HiveForce Labs has reported a sharp rise in cybersecurity threats this week, tracking six major attacks and ten actively exploited vulnerabilities amid a concerning escalation in malicious activity worldwide.

SonicWall warned of two actively exploited zero-days in its SMA1000 remote access appliances, where a critical server-side request forgery flaw, CVE-2026-15409 (CVSS 10.0), chains with a code injection bug, CVE-2026-15410, to hand unauthenticated attackers full root control of the device. Meanwhile, CVE-2026-56291, a critical unauthenticated file upload flaw in the Balbooa Forms Joomla extension, was exploited as a zero-day in the wild, allowing anonymous attackers to achieve remote code execution in a single request (Section 07).

Elsewhere, the modular malware-for-hire TELEPUZ spread through ClickFix clipboard-hijacking lures delivered via a Vidar-based infection chain, and CrashStealer, a macOS information stealer, abused a signed, Apple-notarized dropper to slip past Gatekeeper and harvest keychain secrets, browser credentials, and cryptocurrency wallets. INC Ransomware has matured into one of 2026's most active operations, claiming more than 800 victims since 2023 by exploiting unpatched edge appliances, while the newly documented Spirals ransomware went from an ASP.NET web shell foothold to network-wide encryption in under 24 hours (Section 06). Together, these incidents underscore a growing trend of rapid zero-day weaponization paired with deceptive social engineering, reinforcing the need for timely patching, continuous monitoring, and layered security defenses.

Six attacks, ten exploited vulnerabilities and zero adversaries in action from the 13–19 July 2026 window, for quick reference.

Six storylines stand out this week, spanning a maximum-severity SonicWall zero-day chain, a destructive backdoor, and rapid ransomware deployment.

CVE-2026-15409: A CVSS 10.0 SSRF Chained to Root on SonicWall SMA1000

A CVSS 10.0 server-side request forgery flaw in SonicWall SMA1000 chains with a code injection flaw, CVE-2026-15410, giving unauthenticated attackers root (full profile in Sections 06 and 07).

GigaWiper: Three Malware Families Stitched Into One Destructive Implant

GigaWiper stitches three older malware families into one Go-based implant, flipping from silent surveillance to disk wiping and fake ransomware on command (Section 06).

CrashStealer Slips Past Gatekeeper to Drain Keychains and Crypto Wallets

CrashStealer slips past Gatekeeper via a signed, Apple-notarized dropper, then fakes a password prompt to drain the keychain, 80+ crypto wallets, and 14 password managers (Section 06).

Microsoft's July Patch Tuesday: Largest Release Ever

Microsoft's July Patch Tuesday was its largest release ever: 622 fixes, 63 Critical, with SharePoint and DHCP zero-days already under active attack.

LabubaRAT: A Reusable NVIDIA-Themed Remote Access Framework

LabubaRAT poses as NVIDIA software and takes C2 config at startup instead of hardcoding it, one reusable binary built for Malware-as-a-Service (Section 06).

Spirals: Web Shell to Network-Wide Encryption in Under 24 Hours

Spirals went from web shell to network-wide encryption in under 24 hours, killing 23 backup and database services before the Rust payload fired (Section 06).

Threat Distribution

This week's six attacks span the following threat categories: Backdoor, Infostealer, RAT, Modular malware, and Ransomware.

Countries targeted this week, most to least, are listed below.

Industries reported as targeted this week span: Legal, Manufacturing, Business Services, Healthcare, Financial, Charitable Orgs, Retail, Government, Transportation, Education, Energy, Defense, Aerospace, Hospitality, Telecommunications, Media, Insurance, Technology, Real Estate, Religion, Associations, Aviation, Food Services, Agriculture, and Pharmaceutical.

The top TTPs observed this week span execution, command-and-control, defense evasion, discovery, persistence, and exfiltration.

Six attacks were executed this window (Section 02 has the full list) via destructive backdoors, information stealers, remote access frameworks, ClickFix social engineering, and edge-appliance exploitation; IOCs are in the Appendix.

GigaWiper — Backdoor

GigaWiper is a versatile implant that pairs strong command-and-control (C2) features with several destructive payloads, including disk wiping, fake ransomware, and system-level sabotage. It is an amalgamation of at least three standalone malware families stitched together as commands inside a single implant, plus new backdoor functionality on top. That backdoor lets attackers keep control of infected systems, run commands, deploy more tooling, and trigger any of its destructive options on demand, giving operators the flexibility to switch between quiet espionage and full-on wiping whenever they choose. GigaWiper targets Microsoft Windows and enables system compromise and command execution. No delivery method, CVE, or associated actor is recorded for GigaWiper.

CrashStealer — Infostealer

CrashStealer is a C++ macOS infostealer that disguises itself as Apple's crash-reporting framework to steal browser credentials, cryptocurrency wallets, and keychain data. Before sending anything out, CrashStealer encrypts the stolen files with AES-GCM, then exfiltrates them to a remote command-and-control server. CrashStealer targets macOS and enables data theft. No delivery method, CVE, or associated actor is recorded for CrashStealer.

LabubaRAT — RAT

LabubaRAT is a new remote access tool that poses as NVIDIA software to infect Windows computers. Rather than hardcoding its control server, LabubaRAT accepts configuration at startup, letting attackers reuse the same malware across targets. Once installed, it profiles the host to identify security tools and browsers before awaiting operator commands, indicating a reusable framework built for Malware-as-a-Service deployments. LabubaRAT targets Microsoft Windows and enables credential theft, data exfiltration, and persistent access. No delivery method, CVE, or associated actor is recorded for LabubaRAT.

TELEPUZ — Modular Malware

TELEPUZ is a modular malware that first surfaced through CLICKFIX-VIDAR attacks in April. Written in C, likely by hand, TELEPUZ is lightweight, modular, and reasonably well built, with sparse memory allocations, little middleware, and some features still under development — traits suggesting the project is run by a solo developer or a very small team who code for a living. To slow down reverse engineers, TELEPUZ interleaves its real code with "garbage instructions" that serve no functional purpose; some are even designed to produce side effects, like updating global variables or calling Windows APIs, so the compiler or disassembler won't strip them out as dead code. TELEPUZ is delivered via ClickFix, targets Chromium-based browsers (e.g., Chrome) and Mozilla Firefox, and enables system compromise and persistence. No CVE or associated actor is recorded for TELEPUZ.

INC Ransomware — Ransomware

INC is a Rust-based ransomware-as-a-service operation (aka GOLD IONIC) that has claimed 800+ victims since 2023 and ranks among 2026's most active groups, hitting legal, manufacturing, healthcare, technology, and construction targets predominantly in the US. Operators gain entry via unpatched edge appliances — notably CVE-2023-3519 and CVE-2023-48788 — or broker-supplied credentials, then use living-off-the-land binaries and a modified Veeam credential dumper to move laterally across Windows, Linux, and ESXi. Data is exfiltrated to attacker cloud storage before double-extortion encryption, with aggressive defense impairment via driver-dropping process killers and shadow-copy deletion. Pressure is applied through a Tor negotiation portal, a public leak site, wallpaper defacement, and ransom notes printed to networked printers. INC Ransomware is delivered by exploiting vulnerabilities, targets Citrix NetScaler ADC and NetScaler Gateway, Fortinet FortiClient EMS, and SimpleHelp Remote Support Software, and enables file encryption, data exfiltration, and double extortion.

Spirals — Ransomware

Spirals is a Rust-based ransomware family used in a double-extortion attack in June 2026. Attackers gained initial access via an ASP.NET web shell on an internet-facing IIS server and deployed the payload network-wide in under 24 hours, using PsExec to push it as bitsadmin.exe to impersonate a legitimate Windows utility. Files are encrypted with per-file AES-128 keys wrapped by an attacker-controlled ECDH P-256 public key, with intermittent encryption across jittered chunks applied to files over 5 MB for speed. Spirals targets Windows and enables file encryption, data exfiltration, and double extortion. No delivery method, CVE, or associated actor is recorded for Spirals.

Ten vulnerabilities were exploited in the wild during the 13–19 July 2026 reporting window, all tracked as zero-day issues by HiveForce Labs. CVE-2026-56291 (Balbooa Forms), CVE-2026-56164 (Microsoft SharePoint), CVE-2026-56155 (Microsoft Active Directory Federation Services), CVE-2026-50661 (Windows BitLocker), CVE-2026-15409 and CVE-2026-15410 (SonicWall SMA1000) affect no currently recorded attack or ransomware in this digest but carry critical severity, while CVE-2023-3519, CVE-2023-48788, CVE-2024-57727, and CVE-2025-5777 chain into the INC Ransomware attack detailed in Section 06.

No threat actor activity was observed or reported during this week.

Known Exploited Vulnerabilities (KEV) Software vulnerabilities for which there are public exploits or proof-of-concept (PoC) code available, and for which there is a high risk of potential harm to an organization's systems or data if left unaddressed. Celebrity Vulnerabilities Software vulnerabilities that have gained significant attention and have been branded with catchy names and logos due to their profound and multifaceted impact. These vulnerabilities provide threat actors with opportunities to breach sensitive systems, potentially resulting in unauthorized access and the compromise of critical information.

Indicators of Compromise (IOCs)

IOCs for the six attacks executed during the 13 to 19 July 2026 window are listed below; a comprehensive list is available on the Uni5Xposure platform.