Threat Digest • Monthly Report

Monthly Threat Digest: Vulnerabilities, Attacks & Actors — June 2026

A consolidated overview of the vulnerabilities, attacks, and threat actors that defined June 2026 — covering 29 significant exploited vulnerabilities, 38 tracked malware and attack campaigns, 10 active adversary groups, and 237 associated MITRE ATT&CK TTPs.

01 / Overview

Summary

June proved just how fast attackers can outpace patches, with eleven zero-days actively exploited across the month. Cisco disclosed CVE-2026-20245, an unpatched flaw in Catalyst SD-WAN Manager's CLI that lets an authenticated netadmin-level attacker upload a crafted file, trigger command injection, and seize root on the management plane. Check Point wasn't spared either: CVE-2026-50751 let attackers bypass authentication on its Remote Access VPN and Mobile Access products entirely, with at least one intrusion traced back to a Qilin ransomware affiliate. Oracle PeopleSoft users faced their own reckoning as ShinyHunters exploited CVE-2026-35273 before a patch existed, using it to infiltrate networks, harvest data, and move laterally with ease.

Espionage activity kept pace with the exploitation surge. UNC6508, a PRC-nexus actor, compromised externally facing REDCap research servers and deployed custom malware, INFINITERED, purpose-built to harvest legitimate credentials. Social engineering also had a strong month: attackers spread obfuscated VBScript files through compromised WhatsApp accounts disguised as financial documents, while the Edgecution campaign impersonated IT support over Microsoft Teams to lure victims into installing a malicious browser extension backed by a Python-based host.

ClickFix campaigns rounded out the month by tricking users into pasting malicious commands directly into Windows, each variant delivering a different loader. One, Lorem Ipsum Loader, tied to the Rapid Brigantine group, installed a backdoor chain leading through Oyster, Supper, and MeowBackConn before culminating in Rhysida ransomware. Taken together, June is a clear reminder that patching alone isn't enough; layered defenses and faster detection are now table stakes.

---

02 / Highlights

Insights

---

03 / Landscape

Threat Distribution

Dominant Attack Categories

The month's activity spanned Malware Attacks, Social Engineering, Supply Chain Attacks, Man-in-the-Middle Attacks, Denial-of-Service Attacks, Injection Attacks, and Password Attacks.

---

04 / Vulnerability Details

Celebrity Vulnerabilities

Five vulnerabilities exploited in June carried recognized "celebrity" branding and CISA KEV status, reflecting their scale of impact and public attention.

Vulnerabilities Summary — All 29 Exploited CVEs

---

05 / Attack Details

Attacks Summary — 38 Tracked Attacks & Malware

June's attack activity spanned ransomware, RATs, infostealers, loaders, and backdoors, delivered chiefly through vulnerability exploitation, phishing, social engineering, ClickFix prompts, SEO poisoning, and malvertising.

---

06 / Actor Details

Adversaries Summary — 10 Active Threat Actors

---

07 / Exposure

Targeted Products

Targeted Countries & Industries

Across 195 tracked countries, the United States, Singapore, Vietnam, Canada, and Brazil absorbed the bulk of hostile activity in June. Across 58 tracked industries, the Financial, Education, Government, Technology, and Healthcare sectors were the most targeted, with ransomware operations, data theft, and espionage campaigns driving operational disruption.

---

08 / MITRE ATT&CK

Top 25 MITRE ATT&CK TTPs

A broader set of 237 MITRE ATT&CK TTPs was mapped across June's 38 tracked attacks and 10 active adversaries; the table above reflects the top 25 as ranked in the source digest.

---

09 / Indicators

Top Indicators of Compromise (IoCs)

The digest's full appendix (source PDF pages 108–119) extends this list with complete indicator sets — additional SHA256 hashes, Tor domains, C2 URLs, email addresses, Bitcoin/Tox IDs — for every one of the 38 tracked attacks, including Vidar, Edgecution, Gaslight, TinyRCT, and Prinz Eugen.

---

10 / Key Takeaways

Top 5 Takeaways

---

11 / Recommendations

Recommendations

---

12 / References

References & Patch Links

• CVE-2021-34473 — msrc.microsoft.com/update-guide/en-US/advisory/CVE-2021-34473
• CVE-2021-34523 — msrc.microsoft.com/update-guide/en-US/advisory/CVE-2021-34523
• CVE-2021-31207 — msrc.microsoft.com/update-guide/en-US/advisory/CVE-2021-31207
• CVE-2026-49975 — git.kernel.org/.../commit/?id=49ba7b515c4c0719b866d16f068e62d16a8a3dd1
• CVE-2026-47729 — github.com/squid-cache/squid/releases