Monthly Threat Digest JULY 2026

Summary

July's digest was dominated by thirteen actively exploited zero-days. TA488 hit the US and Europe via a Microsoft Exchange flaw (CVE-2026-42897) deploying OWAReaper, while UNK_MassTraction exploited Roundcube's CVE-2025-49113 against university research departments. Arista patched CVE-2026-16812 in VeloCloud Orchestrator, attackers chained SonicWall SMA1000 zero-days (CVE-2026-15409, CVE-2026-15410) for root-level access, and Cavern Manticore ran stealthy espionage against Israel.

---

Monthly Highlights

Insights

• Cisco's own firewall manager had a skeleton key baked in: CVE-2026-20316 turns built-in credentials into an actively exploited zero-day.
• Just opening the email is the exploit: TA488's CVE-2026-42897 turns a glance at Outlook Web Access into the disk-free OWAReaper backdoor.
• Coinbase Cartel: 100 victims, zero encryption, all extortion.

---

Zero-Day Spotlight

Celebrity Vulnerabilities

Five vulnerabilities earned "celebrity" status in July: Bad Epoll, RoguePlanet, CitrixBleed 2, and wp2shell.

CVE-2026-46242 Bad Epoll: Linux kernel use-after-free (CWE-416), fixed in 6.18.33/7.0.10/7.1. CVE-2026-63030 & CVE-2026-60137 wp2shell: WordPress Core interpretation-conflict chained with SQL injection, an unauthenticated takeover of its ~500 million sites. Also branded: CVE-2026-50656 RoguePlanet (Defender privilege escalation, in Qilin's arsenal) and CVE-2025-5777 CitrixBleed 2 (NetScaler OOB read, used by INC ransomware).

---

Exploitation

Vulnerabilities Exploited

35 vulnerabilities were actively exploited in July, each a Zero-Day or Celebrity Vulnerability in the CISA KEV catalog.

Spotlight: CVE-2026-42897 (Exchange, CWE-79) let TA488 deploy OWAReaper from a single opened email — patch here. CVE-2025-49113 (Roundcube, CWE-502) gave UNK_MassTraction code execution against university research departments.

---

Malware & Campaigns

Attacks Executed

33 attacks spanned botnets, ransomware, backdoors, stealers, and RATs.

OWAReaper

TA488's backdoor via CVE-2026-42897, running inside the OWA reading pane to harvest and persist stolen credentials in browser localStorage.

Also tracked (table above): RustDuck, Veil#Drop, PureLog Stealer, Ousaban, JADEPUFFER, the Roundcube and Ruckus toolsets, AsyncRAT, Cavern, GigaWiper, CrashStealer, LabubaRAT, TELEPUZ, Spirals, HOLLOWGRAPH, the HelloNet chain, SmartLoader, StealC, Tengu, Qilin Ransomware, and INC Ransomware.

---

Threat Actors

Adversaries in Action

Per-actor MITRE ATT&CK mappings are available via Uni5Xposure.

---

Exposure

Targeted Products

Exploited products spanned mail/collaboration servers, IAM, operating systems, network devices, applications/databases, and security appliances — full detail is in the table above.

---

Geography

Targeted Countries

United States, Canada, Spain, Malta, and Bulgaria were most targeted, followed by United Kingdom, Slovakia, Czech Republic, and Taiwan; Guadeloupe, Panama, Guam, and Qatar were least targeted, across 193 countries worldwide. Full breakdown: Uni5Xposure.

---

Adversary Tradecraft

Top MITRE ATT&CK TTPs

223 distinct TTPs were tracked in July; the 6 most prevalent are below.

The complete ATT&CK matrix is available to Uni5 customers via Uni5Xposure.

---

Indicators

Top Indicators of Compromise (IOCs)

Curated highlights; full IOC sets are on Uni5Xposure.

---

Guidance

Recommendations

Security Teams

Prioritize the 35 vulnerabilities; block indicators tied to the 6 actors and 33 malware covered here.

Uni5 Users

Uni5 customers can act on this digest directly via the dashboard.

---

Definitions & Glossary

Appendix

KEV: CISA's catalog of publicly exploited flaws. Celebrity Vulnerabilities: high-impact flaws with catchy names. Glossary: CVE – Common Vulnerabilities and Exposures; CPE – Common Platform Enumeration; CWE – Common Weakness Enumeration.

---

Next Steps