HiveForce Labs has reported a sharp rise in cybersecurity threats this week, tracking thirteen major attacks, eleven actively exploited vulnerabilities, and five threat actor groups amid escalating malicious activity worldwide.

Adobe ColdFusion has a critical path traversal flaw, CVE-2026-48282: on servers with file uploads enabled, an unauthenticated attacker can smuggle a malicious file onto the system and execute arbitrary code with the highest privileges. UNK_MassTraction, a suspected China-aligned espionage cluster, weaponizes two known-but-unpatched Roundcube vulnerabilities to drop its espionage toolset (Sections 06 and 08).

Elsewhere, JADEPUFFER surfaced as a fully agentic ransomware operation; UAT-7810 expanded its Ruckus-wireless-router malware family; and Cavern Manticore, a newly identified Iran-linked group tied to Iran's Ministry of Intelligence and Security (MOIS), began targeting Israeli IT, government and defense organizations amid the ongoing U.S.-Israel military operation against Iran (Sections 06 and 08). Together, these incidents reflect a growing trend of hybrid operations blending technical exploitation with social engineering — reinforcing the need for timely patching, monitoring, and layered defenses.

Thirteen attacks, eleven exploited vulnerabilities and five adversaries in action from the 06–12 July 2026 window, for quick reference.

Six storylines stand out this week, spanning autonomous ransomware, kernel-level privilege escalation, and nation-state espionage.

The Ransom You Can't Pay: JADEPUFFER's One-Way Wipe

JADEPUFFER is an agentic ransomware operation run end-to-end by a large language model — the first observed case of a fully autonomous attack chain (full profile in Section 06).

Bad Epoll (CVE-2026-46242): The Linux Root Bug Sitting in Every Modern Kernel

A use-after-free in the Linux kernel's eventpoll subsystem enables local privilege escalation across a wide band of stable kernel releases, patched in 6.18.33, 7.0.10 and 7.1.

UNK_MassTraction: China-Aligned Espionage Exploiting Two Roundcube Flaws

This suspected China-aligned cluster weaponizes two known-but-unpatched Roundcube flaws to deliver its espionage toolset (Sections 06, 08).

Coinbase Cartel: 100 Victims, Zero Encryption, All Extortion

Coinbase Cartel (aka shinysp1d3r) runs a financially motivated, encryption-free data-extortion operation (Section 08).

RoguePlanet (CVE-2026-50656): Race Condition LPE in the Microsoft Defender Scanning Engine

A race-condition privilege-escalation flaw in the Microsoft Defender Malware Protection Engine (before 1.1.26060.3008) opens a direct path to SYSTEM-level access.

UAT-7810: China-Nexus ORB Operator Weaponizing Ruckus n-Days

UAT-7810 continues to expand its Ruckus-router malware family, building an operational relay box (ORB) network from compromised devices (Sections 06, 08).

Threat Distribution

This week's thirteen attacks span the following threat categories: Backdoor, Ransomware, Stealer, RAT, Loader, Linux binary, Webshell, and Modular Framework.

Countries targeted this week, most to least, are listed below.

The top TTPs observed this week span execution, command-and-control, defense evasion, discovery and exfiltration.

Thirteen attacks were executed this window (Section 02 has the full list) via internet-facing exploits, phishing, social engineering and supply-chain compromise; IOCs are in the Appendix.

JADEPUFFER — Ransomware

JADEPUFFER is an agentic ransomware operation run end-to-end by a large language model via an internet-facing Langflow instance, classified as an agentic threat actor (ATA) — an attacker whose capability comes from an AI agent, not a human toolkit. Its payloads self-narrate their reasoning, target prioritization and annotations human operators rarely write. Delivered via CVE-2025-3248 and CVE-2021-29441; also targets MySQL and MinIO; enables data encryption, exfiltration and financial loss.

VShell, IceCube, SquareShell and SNOWLIGHT are all delivered via CVE-2024-42009 and CVE-2025-49113 against Roundcube Webmail (UNK_MassTraction).

VShell — Backdoor

VShell is a cross-platform, fileless Go backdoor favored by China-aligned attackers and hard to detect. It gives an interactive reverse shell, port-forwarding, and file theft across Linux, Windows and macOS — shell and port-forwarding being most used to burrow deeper into networks.

IceCube — Stealer

IceCube is a JavaScript credential stealer used for targeted cyber-espionage, injected via XSS flaws in webmail platforms like Roundcube. Once running in the browser it harvests login credentials, session cookies, and 2FA tokens.

SquareShell — Webshell

SquareShell is a webshell offering remote code execution on the server. It hides by copying a legitimate plugin's last-modified timestamp to blend in, and runs commands through several system utilities.

SNOWLIGHT — Loader

A lightweight Linux loader that stages and deploys additional payloads, commonly executing follow-on implants such as VShell and persisting via system services or cron jobs.

SHORTLEASH, LONGLEASH, DOGLEASH, LEASHTEST and JARLEASH are all delivered via CVE-2020-22653, CVE-2020-22658 and CVE-2023-25717 against Ruckus wireless routers (UAT-7810).

SHORTLEASH — Backdoor

SHORTLEASH is a backdoor that calls home to its C2 server, stands up its own web server, manages tunnels, and acts as both C2 server and client. LONGLEASH builds on it with extra capabilities, a sign UAT-7810 is actively developing the tool.

LONGLEASH — Backdoor

LONGLEASH is a newer build of SHORTLEASH on the same codebase — both share the internal name "ff-agent." Its MIPS build uses the asynchronous Boost.Asio library to cut blocking and boost throughput, and can act as an intermediate C2 server, relaying commands and data between the original C2 and its peers.

DOGLEASH — Backdoor

DOGLEASH is a backdoor that runs arbitrary shellcode on a compromised Linux device. It binds and listens on a hardcoded local port, decodes incoming TCP data with a hardcoded password, and spins up a new thread to execute the incoming command code and data.

LEASHTEST — Linux Binary

LEASHTEST is a Linux (ELF) binary that tests basic functionality on MIPS embedded devices — not malicious itself, but a strong sign of compromise if found. Internally named "iot-test," it checks it can create and join a thread, bind and listen on a port to open a TCP acceptor, spawn a child process, set an async timer, print "Hello World!", and test exception handling.

JARLEASH — Backdoor

JARLEASH is a JAR-based backdoor UAT-7810 drops on both its own infrastructure and compromised Java-enabled systems for easy access. Its startup script kills any running instance, then spins up a fresh one in the Java container. It can also host a web file-management interface, FTP/SFTP servers, and a netcat server on a given IP and port.

Qilin — Ransomware

Qilin is a prolific Ransomware-as-a-Service operation whose affiliates use double extortion — encrypting files and stealing data to threaten public release unless paid. Affiliates now also run a Linux ransomware variant on Windows hosts via legitimate remote-management tools like AnyDesk, ScreenConnect and Splashtop, evading Windows-focused defenses. Delivered via social engineering; enables system compromise, data encryption and financial loss. No CVE or actor recorded.

AsyncRAT — RAT

AsyncRAT is an open-source Windows RAT ranked 6th in global prevalence in 2024, capable of keylogging, screenshot capture, credential theft and ransomware deployment. Delivered via social engineering; enables information theft and financial loss. No CVE or actor recorded.

Cavern — Modular Framework

Cavern is a modular .NET C2 framework (agent plus modules) evolved from an earlier toolset internally named "Cav3rn." An older mhm.dll variant retains legacy Cav3rn artifacts: extensions .CvnC.png, .CvnA.png and .CvnR.png for command, API and result files, config filename Cvn.cfg, page name cac.aspx, and embedded JPEG header magic bytes. Delivered via supply chain compromise; targets Windows; associated with Cavern Manticore.

Eleven vulnerabilities were exploited in the wild during the 06–12 July 2026 reporting window, all tracked as zero-day issues by HiveForce Labs. CVE-2026-48282 in Adobe ColdFusion and CVE-2026-46242 ("Bad Epoll") in the Linux kernel affect no currently recorded attack or ransomware in this digest but carry critical severity; the remaining nine chain into the JADEPUFFER, UNK_MassTraction and UAT-7810 attack families detailed in Section 06.

Five threat actors were tracked this week (Section 02 has the full list; targeting, CVE and product detail is in the table below).

UNK_MassTraction

A suspected China-aligned cluster weaponizing unpatched Roundcube flaws to deliver a credential- and data-theft toolset.

UAT-7810

A China-nexus operator building an ORB network from compromised Ruckus routers by chaining n-day flaws to deploy its own malware family.

APT41 (aliases in table below)

A China-nexus actor motivated by financial crime, information theft and espionage. No CVE, attack, or affected product is recorded for APT41.

Cavern Manticore

A newly identified Iran-linked group aligned with Iran's MOIS, motivated by espionage. Its 2026 campaign aligns closely with the ongoing U.S.-Israel military operation against Iran.

Coinbase Cartel (aka shinysp1d3r)

A financially motivated group running an encryption-free data-extortion operation spanning dozens of industries and more than thirty countries.

Known Exploited Vulnerabilities (KEV)

Software vulnerabilities with public exploits or proof-of-concept (PoC) code available, posing a high risk of harm to an organization's systems or data if left unaddressed.

Celebrity Vulnerabilities

Software vulnerabilities that have gained significant attention and been branded with catchy names and logos due to their profound impact, giving threat actors opportunities to breach sensitive systems and compromise critical information.

Indicators of Compromise (IOCs)

IOCs for the thirteen attacks executed during the 06 to 12 July 2026 window are listed below; a comprehensive list is available on the Uni5Xposure platform.