Threat Intel Brief — July 24, 2026

TL;DR

  • Russian state-sponsored group Laundry Bear exploited a zero-click Zimbra vulnerability to steal 90 days of email, credentials, and 2FA codes from Western government and defense organizations.
  • Check Point SmartConsole authentication bypass (CVE-2026-16232) actively exploited; CISA orders federal agencies to patch by July 25.
  • Nine-year-old Linux kernel flaw (CVE-2026-64600) grants unprivileged local users root access on default RHEL, Fedora, and Amazon Linux installations.
  • CISA emergency directive mandates patching of actively exploited Langflow RCE vulnerability (CVE-2026-0770) used to steal AWS credentials.
  • China-nexus actor JadeProx deploys new TriBack Loader against government and healthcare targets across Asia and Latin America.

---

Critical Threats

Russian Zero-Click Email Espionage via Zimbra

What happened:
A Russian state-sponsored espionage group (tracked as Laundry Bear/Void Blizzard/TA488) exploited CVE-2025-66376, a stored cross-site scripting vulnerability in Zimbra Collaboration Suite's Classic UI, to conduct zero-click email theft. Victims were compromised simply by viewing a malicious email—no interaction required. The campaign, active since at least July 2025, targeted Western government, defense, transportation, financial, and nuclear sector organizations across NATO member states, Ukraine, and the Commonwealth of Independent States. Attackers exfiltrated 90 days of email history, Global Address Lists, saved browser passwords, and two-factor authentication recovery codes. The group maintained persistence by creating unauthorized Zimbra application passcodes that bypass MFA and survive password resets.

Impact:
This represents a sustained intelligence collection operation against high-value Western targets. The zero-click nature eliminates the need for social engineering, and the theft of 2FA codes undermines multi-factor authentication protections. Organizations using Zimbra face risk of prolonged unauthorized access to sensitive communications, with potential exposure of classified information, diplomatic correspondence, and defense-related data. The five-month zero-day exploitation window before Zimbra's November 2025 patch suggests significant intelligence collection occurred before detection.

Recommendations:

  • Upgrade Zimbra Collaboration to version 10.1.13 or later immediately (10.1.20 recommended; Zimbra 10.0 reached end-of-life December 31, 2025).
  • Audit and revoke all Zimbra application passcodes, particularly those containing "ZimbraWeb"; reset passwords and regenerate 2FA scratch codes for all accounts that accessed Classic UI during the vulnerability window.
  • Review email access logs for anomalous API calls to GetScratchCodesRequest and unusual IMAP enablement (zimbraPrefImapEnabled).
  • Monitor DNS logs for exfiltration patterns consistent with the ZimReaper payload's DNS tunneling technique.
  • Implement phishing-resistant authentication (FIDO2/WebAuthn) to mitigate future session theft attacks.

---

Check Point SmartConsole Authentication Bypass Exploited

What happened:
Check Point disclosed CVE-2026-16232 (CVSS 9.3), a critical authentication bypass vulnerability in SmartConsole—the graphical management interface for Security Management and Multi-Domain Management products. The flaw allows unauthenticated remote attackers to obtain admin login tokens and gain full administrative access to security policy management. Active exploitation has been confirmed against a small number of customers. CISA added the vulnerability to the Known Exploited Vulnerabilities catalog on July 23, 2026, and issued Binding Operational Directive 26-04 requiring federal agencies to patch by July 25. The vulnerability is exploitable only when Management Servers are exposed to the internet without Trusted Client IP restrictions—a misconfiguration, but one present in targeted environments.

Impact:
Attackers with admin access can modify security policies, disable protections, create backdoors, or facilitate ransomware deployment. This represents a critical risk to organizations relying on Check Point for network security enforcement. The vulnerability affects versions R77.30 through R82.10, covering a broad installed base. Check Point has a history of exploited vulnerabilities linked to ransomware campaigns, elevating concern about follow-on attacks.

Recommendations:

  • Apply Check Point's July 22 Jumbo hotfix immediately to all affected Security Management and Multi-Domain Management servers.
  • Block inbound connections from known attacker IPs: 151.241.99.207, 151.241.99.233, 158.62.198.182, 192.142.10.99, 139.28.37.250, 194.213.18.137.
  • Restrict Trusted Clients to specific trusted IP addresses or subnets; do not allow 0.0.0.0/0.
  • Remove direct internet exposure for Management Server IP addresses; implement firewall rules or VPN access.
  • Review SmartConsole authentication logs for unauthorized login tokens or administrative actions since July 2026; correlate with provided IOCs.

---

RefluXFS: Nine-Year-Old Linux Kernel Root Escalation

What happened:
CVE-2026-64600, a race condition vulnerability in the Linux kernel's XFS filesystem, allows unprivileged local users to overwrite root-owned files and gain persistent root access. The flaw has existed since kernel version 4.11 (February 2017) and affects default installations of Red Hat Enterprise Linux, CentOS Stream, Oracle Linux, Rocky Linux, AlmaLinux, CloudLinux, Fedora Server, and Amazon Linux when XFS filesystems are created with reflink=1 (the default). Qualys researchers published a working proof-of-concept demonstrating reliable exploitation in under 10 seconds on default RHEL 10.2 and Fedora Server 44 installations. The exploit leaves no kernel warnings or log entries, and modifications survive reboot with original metadata intact.

Impact:
Multi-tenant environments, CI/CD pipelines, shared hosting, and any system where untrusted code runs locally face critical risk. Attackers can overwrite /etc/passwd, /etc/shadow, or setuid binaries (e.g., /usr/bin/sudo) to establish persistent root access. The lack of logging makes detection extremely difficult. Red Hat issued patches July 14–17, eight days before public disclosure; organizations that applied those updates are already protected.

Recommendations:

  • Verify XFS reflink status on all filesystems with xfs_info / | grep reflink= and xfs_info | grep reflink=; reflink=1 indicates exposure.
  • Apply vendor kernel updates immediately: RHEL 8 (RHSA-2026:39179, RHSA-2026:39180), RHEL 10 (RHSA-2026:39494), Debian trixie-security (kernel 6.12.96-1+), unstable (7.1.4-1+), and equivalent updates for Fedora, Amazon Linux, and other distributions.
  • Reboot all patched systems to load the fixed kernel; verify running kernel version with uname -r.
  • Prioritize patching for multi-tenant hosts, CI/CD workers, shared development servers, and any system where untrusted users or services have local shell or code execution.
  • Review file integrity monitoring for unexplained changes to /etc/passwd, /etc/shadow, and setuid binaries between April 2017 and patch date.

---

CISA Orders Emergency Patching of Exploited Langflow RCE

What happened:
CISA issued an urgent directive under Binding Operational Directive 26-04 ordering U.S. government agencies to patch CVE-2026-0770, an actively exploited remote code execution vulnerability in Langflow, a visual framework for building AI agents. The flaw allows unauthenticated attackers to execute arbitrary code as root on vulnerable instances. Active exploitation has been confirmed since June 27, 2026, with over 220 exploitation attempts from 64 unique IP addresses observed. Attackers are deploying malware, stealing AWS credentials, environment variables, and container metadata. This is not reconnaissance—second-stage payloads have been confirmed. Federal agencies must patch by July 25, 2026.

Impact:
Organizations running Langflow face immediate risk of full system compromise, credential theft, and lateral movement into cloud environments. The vulnerability's low attack complexity and unauthenticated nature make it trivial to exploit. Langflow has a history of exploited vulnerabilities, including CVE-2025-3248, which was used in JadePuffer ransomware attacks. The targeting of cloud credentials suggests adversaries are positioning for long-term access to AI development environments and broader cloud infrastructure.

Recommendations:

  • Apply vendor patches for CVE-2026-0770 immediately on all Langflow instances.
  • Audit historical logs for requests to /api/v1/validate/code endpoint since June 27, 2026, for indicators of compromise.
  • Restrict network access to Langflow validation functionality using firewall rules or authentication controls.
  • Rotate all AWS credentials, API keys, and secrets accessible from Langflow hosts where compromise cannot be ruled out.
  • Review host-level activity logs and container metadata access for signs of reconnaissance or second-stage payload downloads.

---

Threat Actor Activity

Laundry Bear (Russian State-Sponsored)

Russian state-sponsored group Laundry Bear (also tracked as Void Blizzard by Microsoft) conducted a sustained email espionage campaign targeting NATO member states, Ukraine, and organizations supporting Ukrainian defense efforts. First publicly attributed by Dutch intelligence in May 2025 following a 2024 compromise of the Dutch National Police, the group combines phishing with exploitation of CVE-2025-66376 (Zimbra XSS) to steal email data. The group employs adversary-in-the-middle phishing kits, creates unauthorized Zimbra application passcodes for persistence, and exfiltrates data via DNS tunneling and HTTPS uploads to the "Flowerbed" collection framework. Targeting includes Defense Industrial Base, government, education, energy, law enforcement, media, NGOs, and technology sectors. The UK's National Cyber Security Centre and 15 international partners issued a joint advisory exposing the campaign, noting that techniques were "extensively trialled on Ukrainian victims before use against members of NATO."

Chaos Ransomware Group

The Chaos ransomware gang, which emerged in early 2025 and has been linked to Iranian state-backed actor MuddyWater, deployed a new Rust-based backdoor called msaRAT. The implant routes command-and-control traffic through headless Chrome or Edge browsers using the Chrome DevTools Protocol, enabling stealthy C2 communications that appear to originate from legitimate browser processes. The malware hijacks browsers in headless mode, injects JavaScript into browser tabs, and tunnels C2 traffic through WebRTC data channels relayed by Cloudflare Workers and Twilio TURN infrastructure. Dual-layer encryption (WebRTC DTLS + ChaCha20-Poly1305) obfuscates communications. The group uses social engineering (spam, vishing) and abuse of legitimate remote management tools for initial access, then deploys msaRAT as a pre-ransomware stage to establish covert C2 channels before deploying encryptors.

JadeProx (China-Nexus)

China-nexus threat actor JadeProx was discovered using a previously undocumented Windows loader called TriBack Loader to target government, healthcare, and education organizations across Asia and Latin America. The operation was identified through an exposed Alibaba Cloud server in Singapore discovered in mid-April 2026. Confirmed intrusions include a Vietnamese public hospital's medical imaging system, Malaysia's Ministry of Foreign Affairs, and scanning/exploitation attempts against Hong Kong education infrastructure. The actor exploits years-old critical vulnerabilities (CVE-2018-11511, CVE-2021-24139, CVE-2021-31755, CVE-2021-32305—all CVSS 9.8) and employs DLL sideloading with four TriBack Loader variants. The malware uses low-visibility Win32 APIs (InitOnceExecuteOnce, TimerQueue callbacks, undocumented EtwpCreateEtwThread) for shellcode execution to evade EDR detection.

Kratos Phishing-as-a-Service Dismantled

German, US, and Indonesian law enforcement dismantled the Kratos phishing-as-a-service platform, described as one of the world's most widely used criminal phishing kits. The operation arrested an Indonesian national allegedly responsible for developing and operating the kit, which had approximately 1,800 paying customers conducting roughly 15,000 phishing campaigns monthly. Kratos offered adversary-in-the-middle capabilities to steal Microsoft 365 sessions and bypass MFA, generating over 300,000 euros through cryptocurrency payments. The platform targeted victims across more than 30 countries, with concentration in Europe and the United States. Over 200 servers were dismantled, though the approximately 1,800 customers and their copies of the kit code remain unaddressed.

---

Geopolitical Context

Russian Cyber Espionage Intensifies Against Western Targets

The Laundry Bear campaign represents a significant escalation in Russian intelligence collection against NATO member states and Ukraine. The joint advisory from 16 nations—including the UK, US, and European allies—signals a coordinated Western response to impose reputational costs on Russian cyber operations. The pattern of testing techniques on Ukrainian victims before deploying them against NATO members has become an established Russian cyber doctrine. The targeting of defense, government, and nuclear sectors suggests intelligence requirements related to Western military assistance to Ukraine, NATO defense posture, and strategic decision-making. The five-month zero-day exploitation window and continued targeting of unpatched infrastructure indicate sustained operational focus.

Critical Infrastructure Vulnerabilities Exploited at Scale

The active exploitation of Check Point SmartConsole (CVE-2026-16232) and Microsoft SharePoint Server vulnerabilities (CVE-2026-50522, CVE-2026-56164, CVE-2026-58644) underscores the persistent threat to enterprise and government network security infrastructure. CERT-EU's advisory on SharePoint exploitation reflects heightened concern within European cybersecurity coordination bodies about pre-positioning activity targeting European networks. The rapid weaponization of these flaws—with proof-of-concept code emerging within days of patch release—compresses the window between disclosure and exploitation. Organizations with internet-exposed management interfaces face immediate risk of compromise, credential theft, and lateral movement.

Supply Chain and Third-Party Risk Remains Acute

The compromise of Stadler Rail via a shared data exchange platform with a supplier illustrates persistent supply chain vulnerabilities. The GitHub Actions abuse campaign targeting cPanel/WHM instances demonstrates how CI/CD infrastructure can be weaponized for distributed server exploitation. The trojanized NuGet package masquerading as Newtonsoft.Json represents targeted supply chain attacks via typosquatting. These incidents underscore the challenge of securing extended supply chains and third-party dependencies in an interconnected threat landscape.

---

Recommended Actions

Immediate (0-24 hours)

  • Patch CVE-2026-16232 (Check Point SmartConsole) and CVE-2026-0770 (Langflow RCE) immediately; both are actively exploited with federal patching deadlines of July 25, 2026.
  • Upgrade Zimbra Collaboration to version 10.1.13 or later; audit and revoke all application passcodes, reset passwords, and regenerate 2FA codes for accounts that accessed Classic UI.
  • Apply Linux kernel patches for CVE-2026-64600 (RefluXFS) on all RHEL, Fedora, Amazon Linux, and derivative systems; reboot to load fixed kernel.
  • Rotate credentials on all Langflow hosts and Check Point Management Servers where compromise cannot be ruled out.
  • Block known attacker IPs associated with Check Point exploitation: 151.241.99.207, 151.241.99.233, 158.62.198.182, 192.142.10.99, 139.28.37.250, 194.213.18.137.

Within 24-72 Hours

  • Patch Microsoft SharePoint Server vulnerabilities (CVE-2026-50522, CVE-2026-56164, CVE-2026-58644) on all on-premise instances; rotate credentials and conduct compromise assessments on internet-facing servers.
  • Update Ubuntu Desktop to patch CVE-2026-8933 (snap-confine local privilege escalation) on versions 24.04, 25.10, and 26.04.
  • Patch Windmill to version 1.603.3 or later to address CVE-2026-29059 (path traversal); audit logs for suspicious requests to /api/w/*/jobs_u/get_log_file/* endpoints.
  • Update Adobe Acrobat Chrome extension to version 26.5.2.3 or later to address CVE-2026-48294 (WhatsApp Web data theft).
  • Hunt for msaRAT indicators: Chrome/Edge processes launched with --remote-debugging-port and --headless flags; monitor for WebRTC connections to Twilio TURN infrastructure.

This Week

  • Audit GitHub Actions workflows for anomalous runner launches; review .github/workflows directories for malicious YAML files containing DNSHook identifier f5b0b742-240a-4811-8a5b-b0ba6060685d.
  • Review Packagist dependencies for trojanized packages from dinushchathurya namespace; pin to known-good stable releases.
  • Implement phishing-resistant MFA (FIDO2/WebAuthn) for all privileged accounts to mitigate adversary-in-the-middle session theft.
  • Conduct threat hunting for JadeProx indicators: DLL sideloading with signed vendor binaries in user-writable directories, encrypted .dat/.log companions, and connections to known C2 domains (claude-pro[.]com, license[.]claude-pro[.]com, sylverixstrategy[.]com).
  • Patch legacy vulnerabilities exploited by JadeProx: CVE-2018-11511, CVE-2021-24139, CVE-2021-31755, CVE-2021-32305 (all CVSS 9.8).

---

Watch List

  • Langflow vulnerability recurrence: This is the fourth Langflow CVE added to CISA's KEV catalog since 2025; expect continued targeting of AI development infrastructure.
  • Zimbra post-patch targeting: Russian actors assessed to continue targeting unpatched Zimbra instances and pivot to other email platforms as patching increases.
  • Check Point exploitation expansion: History of repeated zero-day exploitation suggests adversaries are investing in vulnerability research targeting Check Point management infrastructure.
  • Chaos ransomware evolution: msaRAT's browser-hijacking C2 technique represents significant advancement in evasion capabilities; monitor for adoption by other threat actors.
  • GitHub Actions abuse: The DNSHook identifier appearing in 6,100 workflow files suggests a broader GitHub abuse ecosystem; expect further CI/CD weaponization campaigns.

---

Sources

  • BleepingComputer: Russian hackers exploit Zimbra zero-click flaw for email theft
  • The Hacker News: Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes
  • NCSC UK: UK and partners expose Russian state-supported actors for new 'zero-click' phishing campaign
  • Unit 42 (Palo Alto): Russian Global Webmail Espionage
  • BleepingComputer: Check Point warns of SmartConsole zero-day exploited in attacks
  • The Hacker News: Check Point Patches Exploited SmartConsole Flaw Allowing Full Admin Access
  • BleepingComputer: New RefluXFS Linux flaw lets attackers gain root privileges
  • The Hacker News: Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs
  • BleepingComputer: CISA orders urgent action on actively exploited Langflow RCE flaw
  • CERT-EU Advisories: 2026-009: Critical Vulnerability in Microsoft SharePoint
  • The Hacker News: China-Nexus JadeProx Uses New TriBack Loader in Government and Healthcare Attacks
  • The Hacker News: Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
  • BleepingComputer: New msaRAT malware uses Chrome, Edge browsers to route C2 traffic
  • The Hacker News: Police Dismantle Kratos Phishing Kit Built to Steal Microsoft 365 Sessions and Bypass MFA
  • The Hacker News: Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers
  • The Hacker News: Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs
  • The Hacker News: Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication
  • The Hacker News: Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data
  • BleepingComputer: Fake Claude app promoted by Bing ads pushes SectopRAT malware
  • BleepingComputer: South Korea discloses data breach impacting diplomats worldwide
  • BleepingComputer: Swiss rail giant Stadler rejects $12.3M ransom demand after cyberattack
  • The Hacker News: Trojanized Newtonsoft.Json Fork Hides Game-Rigging Code in a Working Library