# Threat Intel Brief — July 25, 2026

TL;DR

  • Russian state-sponsored group Laundry Bear exploited a Zimbra zero-day (CVE-2025-66376) for five months, stealing email, credentials, and 2FA codes from Western government and defense organizations in a zero-click attack requiring only message viewing.
  • Critical vulnerabilities disclosed this week include authenticated RCE in Redis (multiple versions), a nine-year-old Linux XFS privilege escalation flaw (CVE-2026-64600), and Active Directory Certificate Services exploit "Certighost" enabling DC impersonation—all with public proof-of-concept code.
  • AI-powered threats emerged across multiple fronts: North Korea's BlueNoroff profiling crypto wallets before malware delivery, autonomous Hermes AI agent conducting post-exploitation at Thailand's Ministry of Finance, and Dolphin X RAT using AI to rank high-value victims.
  • Hotel and conference Wi-Fi networks are being hijacked via DNS manipulation to redirect Microsoft 365 users to credential-theft pages, bypassing MFA through OAuth device-code abuse.
  • Clop ransomware gang launched data-theft extortion campaign against PTC Windchill/FlexPLM users (CVE-2026-12569), targeting manufacturing and defense sectors.

Critical Threats

Laundry Bear Zimbra Zero-Day Espionage Campaign

What happened: Russian state-sponsored group Laundry Bear (also tracked as Void Blizzard) exploited CVE-2025-66376, a stored cross-site scripting vulnerability in Zimbra Collaboration Suite's Classic UI, as a zero-day from at least July through November 2025. The attack required no user interaction beyond viewing a malicious email. Attackers harvested 90 days of email history, credentials, browser-saved passwords, 2FA scratch codes, and Global Address Lists. They created persistent "ZimbraWeb" application passwords that survive credential resets and exfiltrated data via DNS queries and HTTPS uploads. Targets included Western government, defense, transportation, financial, scientific, and nuclear organizations across NATO member states, Ukraine, and allied nations.

Impact: The UK's National Cyber Security Centre and 15 partner agencies formally attributed the campaign to Russian state support. The compromise of NATO member state government and defense communications threatens alliance operational security, Ukraine support coordination, and classified information sharing. The Dutch National Police breach in 2024 exposed personnel information. CISA added CVE-2025-66376 to the Known Exploited Vulnerabilities catalog on March 18, 2026. The group continues targeting unpatched Zimbra servers and is assessed as very likely to adapt techniques to other Western email platforms.

Recommendations: Immediately upgrade Zimbra to version 10.1.13 or later (10.1.20 recommended); Zimbra 10.0 reached end-of-life December 31, 2025. Audit logs for CreateAppSpecificPassword API calls and remove credentials named "ZimbraWeb." Reset passwords, invalidate sessions, and regenerate 2FA scratch codes for all accounts that accessed Classic UI during the exploitation window. Deploy YARA rules to scan for fragmented @import patterns and SVG onload tags in email stores. Monitor for DNS exfiltration via long random subdomains and alert on zimbraPrefImapEnabled changes without business justification. Consider disabling Classic UI in favor of Modern UI where feasible.

Redis Authenticated RCE Vulnerabilities

What happened: Researchers disclosed authenticated remote code execution vulnerabilities in Redis versions 6.2.22, 7.2.14, 7.4.9, 8.2.7, 8.4.4, 8.6.4, and 8.8.0 on July 23, 2026. Exploitation requires authenticated access and use of RESTORE command. Two attack chains exist: (1) Streams shared-NACK use-after-free via corrupt RDB objects leading to arbitrary memory access, and (2) RedisBloom TDigest RDB loader out-of-bounds write enabling read/write primitives. Both poison database hash functions to invoke system() calls. Public proof-of-concept exploits are available. Redis versions 6.2.22 and 7.4.9 were May 2026 security updates, meaning organizations that patched in May remain vulnerable.

Impact: Authenticated attackers can achieve remote code execution with full Redis process privileges. Organizations running Redis in multi-tenant environments or with untrusted authenticated users face elevated risk. The public availability of working exploits lowers the barrier to exploitation. No CVE identifiers or CVSS scores had been assigned as of July 24, 2026.

Recommendations: Upgrade Redis immediately to fixed versions: 6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, 8.6.5, or 8.8.1. Verify exact version using redis-server --version; do not assume May 2026 patches are sufficient. Revoke RESTORE command permissions from accounts that do not strictly require it using ACL commands. Block untrusted network access to Redis instances and enforce authentication with trusted IP restrictions. Monitor logs for unexpected RESTORE, EVAL, XGROUP commands or RedisBloom module usage from non-administrative accounts.

Linux XFS Privilege Escalation (CVE-2026-64600)

What happened: Qualys disclosed CVE-2026-64600, a nine-year-old race condition in the Linux kernel's XFS filesystem affecting kernel v4.11 and later (since February 2017). The vulnerability allows local unprivileged users to overwrite root-owned files or SUID-root binaries to gain root privileges. Exploitation requires XFS with reflink enabled (default on RHEL, Oracle Linux, Amazon Linux, Fedora, CentOS Stream, Rocky Linux, AlmaLinux, CloudLinux) and a writable directory. Qualys estimates 16.4 million systems potentially affected. Proof-of-concept exploit is available and highly reliable, leaves no kernel logs, and survives reboot.

Impact: Standard defenses including SELinux, kernel lockdown, container isolation, KASLR, SMEP, and SMAP do not block this attack because it operates at the filesystem allocation layer. On-disk modifications persist across reboots with no audit trail. Critical for multi-tenant and exposed Linux systems. Patch available since July 16, 2026.

Recommendations: Apply vendor-provided kernel patches immediately for all Linux systems running kernel v4.11 or later with XFS filesystem. Reboot all patched systems to activate the updated kernel. Prioritize patching for multi-tenant environments, shared hosting, and systems with local user access. Verify kernel version post-reboot to confirm patch deployment. Review /etc/passwd and SUID-root binaries for unauthorized modifications on systems with local untrusted users prior to patching.

Active Directory Certighost Exploit (CVE-2026-54121)

What happened: Researchers published a working exploit on July 24, 2026, for CVE-2026-54121 (Certighost), allowing low-privileged Active Directory users to obtain Domain Controller certificates and authenticate as DC machine accounts. Attackers can then perform DCSync to extract krbtgt hash and all domain credentials. The vulnerability affects Microsoft Active Directory Certificate Services on Windows Server 2012 through 2025 and Windows 10 versions 1607 and 1809. Exploitation requires only network access and standard domain user account. Microsoft patched the vulnerability on July 14, 2026 (CVSS 8.8).

Impact: Full Active Directory compromise is possible from a low-privileged starting point. The attack leverages AD CS enrollment chase fallback that fails to validate requester-supplied Domain Controller references, allowing SMB/LDAP relay attacks. Exploitation requires no admin rights or user interaction.

Recommendations: Apply Microsoft July 14, 2026 security updates to all AD CS hosts immediately. Verify patch deployment by checking that certpdef.dll contains CRequestInstance::_ValidateChaseTargetIsDC validation function. If immediate patching is not possible, disable chase fallback with certutil -setreg policy\EditFlags -EDITF_ENABLECHASECLIENTDC and restart CertSvc (test in lab first). Review DC authentication logs and certificate enrollment events for anomalous Machine template requests from standard user accounts. Audit ms-DS-MachineAccountQuota settings and reduce from default value of 10 if business requirements allow.

Threat Actor Activity

North Korean BlueNoroff Cryptocurrency Targeting

BlueNoroff is operating an active phishing kit impersonating Zoom and Microsoft Teams via typosquatted domains to deliver malware targeting cryptocurrency sector employees. The campaign leverages compromised Telegram accounts of legitimate industry contacts to create self-propagating attack chains. Before malware delivery, the group profiles victims' cryptocurrency wallet extensions to enable selective targeting of high-value individuals. The operation demonstrates AI-enhanced social engineering and automated victim profiling capabilities. Organizations in cryptocurrency and technology sectors should monitor for typosquatted videoconferencing domains, detect browser extension enumeration activity, and harden Telegram security with two-factor authentication.

China-Nexus JadeProx Government and Healthcare Intrusions

JadeProx, a China-nexus threat actor, has been discovered using TriBack Loader to target government, healthcare, and education organizations across Asia and Latin America. The operation was identified through an exposed Alibaba Cloud server in Singapore discovered in mid-April 2026. Confirmed intrusions include a Vietnamese public hospital's medical imaging system, Malaysia's Ministry of Foreign Affairs, and scanning of Hong Kong education infrastructure. The actor conducts both targeted intrusions and mass vulnerability scanning, exploiting CVE-2018-11511, CVE-2021-24139, CVE-2021-31755, and CVE-2021-32305. Initial access includes spear-phishing, malvertising impersonating Anthropic's Claude software, and webshell deployment on exposed Java interfaces.

Russia-Aligned UAC-0099 Ukraine Operations

UAC-0099, a Russia-aligned threat group active since mid-2022, is distributing malware disguised as Notepad++ plugins to compromise Ukrainian systems. The campaign deploys LUNCHPOKE, BURNYBEAR, and MATCHBOIL.V2 loaders via social engineering (malicious VBS scripts disguised as PDFs). The group achieves persistence through scheduled tasks executing every three minutes and uses DLL side-loading via legitimate Notepad++. UAC-0099 has previously weaponized WinRAR vulnerabilities and is assessed to provide initial access for APT44 (Sandworm), a Russian GRU-attributed group. Ukrainian organizations should block VBS execution from untrusted sources, monitor for scheduled tasks at regular intervals, and implement DLL side-loading detection.

Golden Chickens Malware-as-a-Service Evolution

Golden Chickens (Venom Spider, TAG-195) has resurfaced with four new malware families: TinyEgg, ChonkyChicken, a modularized variant, and ChromEggscalator credential stealer. The MaaS provider supplies tooling to multiple cybercrime operators including Cobalt Group, Evilnum, and FIN6. TinyEgg provides initial access with anti-sandbox detection and WebSocket-based C2. ChonkyChicken delivers full post-exploitation capabilities including browser credential theft via Chrome DevTools Protocol. The modular architecture employs a controller-plugin system with 14 discrete capability modules, reducing static detection exposure. Organizations should monitor for ClickFix-style social engineering, WebSocket C2 patterns, and Chrome DevTools Protocol abuse.

Clop Ransomware PTC Windchill Campaign

Clop ransomware gang is conducting data theft extortion targeting Internet-exposed PTC Windchill and FlexPLM instances, exploiting CVE-2026-12569 (CVSS 9.3). The gang deploys JSP webshells for persistent access and exfiltrates sensitive product lifecycle management data from manufacturing, aerospace, defense, automotive, and medtech sectors. Clop uses previously compromised email accounts to send mass extortion messages to hundreds of employees per organization. CISA added CVE-2026-12569 to the KEV catalog requiring federal agency remediation within three days. Organizations should immediately patch Windchill/FlexPLM, remove instances from direct Internet exposure, and hunt for JSP webshells.

Geopolitical Context

Russian Cyber Operations Against Western Infrastructure

The coordinated exposure of Laundry Bear by the UK NCSC and 15 partner nations represents a significant Western response to Russian state-sponsored espionage. The campaign's progression from testing on Ukrainian victims to deployment against NATO members follows established Russian doctrine of using Ukraine as a proving ground for offensive cyber capabilities. The multi-sector targeting (defense, government, energy, law enforcement, media, NGOs) aligns with Russian strategic intelligence priorities. The operation threatens NATO operational security, Ukraine support coordination, and classified information sharing across the Alliance. The advisory warns that Laundry Bear is very likely to adapt techniques to other Western email platforms as Zimbra patching rates improve.

Southeast Asian Government Targeting

The alleged breach of Thailand's Ministry of Finance using an autonomous Hermes AI agent represents an escalation in AI-assisted cyber operations in Southeast Asia. The attacker deployed the agent in "YOLO mode" (disabling human approval prompts) to conduct unattended post-exploitation reconnaissance, accessing personnel records dating to 2012. Linguistic artifacts and infrastructure overlap with ShadowPad suggest Chinese-speaking operators, though no formal attribution has been published. The targeting of finance ministry infrastructure—holding sensitive fiscal policy data and economic planning documents—suggests either state-sponsored economic intelligence collection or preparation for future operations. Thailand's cyber defense posture has historically lagged regional peers, making government ministries attractive targets.

North Korean Sanctions Evasion

BlueNoroff's cryptocurrency targeting represents a continuation of North Korea's strategic use of cyber operations to generate revenue amid sustained international sanctions. The group operates under the Reconnaissance General Bureau and has evolved tradecraft to incorporate AI-generated personas and automated victim profiling. The self-propagating nature of the campaign—leveraging compromised Telegram accounts—demonstrates operational maturity consistent with a state-directed program operating under resource constraints. The operation poses systemic risk to digital asset platforms and financial technology infrastructure across jurisdictions, particularly in regulatory-friendly European environments.

Recommended Actions

Immediate (0-24 hours)

  • Patch Zimbra servers to version 10.1.13 or later; audit for "ZimbraWeb" application passwords and reset all credentials for accounts that accessed Classic UI during exploitation window (Laundry Bear campaign).
  • Upgrade Redis to fixed versions (6.2.23, 7.2.15, 7.4.10, 8.2.8, 8.4.5, 8.6.5, 8.8.1); revoke RESTORE command permissions from non-essential accounts.
  • Apply Microsoft July 14, 2026 AD CS patches for CVE-2026-54121 (Certighost); review DC authentication logs for anomalous certificate enrollment.
  • Patch PTC Windchill/FlexPLM against CVE-2026-12569; remove instances from direct Internet exposure and hunt for JSP webshells.
  • Deploy always-on VPN for traveling employees connecting to hotel/conference Wi-Fi; enable encrypted DNS in strict mode to counter DNS hijacking attacks.
  • Hunt for Dolphin X RAT indicators and monitor for AI-powered victim profiling activity targeting high-value accounts.

Within 24-72 hours

  • Patch Linux systems for CVE-2026-64600 (XFS privilege escalation) and reboot to activate kernel updates; prioritize multi-tenant environments.
  • Update NodeBB to version 4.14.2 or later; test custom themes and plugins after upgrade; review admin access logs since May 2026.
  • Block typosquatted domains impersonating Zoom, Microsoft Teams, and Claude AI; hunt for browser extension enumeration targeting cryptocurrency wallets (BlueNoroff campaign).
  • Monitor for TriBack Loader indicators: signed vendor binaries executing from user-writable directories with encrypted .dat/.log files (JadeProx campaign).
  • Audit GitHub Actions workflows for unauthorized YAML files containing external downloads or HTTP POST exfiltration; implement repository protection rules requiring code review.

This week

  • Review business continuity plans for cloud service dependencies following Microsoft 365 outage; evaluate multi-cloud strategies to reduce single-vendor risk.
  • Implement Claude Cowork mitigations: verify cloud execution mode is enabled rather than local VM execution; restrict folder sharing to minimum required directories.
  • Deploy detection rules for UAC-0099 TTPs: VBS execution from email attachments, scheduled tasks at regular intervals, DLL side-loading with Notepad++.
  • Audit Hadoop/HiveServer2 configurations: disable NONE authentication mode and enforce Kerberos or LDAP authentication to prevent unauthorized access.
  • Conduct user awareness training on AI agent phishing risks, hotel Wi-Fi security, and verification of unexpected software download prompts.

Watch List

  • Laundry Bear adaptation: Monitor for exploitation techniques migrating to Microsoft Exchange, Google Workspace, or other enterprise email platforms as Zimbra patching improves.
  • AI-automated intrusions: Track proliferation of autonomous AI agents in post-exploitation workflows; expect increased difficulty distinguishing machine-generated reconnaissance from human activity.
  • Clop follow-on campaigns: Watch for similar data-theft extortion targeting other widely deployed enterprise applications following the PTC Windchill/FlexPLM pattern.
  • BlueNoroff cryptocurrency operations: Monitor for expanded targeting beyond initial cryptocurrency sector focus as self-propagating Telegram compromise mechanism scales.
  • China-nexus activity in Southeast Asia: Track additional government and healthcare intrusions in Asia and Latin America using TriBack Loader or related tooling.

Sources

  • UK National Cyber Security Centre (NCSC)
  • US Cybersecurity and Infrastructure Security Agency (CISA)
  • Palo Alto Networks Unit 42
  • Proofpoint
  • Cisco Talos
  • Group-IB
  • Qualys Threat Research Unit
  • Aikido Security
  • Zenity Labs
  • Hunt.io
  • Sophos
  • Sekoia
  • Recorded Future
  • BleepingComputer
  • The Hacker News

---

*This report synthesizes open-source threat intelligence from July 19-25, 2026. Organizations should validate findings against their specific environments and threat models before implementing recommendations.*