# Threat Intel Brief — July 28, 2026

TL;DR

  • Critical zero-days under active exploitation: Alibaba FastJson RCE (CVE-2026-16723) targeting US firms and Arista VeloCloud Orchestrator command injection (CVE-2026-16812) with CVSS 10.0 require immediate patching.
  • Public exploits released: vBulletin pre-auth RCE and Windows AD CS Certighost (CVE-2026-54121) PoCs now available; patch window closing rapidly.
  • Botnet evolution: Dysphoria IoT botnet rebounds from March law enforcement takedown with blockchain C2 infrastructure, compromising 200,000 devices globally via CVE-2017-17215, CVE-2020-8515, CVE-2025-9528, CVE-2025-28137, CVE-2025-34152, and CVE-2025-55182.
  • Supply chain and extortion activity: ShinyHunters breached Ernst & Young via third-party compromise; Anubis ransomware hit Coca-Cola subsidiary Fairlife with data leak following non-payment.
  • Geopolitical targeting: East Asia-linked actor deploys novel TELESHIM malware against Middle East governments; China-nexus group targets Indian finance sector with Cruciferra crypter.

Critical Threats

FastJson Zero-Day RCE (CVE-2026-16723)

What happened: Attackers are actively exploiting a remote code execution vulnerability in Alibaba's FastJson library versions 1.2.68–1.2.83 deployed as Spring Boot fat-JARs. The flaw allows unauthenticated RCE without user interaction. US organizations across financial services, healthcare, computing, and retail sectors are confirmed targets, with limited activity in Singapore and Canada. No patch is available; FastJson 1.x is no longer maintained.

Impact: Complete system compromise via arbitrary code execution. Organizations using affected versions in production face immediate risk. The vulnerability requires only that the target runs as a Spring Boot executable JAR, making exploitation trivial once identified.

Recommendations:

  • Enable SafeMode in FastJson immediately on all affected instances as temporary mitigation
  • Migrate to fastjson2 or downgrade to FastJson 1.2.60 or earlier if application compatibility permits
  • Deploy network detection for FastJson exploitation patterns focusing on @type processing abuse
  • Review application logs for POST requests with suspicious deserialization activity since disclosure

Arista VeloCloud Orchestrator Command Injection (CVE-2026-16812)

What happened: Arista patched a CVSS 10.0 unauthenticated OS command injection vulnerability in VeloCloud Orchestrator on-premises deployments actively exploited in the wild. Three attacker IP addresses identified: 8.19.75.217, 206.72.242.124, 206.72.242.162. CISA added CVE-2026-16812 to the Known Exploited Vulnerabilities catalog; federal agencies must patch by July 30, 2026.

Impact: Remote attackers can compromise VCO instances without credentials, gaining full control over SD-WAN orchestration and potentially pivoting to managed Edge devices. Confidentiality, integrity, and availability of all managed infrastructure at risk.

Recommendations:

  • Immediately upgrade VCO on-premises to version 5.2.3.14, 6.1.3.4, 6.4.2.4, or 7.0.0.1 depending on release train
  • Block attacker IPs 8.19.75.217, 206.72.242.124, 206.72.242.162 at perimeter and review logs for prior connections
  • Restrict VCO web interface access to administrative networks only until patching complete
  • If compromise suspected, rotate all VCO and managed device credentials; consider full instance replacement

vBulletin Pre-Auth RCE Exploit Public (CVE-2026-61511)

What happened: A public proof-of-concept exploit was released July 27 for a pre-authentication code execution vulnerability in vBulletin 6.2.1 and earlier, and 6.1.6 and earlier. The flaw allows unauthenticated attackers to execute arbitrary PHP code via the template engine without user interaction. Patches were released in late June; version 6.2.2 released July 1. A four-week window existed between patch and public disclosure.

Impact: Unauthenticated remote code execution on internet-facing self-hosted vBulletin forums. vBulletin has a history of similar template-engine RCE flaws that drew exploitation attempts within days of disclosure.

Recommendations:

  • Immediately upgrade self-hosted vBulletin to version 6.2.2 or apply security patches for 6.2.1, 6.2.0, or 6.1.6
  • Review web server logs for POST requests to ajax/render/pagenav with unusually long pagenav parameters between late June and July 27
  • Inspect template runtime files for unauthorized modifications or webshells if compromise suspected
  • Restrict internet exposure of vBulletin admin panels via IP allowlisting

Dysphoria IoT Botnet Resurgence

What happened: Following March 2026 law enforcement disruption of JackSkid infrastructure, the Dysphoria botnet rapidly evolved to use Ethereum Name Service and Solana Name Service for command-and-control, plus victim device relay mesh architecture. The botnet has compromised approximately 200,000 routers, cameras, and IoT devices worldwide, exploiting CVE-2025-55182, CVE-2025-34152, CVE-2025-28137, CVE-2025-9528, CVE-2017-17215, CVE-2020-8515, and weak Telnet/SSH credentials. Operators advertise DDoS-for-hire services claiming 4 Tbps capacity.

Impact: Organizations with vulnerable IoT devices face compromise leading to DDoS participation and unauthorized proxy relay. Infected devices abuse UPnP to create port forwarding rules exposing internal services. Blockchain-based C2 makes takedown difficult.

Recommendations:

  • Patch IoT devices for CVE-2025-55182, CVE-2025-34152, CVE-2025-28137, CVE-2025-9528, CVE-2017-17215, CVE-2020-8515
  • Change default Telnet/SSH credentials; enforce strong password policies
  • Disable UPnP on routers and IoT devices unless required; monitor for unexpected port forwarding
  • Block Telnet/SSH access from internet; segment IoT devices on isolated VLANs
  • Monitor for outbound connections to Ethereum ENS or Solana SNS domains from IoT devices

Threat Actor Activity

ShinyHunters Breaches Ernst & Young

ShinyHunters extortion gang claims breach of Ernst & Young via supply-chain attack, obtaining credentials to access Jira, GitHub, and Azure environments between March 28 and April 12, 2026. The group exfiltrated support tickets and documents containing client tax information over a 15-day period. ShinyHunters set a July 31 deadline for contact before releasing stolen data. The gang has established track record including recent breaches at NAIC, Medtronic, Kodak, and Abbott.

Defensive actions: Implement strict third-party risk management with continuous vendor access monitoring; deploy behavioral analytics for cloud environments to detect credential misuse; establish DLP controls for bulk document downloads from IT service management platforms.

Anubis Ransomware Hits Coca-Cola Subsidiary

Anubis ransomware operation attacked Fairlife, a Coca-Cola subsidiary with over $1 billion in annual sales, encrypting Nutanix virtualization systems and exfiltrating approximately one terabyte of data. Production operations were temporarily suspended across multiple US facilities. Following Coca-Cola's refusal to negotiate, Anubis published the stolen data on their leak site. This represents the first publicly documented Anubis attack.

Defensive actions: Implement robust backup procedures for virtualization infrastructure with offline/immutable copies; deploy network segmentation isolating production/OT from corporate IT; establish privileged access management for hypervisor interfaces.

East Asia-Linked Actor Targets Middle East Governments

An unattributed threat actor assessed to originate from East Asia deployed previously unreported malware families TELESHIM, MIXEDKEY, and BINDCLOAK against government entities in the Middle East. TELESHIM backdoor leverages Telegram API for C2 to blend with legitimate traffic. The campaign employs DLL side-loading, environmental keying (volume serial number-based decryption), and heavy obfuscation. Active post-compromise operations observed July 7-9, 2026.

Defensive actions: Monitor for DLL side-loading via legitimate executables loading unexpected DLLs; detect Telegram API abuse from non-browser processes; hunt for scheduled task creation correlated with reconnaissance commands during 4-12 a.m. UTC window.

China-Linked Group Targets Indian Finance Sector

China-linked cybercrime actor TA4922 (overlaps with Silver Fox) conducted phishing campaigns targeting Indian taxpayers, tax professionals, and corporate finance teams using income tax-themed lures. The group deploys the Cruciferra crypter service, which employs BYOVD attacks using vulnerable GoFlyDrv.sys driver to terminate EDR processes, plus Process Ghosting for fileless execution. Campaigns active April-June 2026 delivered commodity RATs including Agent Tesla, AsyncRAT, Formbook, Remcos, and XWorm.

Defensive actions: Monitor for DLL side-loading and driver blocklisting to prevent BYOVD attacks; detect Process Ghosting via file deletion preceding process creation; implement email security controls for tax-themed phishing lures.

Geopolitical Context

The FastJson zero-day exploitation targeting US organizations underscores supply chain risks from widely deployed Chinese-origin open-source software, particularly when vendor support lifecycles create prolonged exposure. The incident occurs amid ongoing technology decoupling trends and may prompt renewed scrutiny of foreign-developed components in critical infrastructure.

The Dysphoria botnet's rapid recovery following trilateral (US-German-Canadian) law enforcement action demonstrates the limitations of infrastructure seizure against adversaries employing decentralized blockchain technologies. The botnet's exploitation of unpatched IoT devices affects edge infrastructure widely deployed in European and North American critical sectors.

East Asia-linked targeting of Middle East government networks reflects persistent cyber espionage interest in a strategically significant region. The use of Telegram for C2 and deployment of novel malware families signals continued adversary adaptation to blend malicious traffic with commercial platforms.

China-nexus operations targeting Indian financial and government infrastructure during tax season illustrate the blurred line between financially motivated cybercrime and potential intelligence collection, occurring against a backdrop of sustained strategic competition between Beijing and New Delhi.

Recommended Actions

Immediate (0-24 hours)

  • Patch CVE-2026-16812: Upgrade all Arista VeloCloud Orchestrator on-premises deployments; block known attacker IPs
  • Mitigate CVE-2026-16723: Enable FastJson SafeMode on all affected instances; begin migration planning to fastjson2
  • Update vBulletin: Upgrade self-hosted instances to 6.2.2 or apply late-June security patches
  • Audit IoT devices: Identify and patch devices vulnerable to CVE-2025-55182, CVE-2025-34152, CVE-2025-28137, CVE-2025-9528, CVE-2017-17215, CVE-2020-8515; change default credentials

Near-term (24-72 hours)

  • Patch CVE-2026-54121: Apply Microsoft July 2026 updates to all AD CS servers and domain controllers for Certighost
  • Update n8n: Upgrade workflow automation platform to 2.31.5 or 2.32.1+ to address sandbox escape (CVE-2026-27577 follow-on)
  • Review third-party access: Audit vendor credentials and access to corporate systems following ShinyHunters supply-chain breach pattern
  • Hunt for compromise: Search logs for indicators of FastJson, VeloCloud, vBulletin, and Dysphoria exploitation

This week

  • Disable UPnP: Turn off UPnP on routers and IoT devices unless explicitly required; monitor for anomalous port forwarding
  • Segment networks: Isolate IoT devices and OT environments from corporate IT networks
  • Enhance monitoring: Deploy detection for blockchain name service queries from IoT devices, Telegram API abuse from system processes, and DLL side-loading patterns
  • Backup validation: Test recovery procedures for virtualization infrastructure following Fairlife ransomware incident

Watch List

  • n8n workflow automation: Monitor for suspicious workflow modifications by authenticated users; hunt for shells spawned by Node.js processes
  • Cruciferra crypter campaigns: Watch for BYOVD attacks using GoFlyDrv.sys and Process Ghosting techniques across financial services and government sectors
  • Operation BlueDash: Detect unauthorized RMM tool installations (Level RMM, ScreenConnect, Tactical RMM) following phishing with workplace collaboration lures
  • Fraudulent mobile apps: Verify cryptocurrency wallet app authenticity through official developer websites before credential entry
  • TELESHIM malware: Monitor for DLL side-loading via RegSchdTask.exe and GoProAlertService.exe in Middle East government networks

Sources

  • BleepingComputer: FastJson RCE, Arista VeloCloud, Dysphoria botnet, Certighost, Apple crypto wallet fraud, Coca-Cola Fairlife ransomware, Ernst & Young breach
  • The Hacker News: Dysphoria blockchain C2, vBulletin exploit, n8n sandbox escape, Operation BlueDash, Cruciferra crypter, TELESHIM malware
  • CISA Known Exploited Vulnerabilities Catalog: CVE-2026-16812
  • Vendor advisories: Arista, Alibaba, vBulletin, n8n, Microsoft
  • Threat intelligence: Zscaler ThreatLabz, Proofpoint, Security Joes, Seqrite Labs, CNCERT/XLab