Weekly Threat Digest: 10 to 16 August 2026

Overview

Summary

HiveForce Labs has reported a sharp rise in cybersecurity threats, highlighting the growing complexity and frequency of global cyber incidents. Over the past week, 12 major attacks were detected, 9 vulnerabilities were actively exploited, and 4 threat actor groups were closely monitored, signaling a concerning escalation in malicious activity worldwide.

Head Mare is punching through unpatched TrueConf servers, chaining two flaws for SYSTEM-level code execution. From there, it plants a web shell, swaps the real TrueConf installer for a trojanized one carrying the PhantomCore backdoor, and adds a second implant, PhantomGraph, that hides its command-and-control traffic inside Microsoft OneDrive.

Payroll Pirates is a money-driven phishing crew hijacking Microsoft 365 accounts to quietly mine finance and payroll mailboxes. Fake voicemail alerts route victims through trusted Google and Amazon services to an adversary-in-the-middle page that proxies the real Microsoft login and steals the session, MFA and all.

Lazarus has revived Operation Dream Job, dangling fake recruiter offers at defense and aerospace staff to deliver weaponized PDFs or a trojanized PDF viewer. Together, these incidents underscore a growing trend of hybrid cyber operations that combine technical exploitation with social engineering, reinforcing the need for timely patching, continuous monitoring, and layered security defenses.

---

Weekly Highlights

Insights

• CVE-2026-64638 (XSS2Shell): a pre-auth cross-site scripting flaw hits the WordPress Core login screen.
• 421 fixes, 39 ticking clocks: the August 2026 Patch Tuesday cycle.
• DeadLock ransomware exploits a vulnerable Baidu antivirus driver (CVE-2024-51324) to disable EDR from the kernel.
• Gunra ransomware escalates double extortion, weaponizing CVE-2024-55591 and CVE-2025-24472 for entry.
• Lazarus revives Operation Dream Job, exploiting a Windows zero-day, CVE-2026-68820.
• Cloned telecom and NIC portals push PATCHCORD while staging servers hold regreSSHion (CVE-2024-6387) exploit tooling.

Threat Distribution: Backdoor, Ransomware, Rootkit, Downloader, Webshell, Framework.

---

Geography

Targeted Countries

---

Adversary Tradecraft

Top MITRE ATT&CK TTPs

---

Malware & Campaigns

Attacks Executed

A comprehensive list of IOCs (Indicators of Compromise) for the attacks executed is provided in the Appendix section at the end of the report.

---

Exploitation

Vulnerabilities Exploited

All nine CVEs are tracked in this cycle as zero-day vulnerabilities; no CISA KEV listing was recorded for these entries at time of publication. XSS2Shell and regreSSHion are the celebrity-named vulnerabilities in this cycle.

---

Threat Actors

Adversaries in Action

Head Mare

Head Mare is a hacktivist group active since 2023 that consistently targets Russia. This week, Head Mare exploited unpatched TrueConf video conferencing servers to deploy the PhantomCore and PhantomGraph backdoors, the latter of which abuses a Microsoft OneDrive account as its command-and-control channel.

Associated TTPs: T1190, T1199, T1566, T1059, T1059.001, T1059.003, T1505, T1505.003, T1543, T1543.003, T1546, T1546.015, T1068, T1027, T1036, and 8 more

Payroll Pirates (aka Storm-2755)

Payroll Pirates, also tracked as Storm-2755, is a financially motivated phishing crew hijacking Microsoft 365 accounts to quietly mine finance and payroll mailboxes. Fake voicemail alerts route victims through trusted Google and Amazon services to an adversary-in-the-middle page that proxies the real Microsoft login and steals the session, MFA and all.

Associated TTPs: T1583, T1583.001, T1566, T1566.002, T1557, T1111, T1539, T1550, T1550.004, T1036, T1036.005, T1684, T1684.001, T1090, T1090.002, and 4 more

Lazarus (aka Labyrinth Chollima, Hidden Cobra, Zinc, Diamond Sleet, TraderTraitor, and 24 other aliases)

Lazarus has revived Operation Dream Job, dangling fake recruiter offers at defense and aerospace staff to deliver weaponized PDFs or a trojanized PDF viewer, exploiting CVE-2026-68820 and CVE-2025-49113 to deploy Troy, FudModule, RelayShell, MISTPEN, and ForestTiger.

Associated TTPs: T1583, T1583.001, T1584, T1584.004, T1608, T1608.001, T1608.006, T1586, T1586.002, T1566, T1566.003, T1566.001, T1190, T1204, T1204.002, and 30 more

APT36 (aka Transparent Tribe, ProjectM, Mythic Leopard, Storm-0156, and 6 other aliases)

APT36, also known as Transparent Tribe, cloned Afghan Telecom and India's National Informatics Centre portals to push the PATCHCORD backdoor, while staging servers held regreSSHion (CVE-2024-6387) exploit tooling for a parallel push into internet-facing telecom and government infrastructure.

Associated TTPs: T1583, T1583.001, T1583.006, T1566, T1566.001, T1566.002, T1190, T1204, T1204.002, T1059, T1059.003, T1059.001, T1059.005, T1620, T1547, and 19 more

---

Guidance

Recommendations

Security Teams

This digest can be utilized as a drive to force security teams to prioritize the nine exploited vulnerabilities and block the indicators related to the threat actors Head Mare, Payroll Pirates, Lazarus, and APT36, and malware PhantomCore, PhantomGraph, Troy, FudModule, RelayShell, MISTPEN, ForestTiger, DeadLock, Gunra, PATCHCORD, SHEETCORD, and HACKERAI C2 Agent.

Uni5 Users

This is an actionable threat digest for HivePro Uni5 customers, who can get comprehensive insights into their threat exposure and action it effortlessly over the HivePro Uni5 dashboard.

---

Publications This Week

Threat Advisories

• CVE-2026-64638 (XSS2Shell): Pre-Auth XSS in the WordPress Login Screen
• Head Mare Chains TrueConf Server Flaws to Drop PhantomCore and PhantomGraph
• Payroll Pirates Abuse AiTM Phishing to Compromise Microsoft 365
• Microsoft Patch Tuesday August 2026 - Priority Fixes
• Operation Dream Job: Lazarus Exploits a Windows Zero-Day to Deploy Backdoor
• DeadLock Ransomware Anchors Extortion to the Polygon Blockchain
• Gunra Ransomware Evolves into Full RaaS Operation Targeting Global Critical Infrastructure
• PATCHCORD Cluster Targets South Asian Infrastructure

---

Definitions & Indicators

Appendix

Known Exploited Vulnerabilities (KEV): Software vulnerabilities for which there are public exploits or proof-of-concept (PoC) code available, and for which there is a high risk of potential harm to an organization's systems or data if left unaddressed.

Celebrity Vulnerabilities: Software vulnerabilities that have gained significant attention and have been branded with catchy names and logos due to their profound and multifaceted impact. These vulnerabilities provide threat actors with opportunities to breach sensitive systems, potentially resulting in unauthorized access and the compromise of critical information.

Indicators of Compromise (IOCs)

A comprehensive list of IOCs (Indicators of Compromise) associated with the executed attacks is available on the Uni5Xposure platform.

---

Next Steps