# Threat Intel Brief — August 2, 2026

TL;DR

  • Critical Adobe Campaign Classic flaw (CVE-2026-48449, CVSS 10.0) enables unauthenticated remote code execution without user interaction; patch immediately.
  • Russian SVR-linked Storm-2945 compromises hotel Wi-Fi networks globally to deliver CornFlake surveillance RAT via fake browser updates in CaptiveCrunch campaign.
  • Coldcard hardware wallet PRNG vulnerability linked to $70.2M Bitcoin theft from 1,196 addresses in 41 minutes; users must generate new seeds on patched firmware.
  • CISA warns of escalating attacks on internet-exposed PLCs in U.S. water systems; immediate network segmentation required.
  • AI-driven autonomous exploitation demonstrated by Chinese-speaking actor using DeepSeek model to conduct reconnaissance and attacks with minimal human oversight.

---

Critical Threats

Adobe Campaign Classic Maximum-Severity RCE

What happened:
Adobe released emergency patches for CVE-2026-48449 (CVSS 10.0), an incorrect authorization vulnerability in Campaign Classic v7 that allows unauthenticated arbitrary code execution without user interaction. A second flaw, CVE-2026-48448 (CVSS 8.6), enables SQL injection leading to arbitrary file system reads. Adobe states no active exploitation has been observed, but the maximum severity rating and lack of authentication requirement create immediate risk.

Impact:
Organizations running Campaign Classic for marketing automation face potential full system compromise, data exfiltration, and lateral movement. The enterprise marketing platform is widely deployed across government and commercial sectors in Europe and North America. Unauthenticated attack vectors significantly lower exploitation barriers.

Recommendations:

  • Upgrade Adobe Campaign Classic v7 to build 9398 (version 7.4.3) immediately on all Windows and Linux instances.
  • Audit access logs for unusual authentication patterns or unexpected code execution attempts prior to patching.
  • Verify Campaign Classic instances are not directly internet-exposed; enforce access through VPN or bastion hosts.
  • Review SQL query logs for injection attempts and validate file access patterns for anomalies.
  • Implement network segmentation to isolate Campaign Classic servers from critical business systems until patching is complete.

---

Coldcard Hardware Wallet PRNG Flaw Enables $70M Theft

What happened:
A March 2021 firmware integration error in Coldcard hardware wallets routed seed generation to a deterministic software PRNG (MicroPython Yasmarang) instead of proper hardware randomization. On July 30, 2026, an attacker exploited this weakness to drain 1,082.65 BTC (~$70.2M) from 1,196 addresses in 41 minutes. Galaxy Research mapped the sweep to this vulnerability. Affected firmware: Mk2/Mk3 (4.0.0–4.1.9), Mk4/Mk5 (<5.6.0), Q (<1.5.0Q), Edge (<6.6.0X/6.6.0QX).

Impact:
Effective entropy reduced to ~40 bits (Mk3) or ~72 bits (Mk4/Mk5/Q) versus 128 bits for standard BIP-39 seeds. Attackers with knowledge of device UID, timer state, and RNG-call history can reproduce candidate seeds offline and check against blockchain data. Emergency firmware released July 31, but does not repair existing seeds—users must generate new seeds and migrate funds. Exposure determined by firmware version when seed was created, not current version.

Recommendations:

  • Identify all Coldcard devices and determine firmware version active when seeds were originally generated; check against vulnerable ranges.
  • Update all affected devices to patched firmware immediately (Mk3: 4.2.0+; Mk4/Mk5: 5.6.0+; Q: 1.5.0Q+; Edge: 6.6.0X/6.6.0QX+).
  • Generate new seeds on patched firmware and transfer all Bitcoin holdings from old addresses to new wallet addresses—do not restore old seeds.
  • Monitor blockchain for unusual activity on old addresses; review transaction logs for unauthorized sweeps with 30 sat/vB, no-change signature pattern.
  • For multisig configurations, verify quorum is not built entirely from affected Coldcard devices; regenerate keys on patched firmware or alternative hardware wallets.

---

Storm-2945 Hijacks Hotel Wi-Fi in CaptiveCrunch Espionage Campaign

What happened:
Storm-2945, an operational sub-cluster of Midnight Blizzard (APT29, attributed to Russia's SVR), has since May 2026 compromised captive portal infrastructure at hotels and conference centers globally. The actor performs DNS/HTTP redirection to deliver CornFlake RAT via fake browser updates using ClickFix social engineering. The malware captures webcam images, microphone audio, keystrokes, browser credentials (including Chrome App-Bound Encryption bypass), and Microsoft 365/Azure AD tokens. Since July 16, the campaign incorporated device code phishing to obtain MFA-satisfied access.

Impact:
Corporate travelers from government, diplomatic, NGO, and IT sectors face credential theft and surveillance. Compromised tokens enable follow-on access to Microsoft 365 environments and Entra device registration. The campaign exploits shared captive portal equipment across multiple venues, suggesting potential supply chain compromise affecting hospitality networks in multiple countries.

Recommendations:

  • Deploy always-on, full-tunnel VPN solutions for traveling employees to bypass untrusted DNS resolvers and prevent captive portal traffic manipulation.
  • Block Microsoft device code authentication flow via Conditional Access policies in environments where it is not operationally required.
  • Monitor for suspicious Registry Run key creation (HKCU\Software\Microsoft\Windows\CurrentVersion\Run) and scheduled tasks targeting %APPDATA%\svchost32\ paths.
  • Implement user awareness training emphasizing rejection of software updates, certificates, or troubleshooting tools delivered through captive portals or public Wi-Fi.
  • Hunt for token theft indicators including unauthorized access to Token Broker cache .tbres files and anomalous Microsoft 365/Azure AD token usage patterns.

---

CISA: Escalating Attacks on U.S. Water System PLCs

What happened:
CISA issued a warning about a significant increase in cyberattacks targeting internet-exposed programmable logic controllers in U.S. water and wastewater systems. Active exploitation confirmed, though specific threat actors and affected vendors not disclosed.

Impact:
Direct threat to critical water infrastructure and public safety. Successful PLC compromise could enable attackers to disrupt water treatment processes, manipulate chemical dosing, disable safety systems, or cause service outages affecting public health. Water utilities with internet-exposed PLCs face immediate operational and safety risks.

Recommendations:

  • Immediately audit network perimeter to identify any internet-exposed PLCs and industrial control systems.
  • Remove direct internet access to PLCs by placing them behind firewalls with strict access control lists and VPN requirements.
  • Implement network segmentation to isolate operational technology (OT) networks from IT networks and the internet.
  • Review and harden remote access methods for PLCs, requiring multi-factor authentication for all remote connections.
  • Monitor PLC access logs and network traffic for unauthorized connection attempts or configuration changes.

---

Adform Supply Chain Attack Injects Crypto-Stealing Script

What happened:
Attackers compromised Adform's trackpoint-async.js file served from s2.adform[.]net on July 27, 2026 (possibly up to one week prior). The malicious JavaScript replaced Bitcoin, Ethereum, and Tron wallet addresses in user clipboards and form fields with attacker-controlled wallets. Adform removed the malicious code and notified affected clients. The company serves ~1,800 customers and 1.5 billion daily ad impressions.

Impact:
Any visitor to sites embedding the compromised Adform tracking script who copied or entered cryptocurrency wallet addresses may have had those addresses replaced with attacker wallets. The malicious code operated in-browser only with no persistence, but cached versions may persist in user browsers after remediation. Scope remains unclear; no confirmed fund diversions reported yet.

Recommendations:

  • Identify all web properties that embed Adform tracking scripts and verify current script integrity.
  • Force cache invalidation for Adform scripts across all affected properties and notify users to clear browser cache if they visited between July 20–27, 2026.
  • Review transaction logs and user support tickets for cryptocurrency payment errors or wallet address mismatches during the exposure window.
  • Block outbound connections to 84.32.102[.]230:7744 at perimeter and inspect logs for prior connections to this IP.
  • Implement Subresource Integrity (SRI) hashes for all third-party JavaScript resources to detect future tampering.

---

Threat Actor Activity

Chinese-Speaking Actor Deploys AI for Autonomous Exploitation

Palo Alto Networks Unit 42 discovered a Chinese-speaking threat actor (tracked as knaithe/KnYuan) using the DeepSeek AI model through the Hermes Agent framework to conduct semi-autonomous cyberattacks. The operator issued initial commands via Telegram, after which the AI agent independently identified internet-facing systems, selected public exploits, and executed attacks without further human intervention. The actor targeted workflow automation platforms (Langflow, n8n, Marimo) and NetScaler appliances, launching over 460 exploitation attempts with only three confirmed successful compromises. The operation was discovered when the actor inadvertently exposed infrastructure by starting an HTTP server that made model configurations, API keys, exploit scripts, and session logs publicly accessible. Targeted CVEs include CVE-2026-33017 (Langflow), CVE-2026-21858 and CVE-2025-68613 (n8n), CVE-2026-39987 (Marimo), and CVE-2026-3055 (NetScaler).

Defensive priorities: Patch affected systems immediately; monitor for T1046 network service discovery patterns via threat intelligence platforms (FOFA, Shodan) querying your assets; detect Telegram API traffic from server infrastructure; implement behavioral detection for GitHub API access patterns from endpoints.

---

OctLurk and SilkLurk Target Central Asian Governments

A Chinese-speaking threat actor has been conducting targeted cyber espionage against government organizations in Central Asia (Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan) and Syria since January 2025. The actor deploys custom multi-plugin malware frameworks (OctLurk and SilkLurk) with memory-resident techniques to evade detection. Affected sectors include ministries of foreign affairs, law enforcement, healthcare, research, and government offices. TTPs include credential dumping via Impacket secretsdump.py, keylogging with AnyDesk masquerading, browser password extraction, PlugX backdoor deployment via DLL side-loading, and SOCKS5/transparent proxying via LurkProxy. Infrastructure overlaps with prior SilentRaid (MystRodX/TrustFall) campaigns suggest possible continuity with earlier Chinese-nexus operations.

Defensive priorities: Monitor for DLL side-loading chains and unsigned DLLs loaded by legitimate processes; detect in-memory-only malware execution via process hollowing and reflective DLL injection; implement network monitoring for connections to dns.ssentialserv[.]xyz, dns.multitoconference[.]com, and 154.196.162[.]76; detect credential dumping activity targeting domain controllers.

---

HollowFrame and Matryoshka Target Law Firms

An unattributed threat actor deployed previously undocumented Go-based loader framework (HollowFrame) and Rust-based backdoor (Matryoshka) in spear-phishing attacks targeting law firms. The attack chain begins with a spear-phishing message containing a link to an encrypted archive with a Windows Shortcut (LNK) file that triggers multi-stage infection. The malware uses DLL side-loading (python.exe with rogue python311.dll) to load HollowFrame, which deploys Matryoshka via a second side-loading chain (version.dll). C2 communication occurs over HTTP to 45.158.196[.]184:8888 and via GitHub repositories using per-host mailbox directories. Capabilities include command execution, Active Directory reconnaissance, file transfer, and secondary payload delivery supporting credential theft and lateral movement.

Defensive priorities: Monitor for suspicious LNK file execution followed by PowerShell network connections; implement application whitelisting and scrutinize DLL side-loading attempts involving python.exe, python311.dll, version.dll, and wtsapi32.dll in non-standard directories; detect scheduled task creation for persistence via Windows Event ID 4698; establish behavioral detection for GitHub API access patterns from endpoints.

---

Fuyao Campaign: Android TV Boxes Weaponized for Ad Fraud

Bitsight researchers discovered a campaign called Fuyao where cheap Android TV boxes shipped with malicious apps that spoof device identities as Samsung, Huawei, Xiaomi, or Vivo phones to perform ad fraud and repurpose users' broadband connections as SOCKS5 proxies. The operation is attributed to Zhejiang Fengwo IoT Technology Co., Ltd., a mainland China company. The malware uses YOLOv8s object detection, Android accessibility services, and Google ML Kit OCR to locate and click advertisements. When HDMI signals are detected, devices function as SOCKS5 exit nodes; when HDMI is off, devices revert to ad-fraud tasks. Bitsight's sinkhole captured 65,957 reports from approximately 38,000 unique MAC addresses in a single day.

Defensive priorities: Verify Play Protect certification on all Android devices before deployment; monitor network traffic for unexpected SOCKS5 proxy behavior and outbound connections to residential proxy networks; implement network segmentation to isolate Android TV boxes from trusted networks; detect anomalous device identity spoofing by correlating device fingerprints with expected hardware profiles.

---

Geopolitical Context

The CaptiveCrunch campaign represents an evolution in Russian SVR tradecraft, targeting the hospitality sector to exploit business travelers accessing corporate resources over shared networks. The operation appears consistent with SVR's longstanding mandate to collect strategic intelligence in support of Russian foreign policy objectives, particularly from government, diplomatic, NGO, and IT sector personnel. The campaign's sophistication—including AI-augmented operations, adversary-in-the-middle phishing, device code abuse, and cross-platform malware delivery—reflects continued Russian investment in technical collection capabilities despite Western sanctions and attribution efforts.

The targeting of Central Asian governments by a Chinese-speaking actor reflects sustained intelligence collection priorities in a region of strategic competition between China, Russia, and Western powers. The focus on government ministries, foreign affairs offices, and law enforcement across Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and Syria is consistent with strategic intelligence requirements related to Belt and Road Initiative corridors, counterterrorism cooperation, and regional diplomatic positioning.

CISA's warning about escalating attacks on U.S. water system PLCs underscores broader trends in adversary focus on operational technology environments, where legacy systems with limited security controls intersect with public service delivery. While no attribution has been provided, water and wastewater systems have previously been targeted by actors linked to Iran, Russia, and China in separate campaigns.

---

Recommended Actions

Immediate (0–24 hours)

  • Patch Adobe Campaign Classic to build 9398 (v7.4.3) on all instances; audit access logs for suspicious activity.
  • Update Coldcard firmware and generate new seeds on patched versions; transfer all Bitcoin holdings from old addresses.
  • Remove internet exposure from water system PLCs; implement network segmentation and VPN-only access.
  • Force cache invalidation for Adform scripts on all web properties; notify users to clear browser cache if they visited affected sites July 20–27.
  • Deploy VPN solutions for traveling employees to bypass untrusted captive portal DNS resolvers.

Within 24–72 hours

  • Patch CVE-2026-33017 (Langflow ≥1.9.0), CVE-2026-21858 and CVE-2025-68613 (n8n ≥1.121.1), CVE-2026-39987 (Marimo ≥0.23.0), and CVE-2026-3055 (NetScaler per vendor bulletin).
  • Update Google Chrome to version 151 or later via enterprise update mechanisms; enable automatic updates.
  • Audit Arch Linux systems for AUR package installations; review package install/update logs for suspicious activity.
  • Block Microsoft device code authentication flow via Conditional Access policies where not operationally required.
  • Implement Subresource Integrity (SRI) hashes for all third-party JavaScript resources.

Within one week

  • Apply VMware vCenter patches per vendor advisories; review access logs for suspicious administrative activity.
  • Patch Cisco Secure Firewall Management Center per Cisco security advisories; restrict network access to management interfaces.
  • Review multisig configurations for Coldcard devices; regenerate keys on patched firmware or alternative hardware wallets if quorum built entirely from affected devices.
  • Implement behavioral analytics to identify autonomous attack patterns, such as machine-speed decision cycles between reconnaissance and exploitation phases.
  • Conduct user awareness training emphasizing rejection of software updates delivered through captive portals or public Wi-Fi.

---

Watch List

  • Rails Active Storage vulnerability: Critical flaw enables unauthenticated file read and potential RCE; patches released but specific CVE not yet assigned. Monitor vendor advisories.
  • 4G/5G core network vulnerabilities: 84 flaws affecting Open5GS, free5GC, OpenAirInterface, SD-Core, and eUPF; 81 CVEs assigned. Monitor vendor advisories for patch availability.
  • Amgen data breach: Pharmaceutical company disclosed breach affecting cloud systems operated by third-party service providers; patient health information and proprietary corporate data exposed. Monitor for additional details.
  • Arch Linux AUR package takeovers: Package adoption feature temporarily disabled due to malicious takeovers. Monitor Arch Linux security advisories for list of confirmed compromised packages.

---

Sources

  • Adobe Security Bulletin (APSB-2026 series)
  • BleepingComputer
  • CERT.BE (Belgium)
  • CISA Advisories
  • Cisco Security Advisories
  • Coinkite Security Advisory
  • Galaxy Research
  • Google Chrome Release Notes
  • Kaspersky Threat Intelligence
  • Microsoft Security Blog
  • Palo Alto Networks Unit 42
  • The Hacker News
  • VMware Security Advisories (VMSA)