HiveForce Labs has reported a sharp rise in cybersecurity threats, highlighting the growing complexity and frequency of global cyber incidents. Over the past week, this weekly threat digest tracked six major attacks, five vulnerabilities actively exploited, and two threat actor groups closely monitored, signaling a concerning escalation in malicious activity worldwide. HiveForce Labs recorded 472.1K total vulnerabilities published to date, with 1,854 new vulnerabilities published during the 29 June–05 July 2026 window alone, of which five were confirmed as actively exploited.

Leading the pack is CVE-2026-45659, a high-severity flaw in Microsoft SharePoint Server that lets attackers run their own code on the server. The catch is small but nasty: an attacker only needs basic Site Member access, then a single crafted payload does the rest, no clicking or user action required. On the ransomware front, Prinz Eugen showed up in April 2026, a quiet Go-based operation likely run by one person (ROOTBOY, aka GERMANIA). It sneaks in through stolen RDP logins, hijacks the legitimate RemotePC tool to do its dirty work, steals data, locks everything with ChaCha20-Poly1305, and skips the classic ransom note entirely, choosing to negotiate off the radar.

Rounding things out is RustDuck, a botnet built for large-scale DDoS attacks that's been active since February 2026. It grabs whatever it can reach — weak Telnet and SSH passwords, exposed Android Debug Bridge, and a grab-bag of old bugs — sweeping up routers, DVRs, IP cameras, and Linux servers along the way. Alongside RustDuck, this HiveForce Labs weekly threat digest also covers TinyRCT (tied to CL-STA-1062), the fileless Veil#Drop delivery framework, PureLog Stealer, and the Ousaban banking trojan. Put together, these cases point to the same uncomfortable direction: attackers are blending technical exploits with social tricks, and the old "patch it later" habit no longer holds up. Staying ahead means patching fast, watching continuously, and layering defenses so one weak spot doesn't open the whole door.

Six attacks were executed during the 29 June to 05 July 2026 window: TinyRCT, Prinz Eugen, RustDuck, Veil#Drop, PureLog Stealer and Ousaban. Five of the six affect Microsoft Windows; RustDuck additionally sweeps up routers, DVRs, IP cameras and Linux servers. Delivery ranges from ASPX web shells and stolen RDP credentials to weak Telnet/SSH credential guessing and phishing.

TinyRCT — Backdoor

TinyRCT is a lightweight, C#-based remote access Trojan built to quietly take control of Windows systems. Once executed, it acts as a full-featured backdoor, running arbitrary commands, enumerating and exfiltrating files, capturing screenshots, and giving attackers hands-on remote management of the compromised host. What sets it apart is its evasion-first design: before doing anything else, TinyRCT checks whether it's running from %LOCALAPPDATA%, and if it isn't — say, in a sandbox or on an analyst's machine — it shuts itself down immediately. TinyRCT is delivered via ASPX web shells, is associated with the threat actor CL-STA-1062, and enables system compromise, command execution and screen capture on affected Windows platforms. No targeted CVE or patch link is recorded for TinyRCT.

Prinz Eugen — Ransomware

Prinz Eugen is a financially motivated, Go-based ransomware operation that surfaced publicly in April 2026, with its encryptor first analyzed hands-on the following month. It runs a deliberately quiet double-extortion playbook, stealing data first, encrypting second, but skips the usual ransom note entirely, instead pushing all victim communication out-of-band through direct email and a dedicated Tor leak portal. The operation carries a distinct anti-forensic footprint, prioritizing freshly modified files during encryption to maximize damage fast. Prinz Eugen is delivered via compromised RDP credentials, is associated with the threat actor ROOTBOY, and enables data encryption and data theft on affected Windows platforms. No targeted CVE or patch link is recorded for Prinz Eugen.

RustDuck — Botnet

RustDuck is a two-stage botnet, active since February 2026, whose main purpose is launching large-scale distributed denial-of-service (DDoS) attacks. It spreads opportunistically through weak Telnet and SSH passwords, exposed Android Debug Bridge interfaces, and a mix of older vulnerabilities in devices and web applications — affecting routers, DVRs, IP cameras, and Linux servers. RustDuck is delivered by guessing weak passwords on exposed Telnet and SSH services and by exploiting known vulnerabilities, targeting CVE-2025-29635, CVE-2017-17215, CVE-2018-8007 and CVE-2024-1781. Affected platforms include Huawei HG532, D-Link DIR-823X, Totolink X6000R, Apache CouchDB, TP-Link, ZTE, Ruijie, TVT, ThinkPHP, Jenkins and Hadoop YARN devices, and RustDuck enables service disruption, network downtime and device hijacking.

Veil#Drop — Framework

Veil#Drop is a multi-stage delivery framework that chains social engineering, compromised websites, and malicious JavaScript launchers into PowerShell download cradles, then abuses trusted cloud-hosted infrastructure to run PureLog Stealer entirely in memory, never touching disk. Delivered via phishing, Veil#Drop enables command execution and the loading of additional payloads on affected Windows platforms. No associated actor, targeted CVE, or patch link is recorded for Veil#Drop.

PureLog Stealer — Infostealer

PureLog Stealer is a .NET-based information stealer that harvests browser credentials, cookies, autofill data, and browsing history, alongside cryptocurrency wallet information and system reconnaissance data. Delivered via phishing (and dropped fileless via Veil#Drop), PureLog Stealer enables data theft on affected Windows platforms. No associated actor, targeted CVE, or patch link is recorded for PureLog Stealer.

Ousaban — Banking Trojan

The Ousaban banking trojan campaign has been observed targeting Windows users in Spain and Portugal. Its trick is patience: a fake "corrupted" PDF, one click on "Update," and it waits silently until the victim logs into their bank. The malware monitors banking sessions, captures screenshots and keystrokes, manipulates clipboard content, displays fraudulent dialogs, and grants attackers remote control of infected systems. Delivered via phishing, Ousaban enables credential theft, financial fraud and session hijacking on affected Windows platforms. No associated actor, targeted CVE, or patch link is recorded for Ousaban.

Five vulnerabilities were exploited in the wild during the reporting window, four of them chained together by the RustDuck botnet and the fifth, CVE-2026-45659, exploited independently against Microsoft SharePoint Server. All five are tracked as zero-day issues by HiveForce Labs.

CVE-2025-29635 — D-Link DIR-823X Command Injection Vulnerability

This zero-day flaw affects D-Link DIR-823X firmware versions 240126 and 240802. Classified under CWE-77, it is exploited by RustDuck via the T1059 Command and Scripting Interpreter technique. The affected device is end-of-life (EOL), with no vendor patch available.

CVE-2017-17215 — Huawei HG532 Remote Code Execution Vulnerability

This zero-day flaw affects the Huawei HG532 router. Classified under CWE-20, it is exploited by RustDuck via the T1059 Command and Scripting Interpreter technique. The affected device is end-of-life (EOL), with no vendor patch available.

CVE-2018-8007 — Apache CouchDB Privilege Escalation Vulnerability

This zero-day flaw affects Apache CouchDB, all versions up to and including 1.7.1. Classified under CWE-20, it is exploited by RustDuck via T1190 Exploit Public-Facing Application, T1078 Valid Accounts and T1068 Exploitation for Privilege Escalation.

CVE-2024-1781 — Totolink Command Injection Vulnerability

This zero-day flaw affects the Totolink X6000R AX3000, firmware version 9.4.0cu.852_20230719. Classified under CWE-77, it is exploited by RustDuck via T1595 Active Scanning and T1059 Command and Scripting Interpreter.

CVE-2026-45659 — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

This zero-day flaw affects Microsoft SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Enterprise Server 2016. Classified under CWE-502, it allows an attacker with only basic Site Member access to achieve remote code execution via a single crafted payload, without any user interaction. It is exploited via T1190 Exploit Public-Facing Application and T1059 Command and Scripting Interpreter. No associated actor or attack is recorded for CVE-2026-45659 in this digest.

Two threat actors were tracked this week: CL-STA-1062 and ROOTBOY. CL-STA-1062, originating from China, is motivated by espionage and information theft, mixing old open-source tools with the new custom backdoor TinyRCT to quietly work its way into state-owned energy and government networks across Southeast Asia. It targets Government, Critical Energy Infrastructure and State-Owned Enterprises, is associated with TinyRCT, and affects Windows platforms.

ROOTBOY (also known by the aliases avtokz and GERMANIA) is financially motivated and runs the solo Prinz Eugen ransomware operation — sneaking in via stolen RDP credentials, hijacking RemotePC for staging, then stealing and encrypting data quietly. ROOTBOY targets Financial Services, Professional Services, Education and Automotive organizations across South Africa, France, the United States and the United Kingdom, is associated with Prinz Eugen Ransomware, and affects Windows platforms.

The countries most targeted by this week's attacks include the Philippines, Spain, Singapore, Brunei, the United Kingdom, Cambodia, Portugal, France, South Africa, Indonesia, Thailand, Laos, the United States of America, Malaysia, Vietnam and Australia, among others. The least-targeted countries recorded include Denmark, Saint Kitts and Nevis, Djibouti, San Marino, Dominica, Serbia, the Dominican Republic, Slovakia, Ecuador, Azerbaijan and Egypt, among others.

The following indicators of compromise are associated with the attacks executed during the 29 June to 05 July 2026 window. A comprehensive list of IOCs associated with the executed attacks is available on the Uni5Xposure platform.

The top MITRE ATT&CK TTPs observed across this week's six attacks span execution, defense evasion, discovery, exfiltration, and command-and-control techniques. The following are the leading techniques reported in this HiveForce Labs weekly threat digest.