HiveForce Labs · Weekly Threat Digest

Weekly Threat Digest: 20 to 26 July 2026

HiveForce Labs reports a sharp rise in cybersecurity threats this week, headlined by wp2shell — a zero-day flaw chain in WordPress Core combining CVE-2026-63030 and CVE-2026-60137 for unauthenticated full-site takeover — alongside a Check Point SmartConsole authentication bypass (CVE-2026-16232), the HelloNet espionage campaign abusing ViPNet's trusted update mechanism, and continued Qilin Ransomware exploitation of Palo Alto Networks PAN-OS (CVE-2026-0257).

---

Overview

Summary

HiveForce Labs has reported a sharp rise in cybersecurity threats, highlighting the growing complexity and frequency of global cyber incidents. Over the past week, nine major attacks were detected, five vulnerabilities were actively exploited and closely monitored, signaling a concerning escalation in malicious activity worldwide.

One of the biggest concerns is a flaw chain in WordPress Core, the platform behind more than 500 million websites. Dubbed wp2shell, it lets an attacker take over a site with just one web request, no login, no plugins, no user interaction required. The chain works by pairing two bugs together: a REST API mix-up introduced in WordPress 6.9 (CVE-2026-63030) and a SQL injection flaw in WP_Query's author parameter (CVE-2026-60137).

Check Point has also patched a critical issue in SmartConsole, the admin console used to manage its Security Management and Multi-Domain servers. Tracked as CVE-2026-16232, the bug is an authentication bypass that lets an attacker intercept a valid login token during the sign-in process and use it to gain full administrator access, no password needed.

Separately, researchers are tracking HelloNet, an espionage campaign active since at least May 2026 that targets Russian government and critical-infrastructure networks. The attackers abuse ViPNet's trusted software update mechanism to sideload a malicious DLL, quietly planting a multi-stage implant that blends in with legitimate update traffic. Together, these incidents underscore a growing trend of hybrid cyber operations that combine technical exploitation with social engineering, reinforcing the need for timely patching, continuous monitoring, and layered security defenses.

---

Weekly Highlights

Insights

• From dominant to more dominant, Qilin Ransomware's latest chapter adds CVE-2026-0257 to an already growing arsenal targeting Palo Alto Networks PAN-OS / Prisma Access.
• CVE-2026-16232 hit where it hurts most: the admin console managing Check Point's own Security Management and Multi-Domain Security Management (MDS) servers.
• HOLLOWGRAPH's cover is genius: legitimate Microsoft Graph API calls, calendar invites for commands, and a 2050 timestamp so no one ever looks.
• Signed, trusted, compromised: HelloNet rides ViPNet's legitimate update mechanism straight into government networks, then covers its tracks on the way out.
• 500 million WordPress sites, one flaw chain, zero authentication: wp2shell turns CVE-2026-63030 and CVE-2026-60137 into instant takeover.
• FakeGit doesn't hack GitHub's trust; it borrows it, wrapping SmartLoader inside thousands of repositories that look like the real thing.

Threat Distribution: Backdoor, Loader, Wiper, Information Stealer, Ransomware.

---

Geography

Targeted Countries

---

Adversary Tradecraft

Top MITRE ATT&CK TTPs

---

Malware & Campaigns

Attacks Executed

HOLLOWGRAPH

HOLLOWGRAPH is a Windows backdoor that communicates exclusively through third-party services rather than attacker-controlled infrastructure. It uses the Microsoft Graph API to exchange commands and exfiltrate data through a compromised Microsoft 365 calendar, while DNS tunneling is used to retrieve and refresh Microsoft Entra ID credentials.

HelloInjector

HelloInjector is the initial loader in the HelloNet chain, deployed as a malicious wtsapi32.dll sideloaded by the signed ViPNet update binary at system startup. It decrypts an embedded payload and injects it into a netsvcs svchost.exe instance using native NT APIs, giving the operators a stealthy foothold inside a trusted, signed process.

HelloProxy

HelloProxy is the main HelloNet payload, functioning as both a network proxy and an in-memory loader. It hooks network-related APIs via a legitimate hooking library and intercepts AFD IOCTLs to hinder user-mode security tools, listening on ports 5003 and 5060 behind a handshake-gated C2 to distinguish operator traffic before processing commands.

HelloExecutor

HelloExecutor is a command-execution implant used for internal reconnaissance within compromised networks. It runs discovery commands for users, groups, and network configuration, and specifically harvests ViPNet Administrator and Client export paths to map the secure-networking environment.

HelloCleaner

HelloCleaner is an anti-forensic module that scrubs ViPNet software log files to erase evidence of the operators' activity, supporting the campaign's emphasis on stealth and long-dwell persistence.

HelloBackdoor

HelloBackdoor is a Rust-based backdoor that listens on port 443 and activates only on receipt of a specific trigger string derived from an MD5 hash. Once active it supports file upload, download, and arbitrary command execution via the command shell, providing a resilient secondary access channel.

SmartLoader

SmartLoader sets up persistence and installs StealC, an information stealer that goes after credentials, active sessions, and other sensitive data. Attackers have used SmartLoader to target developers through convincing-looking GitHub projects, turning what feels like normal software discovery into malware delivery.

StealC

StealC is an information stealer that goes after credentials, active sessions, and other sensitive data, including browser passwords, cookies, browser extension data, email and remote-access credentials, screenshots, and host details. The malware chain itself is nothing new; what changes is the route that leads to it being run.

Qilin Ransomware

Qilin is a prolific Ransomware-as-a-Service operation whose affiliates use double extortion, encrypting victims' files and stealing sensitive data to threaten public release unless a ransom is paid. In a notable evolution, affiliates now run a Linux ransomware variant on Windows hosts by abusing legitimate remote-management tools like AnyDesk, ScreenConnect, and Splashtop, evading Windows-focused defenses and improving stealth in mixed-OS environments.

---

Exploitation

Vulnerabilities Exploited

CVE-2026-63030 — wp2shell (WordPress Core Interpretation Conflict)

This is one half of the wp2shell flaw chain: a REST API mix-up introduced in WordPress 6.9 that, when paired with CVE-2026-60137, allows an attacker to take over a WordPress site with a single web request, requiring no login, no plugins, and no user interaction.

CVE-2026-60137 — wp2shell (WordPress Core SQL Injection)

A SQL injection flaw in WP_Query's author parameter, the second link in the wp2shell chain. WordPress Core versions before 6.9.5 and 7.0.2 are affected across more than 500 million websites running the platform.

CVE-2026-6875 — ServiceNow AI Platform Remote Code Execution

A zero-day remote code execution vulnerability affecting ServiceNow AI Platform versions prior to Australia Patch 2, Yokohama Patch 12 Hot Fix 1b, Yokohama Patch 13, Zurich Patch 7b, Zurich Patch 9, and Brazil EA/GA releases, tracked as CVE-2026-6875 and exploited pre-authentication.

CVE-2026-16232 — Check Point SmartConsole Improper Authentication

An authentication bypass in Check Point SmartConsole, the admin console used to manage Security Management and Multi-Domain Security Management (MDS) servers, that lets an attacker intercept a valid login token during sign-in and use it to gain full administrator access without a password.

CVE-2026-0257 — Palo Alto Networks PAN-OS Authentication Bypass

An authentication bypass vulnerability in Palo Alto Networks PAN-OS / Prisma Access, actively exploited by Qilin Ransomware affiliates as part of ongoing double-extortion campaigns.

---

Threat Actors

Adversaries in Action

No threat actor activity was observed or reported during this week.

---

Guidance

Recommendations

Security Teams

This digest can be utilized as a drive to force security teams to prioritize the five exploited vulnerabilities and block the indicators related to the malware HOLLOWGRAPH, HelloInjector, HelloProxy, HelloExecutor, HelloCleaner, HelloBackdoor, SmartLoader, and StealC.

Uni5 Users

This is an actionable threat digest for HivePro Uni5 customers, who can get comprehensive insights into their threat exposure and action it effortlessly over the HivePro Uni5 dashboard.

---

Publications This Week

Threat Advisories

• wp2shell: One Request, No Login, Full Control of WordPress Core
• CVE-2026-6875: ServiceNow AI Platform Pre-Auth RCE Exploited
• HOLLOWGRAPH Hides Its C2 in Microsoft 365 Calendars
• HelloNet Campaign Targets Russian Infrastructure via ViPNet Update Abuse
• When Your AI Agent Hands You the Malware: Inside FakeGit's AgentBaiting Campaign
• July 2026 Linux Patch Roundup
• Check Point SmartConsole Authentication Bypass Exploited
• Qilin Rising: Continued Global Dominance and Expanded Tradecraft

---

Definitions & Indicators

Appendix

Known Exploited Vulnerabilities (KEV): Software vulnerabilities for which there are public exploits or proof-of-concept (PoC) code available, and for which there is a high risk of potential harm to an organization's systems or data if left unaddressed.

Celebrity Vulnerabilities: Software vulnerabilities that have gained significant attention and have been branded with catchy names and logos due to their profound and multifaceted impact. These vulnerabilities provide threat actors with opportunities to breach sensitive systems, potentially resulting in unauthorized access and the compromise of critical information.

Indicators of Compromise (IOCs)

A comprehensive list of IOCs (Indicators of Compromise) associated with the executed attacks is available on the Uni5Xposure platform.

---

Next Steps

What Next?