Weekly Threat Digest: 17 to 23 AUGUST 2026

Overview

Summary

HiveForce Labs has reported a sharp rise in cybersecurity threats, highlighting the growing complexity and frequency of global cyber incidents. Over the past week, twelve major attacks were detected, nine vulnerabilities were actively exploited, and four threat actor groups were closely monitored, signaling a concerning escalation in malicious activity worldwide.

On the vulnerability front, three critical flaws dominated the week. Apple addressed CVE-2026-65400, a serious authentication bypass in macOS Screen Sharing affecting Sonoma, Sequoia, and Tahoe, though attackers moved quickly, exploiting internet-exposed Screen Sharing ports (TCP 5900) to seize root access and deploy Monero miners even after the patch was released. Separately, MLflow, the popular open-source platform, was found vulnerable to CVE-2026-64849, a critical SSRF flaw residing in an unauthenticated webhook-testing endpoint. Meanwhile, VMware vCenter's Syslog server was exposed by CVE-2026-59310, a directory traversal bug letting unauthenticated attackers write malicious files and achieve instant root-level code execution.

Threat actor activity was equally alarming. StopAndProtect, a sprawling cybercrime operation, has compromised nearly 2,000 poorly secured WordPress sites, repurposing them as a distributed network for malware delivery, command-and-control, and stolen-data storage, luring victims through fake ClickFix CAPTCHA prompts. Meanwhile, Medusa, a ransomware-as-a-service group, continues its double-extortion campaigns, having compromised over 500 critical-infrastructure victims across healthcare, education, legal, and manufacturing sectors by August 2026.

Rounding out the week's findings, Jewelbug, a China-based hacker-for-hire group, was found running dual operations through a single control panel, XG-Web: state-sponsored espionage against government and military, alongside a parallel cryptocurrency fraud scheme. Collectively, these incidents reflect an intensifying trend toward hybrid cyber operations that blend technical exploitation with social engineering, underscoring the urgent need for prompt patching, vigilant monitoring, and layered security defenses.

---

Weekly Highlights

Insights

• Jewelbug blends state-aligned espionage with for-profit crypto fraud under one roof, running both through its XG-Web control panel.
• One open port, TCP 5900, was all it took; CVE-2026-65400 handed attackers root on Macs and a side income mining Monero.
• Cl0p-linked actors turn exposed PTC Windchill and FlexPLM into a straight line from disclosure to extortion.
• Neglect has a cost: StopAndProtect hijacks almost 2,000 unmaintained WordPress sites into a sprawling network for malware delivery and stolen data.
• Medusa's leak site went quiet, but the threat didn't. Storm-1175 simply rebranded its speed and exploit arsenal into StormEncryptor.
• No credentials, no waiting; CVE-2026-59310 hit vCenter's syslog server and, five days later, had already reached 361 IPs in 47 countries.

Threat Distribution: Backdoor, RAT, Cryptominer, Framework, Stealer, Worm, Ransomware, Banking Trojan.

---

Geography

Targeted Countries

---

Adversary Tradecraft

Top MITRE ATT&CK TTPs

---

Malware & Campaigns

Attacks Executed

A comprehensive list of IOCs (Indicators of Compromise) for the attacks executed is provided in the Appendix section at the end of the report.

---

Exploitation

Vulnerabilities Exploited

All nine CVEs are tracked in this cycle as zero-day vulnerabilities.

---

Threat Actors

Adversaries in Action

HoneyMyte (aka Mustang Panda, Bronze President, TEMP.Hex, Red Lich, Earth Preta, Camaro Dragon, PKPLUG, Stately Taurus, Twill Typhoon, Hive0154)

HoneyMyte is a China-linked espionage actor that continues to evolve its CoolClient backdoor, adding a signed kernel-mode rootkit driver for stealth alongside its long-running PlugX RAT for full remote control of infected Windows hosts.

Associated TTPs: T1569, T1569.002, T1106, T1547, T1547.001, T1053, T1053.005, T1543, T1543.003, T1548, T1548.002, T1134, T1134.004, T1574, and 15 more

Jewelbug (aka Earth Alux, REF7707, CL-STA-0049, Ink Dragon)

Jewelbug is a China-based hacker-for-hire group running dual operations through a single control panel, XG-Web: state-sponsored espionage against government, military, and telecom targets, alongside a parallel cryptocurrency-fraud scheme using the Antino backdoor and ClientKing implant.

Associated TTPs: T1583, T1584, T1587, T1608, T1189, T1566, T1078, T1204, T1059, T1176, T1556, T1547, T1112, and 40 more

Storm-1175

Storm-1175 is a financially motivated actor that exploits ConnectWise ScreenConnect, Fortinet FortiClient EMS, Fortra GoAnywhere MFT, and BeyondTrust RS/PRA to deploy Medusa ransomware, and rebranded its exploit arsenal into StormEncryptor after Medusa's leak site went quiet.

Associated TTPs: T1190, T1059, T1569, T1072, T1505, T1484, T1562, T1036, T1003, T1555, T1046, T1018, T1021, and 13 more

Lazarus (aka Labyrinth Chollima, Group 77, Hastati Group, Zinc, Hidden Cobra, Diamond Sleet, TraderTraitor, and 18 other aliases)

Lazarus, the North Korean state-sponsored actor, is associated with Medusa ransomware activity this week, continuing its pattern of blending espionage, sabotage, and financially motivated operations against global targets.

Associated TTPs: T1583, T1584, T1608, T1586, T1566, T1190, T1204, T1059, T1505, T1068, T1574, T1014, T1562, and 20 more

---

Guidance

Recommendations

Security Teams

This digest can be utilized as a drive to force security teams to prioritize the nine exploited vulnerabilities and block the indicators related to the threat actors HoneyMyte, Jewelbug, Storm-1175, and Lazarus, and malware CoolClient, PlugX, Monero, Antino, ClientKing, XG-Web, SilentDataCollector, NetworkShareScanner, SilentEncryptor, Medusa, Babuk-derived ESXi ransomware, and Grandoreiro.

Uni5 Users

This is an actionable threat digest for HivePro Uni5 customers, who can get comprehensive insights into their threat exposure and action it effortlessly over the HivePro Uni5 dashboard.

---

Publications This Week

Threat Advisories

• Cl0p-Linked Actors Exploit PTC Windchill and FlexPLM in Data Theft Campaign
• HoneyMyte Arms CoolClient with a Signed Kernel-Mode Rootkit
• macOS Screen Sharing Authentication Bypass Flaw Exploited
• One Team, Two Payrolls: Jewelbug's Parallel Operations
• MLflow SSRF Flaw (CVE-2026-64849) Hands Attackers Your Cloud Credentials
• StopAndProtect: Nearly 2,000 Hacked WordPress Sites Weaponized as Criminal Infrastructure
• Medusa Ransomware: RaaS Escalating Double-Extortion Attacks on Critical Infra
• Suspected China-Nexus APT Weaponizes CVE-2026-59310
• Grandoreiro Outlives Its Own Takedown

---

Definitions & Indicators

Appendix

Known Exploited Vulnerabilities (KEV): Software vulnerabilities for which there are public exploits or proof-of-concept (PoC) code available, and for which there is a high risk of potential harm to an organization's systems or data if left unaddressed.

Celebrity Vulnerabilities: Software vulnerabilities that have gained significant attention and have been branded with catchy names and logos due to their profound and multifaceted impact. These vulnerabilities provide threat actors with opportunities to breach sensitive systems, potentially resulting in unauthorized access and the compromise of critical information.

Indicators of Compromise (IOCs)

A comprehensive list of IOCs (Indicators of Compromise) associated with the executed attacks is available on the Uni5Xposure platform.

---

Next Steps