# Threat Intel Brief — August 14, 2026

TL;DR

  • North Korean Lazarus Group exploited a Windows zero-day (CVE-2026-68820) to compromise defense and aerospace firms in France, Germany, Brazil, and India as part of Operation Dream Job.
  • Critical VMware vCenter vulnerability (CVE-2026-59310, CVSS 9.8) actively exploited across 361 IPs in 47 countries; attackers deploying reverse SSH for persistence.
  • Microsoft SharePoint authentication bypass (CVE-2026-55040, CVSS 9.1) weaponized within 24 hours of public PoC release; active exploitation confirmed.
  • Supply chain attack: Malicious LiteLLM packages on PyPI exfiltrated credentials from 2,100+ organizations including NVIDIA, Cisco, and Deloitte.
  • Adobe patches three CVSS 10.0 vulnerabilities in ColdFusion and Campaign Classic (CVE-2026-48362, CVE-2026-71398, CVE-2026-27302); immediate patching required.

---

Critical Threats

Lazarus Exploits Windows Zero-Day in Defense Sector Espionage

What happened: North Korea's Lazarus Group weaponized CVE-2026-68820, a use-after-free vulnerability in Windows AFD.sys, to achieve SYSTEM-level privilege escalation on Windows 11 and Windows Server 2025. The campaign targeted defense, aerospace, and aviation organizations in France, Germany, Brazil, and India through Operation Dream Job—a multi-year espionage operation using fraudulent LinkedIn recruitment lures. Attackers deployed the Troy backdoor (17 commands including file exfiltration and process injection), the FudModule 3.1 rootkit (disabling EDR and tampering with Smart App Control), and compromised Roundcube webmail servers (exploiting CVE-2025-49113) to establish command-and-control infrastructure.

Impact: The zero-day exploitation enabled full system compromise of defense contractors handling sensitive military technologies including surveillance sensors, drones, and robotics. Lazarus achieved persistent access through reverse SSH tunnels and kernel-mode rootkits, positioning the group for long-term intelligence collection. The compromise of a French organization for use in subsequent spear-phishing demonstrates supply chain risk and operational sophistication. Microsoft patched CVE-2026-68820 in the August 2026 Patch Tuesday release.

Recommendations:

  • Apply Microsoft August 2026 Patch Tuesday updates immediately to remediate CVE-2026-68820; prioritize Windows 11 builds 26100/26200 and Windows Server 2025 in defense environments.
  • Hunt for FudModule rootkit indicators: EDR telemetry suppression, Smart App Control tampering (VerifiedAndReputablePolicyState modifications), and kernel-mode driver loading from unexpected paths.
  • Implement security awareness training on LinkedIn recruitment scams targeting defense/aerospace employees; establish verification procedures for unsolicited recruiter contacts and PDF document requests.
  • Scan Roundcube webmail servers for CVE-2025-49113 exploitation and RelayShell PHP webshell; monitor for text file-based command relay patterns on WordPress and SharePoint infrastructure.

---

VMware vCenter RCE Under Mass Exploitation

What happened: Threat actors are actively exploiting CVE-2026-59310, a critical directory-traversal vulnerability in VMware vCenter Server (CVSS 9.8), to achieve unauthenticated remote code execution. QUIRSO identified 361 compromised IP addresses across 47 countries (concentrated in Germany, US, Turkey, Iran, and France) within five days of public disclosure. Attackers deploy reverse_ssh frameworks via malicious cron jobs to establish persistent remote access that bypasses inbound security controls. The campaign is attributed to a suspected APT actor based on infrastructure patterns and operational tradecraft.

Impact: VMware vCenter manages entire virtual infrastructures including ESXi hosts, VMs, and access controls. Successful exploitation grants complete infrastructure compromise, enabling data exfiltration, operational disruption, and lateral movement across virtualized environments. The rapid weaponization and global victim distribution indicate coordinated exploitation by a sophisticated threat actor. Organizations with unpatched vCenter instances face imminent compromise risk.

Recommendations:

  • Apply Broadcom VMware vCenter patches (VMSA-2026-0006) immediately to all instances; no workarounds exist.
  • Hunt for indicators of compromise: unauthorized cron jobs, reverse_ssh binaries (use QUIRSO's published YARA rule), and outbound SSH connections from vCenter appliances to unknown external IPs.
  • Review vCenter logs for path traversal patterns (directory traversal attempts) between July 28 and present, especially POST requests to /sdk/ and /websso endpoints.
  • Block or monitor outbound SSH connections from vCenter servers at network perimeter; investigate any reverse SSH tunnels to external infrastructure.

---

Microsoft SharePoint Authentication Bypass Actively Exploited

What happened: CVE-2026-55040, a critical Microsoft SharePoint vulnerability (CVSS 9.1) enabling JWT token forgery, is under active exploitation following Rapid7's publication of a Python-based proof-of-concept exploit on August 11, 2026. The flaw affects SharePoint Enterprise Server 2016 and 2019, allowing unauthenticated attackers to bypass authentication and impersonate site users or administrators. KEVIntel telemetry recorded 12 exploitation attempts from 8 unique IPs across 5 countries (Hong Kong, Japan, Netherlands, Taiwan, US) between July 19 and August 13, with eight attempts occurring within 24 hours of the PoC release.

Impact: Attackers can disclose files and modify data without authentication, posing immediate risk to organizations with internet-facing SharePoint servers. This is the fifth actively exploited SharePoint vulnerability in 2026. CISA warned federal agencies on July 15, 2026, and added CVE-2026-55040 to the Known Exploited Vulnerabilities catalog. SharePoint has been targeted in 14 prior actively exploited vulnerabilities since 2021, with 8 used in ransomware campaigns.

Recommendations:

  • Apply Microsoft July 2026 Patch Tuesday updates to all SharePoint servers immediately, prioritizing internet-facing instances.
  • Review SharePoint access logs since July 19, 2026 for suspicious JWT authentication attempts, especially from IPs in Hong Kong, Japan, Netherlands, Taiwan, and unknown US sources.
  • Monitor for anomalous SharePoint user activity including unexpected privilege escalations, file access by service accounts, or domain controller queries from SharePoint servers.
  • Implement network segmentation to restrict SharePoint server access to domain controllers and limit exposure of SharePoint instances to the internet.

---

Supply Chain Attack: Malicious LiteLLM Packages Expose 2,100+ Organizations

What happened: Two malicious LiteLLM releases (versions 1.82.7 and 1.82.8) were published on PyPI on March 24, 2026, containing credential-stealing code that executed at Python interpreter startup via a litellm_init.pth file. The packages harvested cloud keys (AWS, Azure, GCP), SSH keys, Kubernetes tokens, database passwords, and AI model API keys (OpenAI, Anthropic) to attacker-controlled infrastructure (models.litellm[.]cloud). CloudSEK obtained a dataset of approximately 434,000 captured files indicating potential exposure to 2,100+ organizations including NVIDIA, Cisco, Deloitte, Volkswagen, FedEx, Siemens, and X Corp. The campaign is linked to TeamPCP/UNC6780, which previously compromised Aqua Security's Trivy scanner (CVE-2026-33634, added to CISA KEV March 26, 2026). The FBI issued advisory FLASH-20260702-01 warning that exfiltrated credentials will likely be weaponized long-term.

Impact: Organizations that installed affected LiteLLM versions—even as transitive dependencies in CI/CD pipelines—face credential compromise. Long-lived secrets (static cloud keys, SSH keys, PyPI tokens) remain exploitable until rotated. The malicious code executed regardless of whether LiteLLM was explicitly imported, affecting automated build systems and continuous integration environments. The FBI warns stolen credentials will be weaponized over an extended timeframe.

Recommendations:

  • Check CloudSEK public lookup using your organization's domain to determine if you appear in the exposed dataset.
  • Audit Python environments and CI/CD pipelines for LiteLLM 1.82.7 or 1.82.8 installations between March 24, 2026 10:39 UTC and 16:00 UTC; check pip logs, requirements files, and transitive dependencies.
  • Immediately rotate all credentials accessible in affected environments: cloud provider keys, SSH keys, Kubernetes service account tokens, database passwords, PyPI publishing tokens, and AI model API keys.
  • Review outbound network logs for connections to models.litellm[.]cloud from March 24, 2026 onward to identify compromised hosts.
  • Migrate from long-lived static credentials to short-lived tokens (OIDC for GitHub Actions, IAM roles for AWS, workload identity for Kubernetes) in CI/CD pipelines.

---

Adobe Patches Three CVSS 10.0 Vulnerabilities

What happened: Adobe released patches for multiple critical vulnerabilities in ColdFusion, Commerce, and Campaign Classic, including three rated CVSS 10.0: CVE-2026-48362 (ColdFusion OS command injection), CVE-2026-71398 (Campaign Classic arbitrary code execution), and CVE-2026-27302 (Campaign Classic authorization bypass). Adobe rates ColdFusion and Campaign Classic updates as Priority 1, indicating higher risk of future targeting. CVE-2026-71362 in Adobe Commerce/Magento is already under active exploitation for customer account hijacking, with Sansec Shield WAF blocking live attacks.

Impact: CVE-2026-48362 enables unauthenticated OS command injection leading to full system compromise. Campaign Classic flaws allow arbitrary code execution via authorization bypass. Adobe Commerce flaw enables session hijacking and access to private customer data including payment information. Organizations running on-premise or hybrid Adobe deployments face immediate risk of full server takeover, data exfiltration, and lateral movement.

Recommendations:

  • Update Adobe ColdFusion to version 2025.0.12 or 2023.0.23 within 72 hours per Adobe Priority 1 guidance.
  • Update Adobe Campaign Classic v7 on-premise and hybrid deployments to version 7.4.4 build 9400 immediately.
  • Apply available patches for Adobe Commerce to address CVE-2026-71362 privilege escalation flaw.
  • Monitor ColdFusion and Campaign Classic logs for suspicious command execution, SQL injection attempts, or unauthorized privilege changes.
  • Deploy or configure WAF rules to block CVE-2026-71362 exploitation attempts if patching cannot be completed immediately.

---

Threat Actor Activity

Lazarus Group (North Korea)

Exploited Windows zero-day CVE-2026-68820 in Operation Dream Job campaign targeting defense and aerospace firms in France, Germany, Brazil, and India. Deployed Troy backdoor, FudModule 3.1 rootkit, and compromised Roundcube servers for C2. Demonstrates sustained investment in zero-day capabilities and social engineering tradecraft aligned with DPRK weapons development and sanctions evasion priorities.

TeamPCP/UNC6780

Conducted supply chain attack via malicious LiteLLM PyPI packages following Aqua Security Trivy scanner compromise. Harvested credentials from 2,100+ organizations including major technology and defense contractors. FBI warns stolen credentials will be weaponized long-term. Campaign demonstrates sophisticated understanding of software supply chains and CI/CD environments.

City-Forum Campaign

Ongoing data theft operation targeting misconfigured Salesforce Experience Cloud and ServiceNow portals since March 2025. Uses custom tools to enumerate and exfiltrate data exposed to unauthenticated guest users. Targets telecommunications, banking, enterprise software, and public-sector organizations globally. Operates from single IP (158.220.87.79, Contabo-hosted) with increasing activity volumes.

Jewelbug (Earth Alux, REF7707)

China-based threat actor conducting dual-track espionage and cryptocurrency fraud operations. Compromised 15 government webmail tenants in Middle Eastern country via shared hosting infrastructure. Deployed Antino backdoor, ClientKing implant, and malicious browser extensions. Parallel cryptocurrency fraud operation uses AI-generated content and hundreds of lookalike domains impersonating exchanges.

Akira Ransomware Affiliates

Demonstrated EDR evasion by forcing Safe Mode boot to disable security controls. Successfully exfiltrated data using s5cmd to attacker-controlled S3 buckets but failed to encrypt systems due to memory constraints. Rapid five-hour attack timeline from VPN compromise through data theft. Highlights evolution of ransomware tactics toward data theft over encryption.

---

Geopolitical Context

North Korea's exploitation of CVE-2026-68820 against defense contractors across four continents demonstrates Pyongyang's continued prioritization of cyber espionage to circumvent sanctions and support weapons programs. The targeting of European defense industrial base entities occurs amid heightened security concerns and defense modernization efforts. The supply chain attack via LiteLLM packages reflects broader trends in software supply chain compromise affecting critical infrastructure and technology sectors globally. Belgium's CERT warnings on Cisco firewall and Metabase vulnerabilities underscore European coordination on vulnerability management and critical infrastructure resilience. The FBI's advisory on social media account compromise for sexual exploitation highlights transnational cybercrime challenges requiring cross-border law enforcement cooperation.

---

Recommended Actions

Immediate (0-24 hours)

  • Patch CVE-2026-59310 (VMware vCenter), CVE-2026-55040 (SharePoint), CVE-2026-71362 (Adobe Commerce), CVE-2026-48362 (Adobe ColdFusion), and CVE-2026-68820 (Windows AFD.sys).
  • Hunt for reverse_ssh binaries on vCenter systems using QUIRSO's YARA rule.
  • Block IP 158.220.87.79 and domain city-forum.com; audit Salesforce/ServiceNow guest-user permissions.
  • Remove malicious Chrome VPN extensions; cross-reference against Socket's published list of 737 extension IDs.
  • Rotate credentials potentially exposed in LiteLLM supply chain attack (March 24, 2026).

24-72 hours

  • Apply Microsoft August 2026 Patch Tuesday updates (398 vulnerabilities, 42 critical).
  • Update Adobe Campaign Classic v7 to version 7.4.4 build 9400.
  • Audit Python environments for LiteLLM 1.82.7/1.82.8; check transitive dependencies.
  • Review SharePoint access logs since July 19, 2026 for JWT authentication anomalies.
  • Implement MFA on all VPN and remote access solutions, particularly SonicWall devices.

This week

  • Conduct threat hunt for FudModule rootkit indicators and Troy backdoor behaviors.
  • Scan Roundcube webmail servers for CVE-2025-49113 exploitation and RelayShell webshell.
  • Implement browser extension allowlisting and audit installed extensions for suspicious PDF viewers.
  • Review Salesforce LWR sites for GraphQL-based enumeration via /webruntime/api endpoints.
  • Deploy security awareness training on LinkedIn recruitment scams targeting defense/aerospace employees.

---

Watch List

  • CVE-2026-62832 (LegacyHive): Windows User Profile Service privilege escalation; public PoC available, patched August 2026.
  • CVE-2026-50656 bypass (ShieldBreak): Microsoft Defender zero-day bypassing RoguePlanet patch; PoC released, no patch available.
  • CVE-2026-20349: Cisco Secure Firewall ASA/FTD DoS vulnerability; active exploitation confirmed, CISA KEV deadline August 14, 2026.
  • CVE-2026-58231: SAP Commerce Cloud RCE (CVSS 10.0); patched August 2026, no active exploitation reported.
  • Metabase SQL injection: Active exploitation confirmed by CERT.BE; specific CVE not yet publicly assigned.
  • Plug and Pwn attacks: Windows Plug and Play exploitation for SYSTEM access; PoC demonstrated at DEF CON 34, no active exploitation reported.

---

Sources

  • BleepingComputer: Lazarus hackers exploited Windows zero-day to target defense firms
  • The Hacker News: Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor
  • BleepingComputer: Critical VMware vCenter RCE flaw exploited for reverse SSH access
  • The Hacker News: Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access
  • The Hacker News: Attackers Exploit SharePoint Authentication Bypass After Public PoC Release
  • BleepingComputer: Hackers leverage new Microsoft SharePoint exploit in attacks
  • The Hacker News: Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations
  • The Hacker News: Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws
  • BleepingComputer: Hackers exploit critical Adobe Commerce flaw to hijack customer accounts
  • The Hacker News: Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS
  • CERT.BE: Warning: Microsoft Patch Tuesday August 2026 patches 398 vulnerabilities
  • CERT.BE: Warning: Actively Exploited DoS vulnerability in Cisco Secure Firewall
  • CERT.BE: Warning: Actively exploited SQL injection in Metabase
  • BleepingComputer: "City-Forum" data-theft attacks target Salesforce, ServiceNow portals
  • BleepingComputer: Hundreds of fake Chrome VPN extensions route traffic through a proxy
  • The Hacker News: 737 Chrome VPN Extensions Caught Routing Traffic Through Proxies
  • BleepingComputer: Hackers breach govt webmail while running parallel crypto fraud
  • BleepingComputer: Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt
  • The Hacker News: SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code
  • The Hacker News: ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access
  • BleepingComputer: Microsoft patches LegacyHive Windows zero-day vulnerability
  • BleepingComputer: Plug and Pwn attack uses fake USB devices for Windows SYSTEM access
  • The Hacker News: OpenAI, Anthropic, Google API Flaw Let Weaker AI Models Decode Stronger Models' Reasoning
  • BleepingComputer: Android malware combo takes out loans and relays victims' credit cards
  • BleepingComputer: FBI: Hackers target online accounts to steal nude photos
  • BleepingComputer: Trezor discloses data breach affecting nearly 14,000 customers