Cyber Threat Brief — July 20 2026
⚠️ This report is AI-generated. Always validate findings.
1. NGINX Regex Map Heap Overflow — CVE-2026-42533
TL;DR: Critical heap buffer overflow in nginx’s regex map module enables pre-auth DoS and RCE via crafted HTTP requests. ASLR bypass primitive included. Patch to 1.30.4/1.31.3 immediately.
What’s New:
- F5/ZDI disclosed July 15 (ZDI-26-444); affects nginx 0.9.6 through 1.30.3 (stable) and 1.31.2 (mainline)
- Triggers when a regex-based
mapdirective output variable is referenced in a string expression after a capture from an earlier regex match - Attacker controls both overflow content and length; companion information leak defeats ASLR — chaining both enables reliable pre-auth RCE
- Fixed in nginx 1.30.4 (stable), 1.31.3 (mainline), NGINX Plus 37.0.3.1
- Not on CISA KEV; no public exploit code yet but exploitation path is well-documented
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
map ~regex with capture reuse in string expr | Vulnerable config pattern | T1190 | nginx.conf | Audit configs for regex map + capture chain |
| nginx error logs: worker crash/restart | Exploitation indicator | T1190 | nginx error.log | Alert on repeated worker process crashes |
| CVSS 9.2 (v4.0) / 8.1 (v3.1) | Severity | — | — | Prioritize patching internet-facing nginx |
| nginx < 1.30.4 / < 1.31.3 | Vulnerable version | T1190 | Asset inventory | Upgrade all instances |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No rule for nginx worker crash patterns or regex map exploitation |
| Elastic | None | No specific nginx heap overflow detection |
| Sigma | None | Need rule for nginx worker process repeated crash/restart (error.log or syslog) |
Sources: The Hacker News, ZDI-26-444, nginx advisory
2. UTA0533 Exploited SonicWall SMA1000 Zero-Days Pre-Disclosure — CVE-2026-15409 / CVE-2026-15410
TL;DR: Volexity attributes SonicWall SMA1000 zero-day exploitation to new threat actor UTA0533, active since June 22 — three weeks before public disclosure. Root-level access enabled credential theft and traffic interception.
What’s New:
- Volexity published July 19: UTA0533 chained CVE-2026-15409 (CVSS 10.0 SSRF) and CVE-2026-15410 (CVSS 7.2 post-auth command injection) as zero-days since June 22
- Exploitation predated SonicWall’s public advisory and CISA KEV addition (July 14) by 3 weeks
- Root access used for: cached/stored credential extraction, network traffic capture, credential interception
- CISA KEV federal deadline was July 17 — now passed
- IOCs from prior coverage still valid:
/__api__/loginand/__api__/logoutin extraweb_access.log,/wsproxywith suspicious host params
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| UTA0533 | Threat actor | — | — | New tracking designation; correlate with SMA1000 IOCs |
/__api__/login, /__api__/logout | Exploitation URI | T1190 | extraweb_access.log | Hunt for entries from June 22 onward |
/wsproxy with suspicious host param | SSRF exploitation | T1190 | SMA1000 access logs | Block/alert on anomalous proxy requests |
/var/lib/unit/conf.json backdoor routes | Persistence | T1505.003 | File integrity | Check for unauthorized route additions |
| hotfix removal path traversal | Anti-forensics | T1070 | ctrl-service.log | Hunt for hotfix removal entries |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No SMA1000-specific detection; need access log parser for /__api__ abuse |
| Elastic | None | No SonicWall SMA detection content |
| Sigma | None | Need rule for SMA1000 log patterns (SSRF via /__api__ endpoints) |
Sources: The Hacker News, Volexity, Rapid7
3. Sandworm/UAC-0145 ClickFix Campaign Targets Ukraine — GHETTOVIBE / SCOUTCURL
TL;DR: Sandworm sub-cluster UAC-0145 deploys ClickFix fake CAPTCHAs on 10+ compromised sites to deliver GHETTOVIBE VBS persistence and SCOUTCURL recon against Ukrainian targets. Also steals Signal/WhatsApp data and distributes trojanized Android APKs.
What’s New:
- CERT-UA disclosure; coverage July 19; campaign active June–July 2026
- Fake CAPTCHA on compromised websites instructs victims to execute PowerShell via Run dialog — classic ClickFix technique
- GHETTOVIBE: VBS file placed in Startup autorun directory for persistence
- SCOUTCURL: PowerShell recon script harvesting machine details
- Signal/WhatsApp message data exfiltrated via RSYNC
- Infrastructure: Cloaking.House traffic filtering + custom SMARTAXE tool + EtherHiding (Ethereum smart contract for domain resolution)
- Additional vector: trojanized Android APKs distributed via messaging apps disguised as security tools
- 10+ compromised websites used as ClickFix delivery platforms
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
GHETTOVIBE VBS in shell:startup | Persistence | T1547.001 | EDR / Sysmon EID 11 | Alert on VBS file creation in Startup dirs |
| SCOUTCURL PowerShell script | Recon | T1059.001 | PowerShell ScriptBlock (EID 4104) | Hunt for encoded PowerShell recon patterns |
| RSYNC data exfiltration | Exfil | T1048 | Proxy / netflow | Alert on RSYNC to external destinations |
| Cloaking.House domain | Infrastructure | T1583.001 | DNS / proxy | Block/monitor Cloaking.House DNS queries |
| EtherHiding (Ethereum smart contract C2) | C2 resolution | T1102.002 | DNS / proxy | Alert on Ethereum RPC API calls from endpoints |
| Trojanized APKs via Signal/Telegram | Mobile delivery | T1204.002 | MDM / mobile security | Block sideloaded APKs from messaging apps |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Windows VBS File Written To Startup Folder (generic) | No GHETTOVIBE-specific content; no EtherHiding detection |
| Elastic | Suspicious Script Object Execution (partial) | No ClickFix-specific PowerShell pattern |
| Sigma | proc_creation_win_powershell_susp_download.yml (partial) | No rule for RSYNC exfiltration or EtherHiding smart contract C2 |
Sources: The Hacker News, CERT-UA, SOC Prime
4. ChocoPoC RAT — Trojanized GitHub PoC Repos Target Security Researchers
TL;DR: At least 7 GitHub repos hosting fake PoC exploits for hot CVEs deliver the ChocoPoC Python RAT via malicious PyPI dependency chain. Targets vulnerability researchers and SOC analysts who clone and test PoCs.
What’s New:
- Sekoia/YesWeHack disclosure July 1; BleepingComputer/THN coverage July 19
- Malware NOT in exploit code itself — hidden in PyPI dependency chain:
frint→skytext(compiled native extension) skytextdownloaded 2,400+ times, mostly on Linux- 7 trojanized repos target CVEs: FortiWeb (CVE-2025-64446), React2Shell (CVE-2025-55182), MongoBleed (CVE-2025-14847), PAN-OS (CVE-2026-0257), Ivanti Sentry (CVE-2026-10520), Check Point VPN (CVE-2026-50751), Joomla SP Page Builder (CVE-2026-48908)
- RAT capabilities: full credential theft (Chrome/Brave/Edge/Firefox), file exfiltration, arbitrary shell/Python execution, process enumeration
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
PyPI package frint | Malicious dependency | T1195.002 | pip install logs / lockfiles | Block; search for installations |
PyPI package skytext | Malicious native ext | T1195.002 | pip install logs | Block; audit all Python envs on researcher machines |
| 7 GitHub repos (FortiWeb/React2Shell/MongoBleed/PAN-OS/Ivanti/CheckPoint/Joomla PoCs) | Delivery | T1195.002 | Git clone logs | Search git history for clones of these repos |
| Browser credential theft (Chrome/Brave/Edge/Firefox) | Credential access | T1555.003 | EDR | Alert on non-browser processes accessing credential stores |
| Arbitrary shell command execution | C2 | T1059 | EDR / Sysmon | Hunt for Python parent spawning shell children on researcher VMs |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No rule for PyPI supply chain or PoC-repo-based delivery |
| Elastic | None | No researcher-workstation-specific detection for credential store access by Python |
| Sigma | proc_creation_lnx_python_spawn_shell.yml (partial) | Need rule for anomalous PyPI native extension loading + credential store access |
Sources: BleepingComputer, The Hacker News, Sekoia/YesWeHack
5. UNK_MassTraction — China-Aligned Roundcube Exploitation at US/Canadian Universities
TL;DR: China-aligned cluster UNK_MassTraction exploits two Roundcube flaws to deploy IceCube stealer and VShell/SquareShell webshells, targeting physics and engineering departments with national security ties. Active since May 2026.
What’s New:
- Proofpoint attribution to UNK_MassTraction; targeting US and Canadian university physics/engineering/astrophysics departments
- Exploits: CVE-2024-42009 (CVSS 9.3 XSS credential theft) + CVE-2025-49113 (CVSS 9.9 post-auth RCE)
- Attack chain: malicious email → JS loader in message body executes on open → IceCube stealer via CSRF token weaponization → CVE-2025-49113 for RCE → VShell or SquareShell (in-memory webshell) deployment
- Targets: administrators and professors in departments with national security ties or studying astrophysics/particle physics
- Estimated few dozen universities targeted; <10 directly observed by Proofpoint
- Campaign active since May 2026, believed ongoing
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| CVE-2024-42009 (Roundcube XSS) | Initial access | T1190 | Roundcube version | Patch to Roundcube 1.6.8+/1.5.8+ |
| CVE-2025-49113 (Roundcube RCE) | Execution | T1190 | Roundcube version | Patch immediately |
| IceCube stealer | Malware | T1005 | EDR / network | Hunt for JS-based credential exfiltration from webmail |
| VShell | Webshell/C2 | T1505.003 | Web server access logs | Hunt for anomalous PHP/shell process spawning |
| SquareShell (in-memory) | Webshell | T1505.003 | Memory forensics | Memory-resident — no file artifact |
| CSRF token weaponization | Technique | T1185 | Roundcube app logs | Alert on unusual CSRF token usage patterns |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Web JSP Request via URL (generic, partial) | No Roundcube-specific detection; no IceCube signature |
| Elastic | Web Shell Detection: Script Process Child of Common Web Processes (partial) | No Roundcube XSS or in-memory webshell detection |
| Sigma | webshell_detection_file_creation.yml (misses in-memory SquareShell) | Need Roundcube-specific rule; in-memory webshell gap |
Sources: The Hacker News, The Register, Proofpoint
Status Updates
- CVE-2026-58644 (SharePoint Server): Federal CISA KEV deadline passed July 19. Pre-auth deserialization RCE confirmed exploited as zero-day pre-patch. Original brief.
- CVE-2026-39808 / CVE-2026-25089 (FortiSandbox): Federal CISA KEV deadline passed July 19. Triple-CVE chain active exploitation with CVE-2026-39813. Original brief.
- CVE-2026-46817 (Oracle EBS): Federal CISA KEV deadline passed July 18. DriveSurge IAB exploitation ongoing; 950 exposed instances. Original brief.