Cyber Threat Brief — July 26 2026
⚠️ This report is AI-generated. Always validate findings.
1. HollowGraph M365 Calendar C2 Implant — Cavern Framework
TL;DR: Iranian-linked .NET implant uses hijacked Microsoft 365 calendar events dated to 2050 as a bidirectional C2 channel via Graph API, targeting Israeli entities since June 2026.
What’s New:
- Group-IB disclosed July 20; major coverage July 24-25 with full IOC set
- .NET DLL uses Microsoft Graph API to read commands from and exfiltrate stolen files as attachments on calendar events dated
2050-05-13 - Only two commands:
get(pull tasking) andsend(exfil) — part of larger Cavern modular backdoor framework - DNS channel refreshes Entra ID credentials (tenant/client/secret) via IPv6 AAAA records from
cloudlanecdn[.]com, stored inlogAzure.txt - RSA + AES-256 hybrid encryption on all calendar payloads; DNS channel is cleartext
- Attributed to Cavern Manticore (MuddyWater/Lyceum overlap, MOIS-linked) with high confidence on code, low confidence on operator
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
cloudlanecdn[.]com | C2 domain (DNS) | T1071.004 | DNS logs | Block/Hunt |
Calendar events at 2050-05-13 | C2 dead-drop | T1102.002 | M365 Unified Audit Log (Exchange) | Hunt |
logAzure.txt on disk | Credential cache | T1552.001 | Sysmon EID 11 / EDR file create | Alert |
| AAAA DNS queries with high-entropy subdomains to single domain | DNS tunneling | T1071.004 | DNS query logs | Hunt |
| App-driven calendar event creation (non-interactive Graph API calls) | Anomalous OAuth | T1550.001 | Entra ID sign-in + audit logs | Hunt |
Events with Event ID: / Boss{..}ID{..} subjects | C2 naming pattern | T1102.002 | Exchange mailbox audit | Hunt |
Attachments named File{n}.txt on far-future events | Exfil payload | T1567.002 | Exchange mailbox audit | Hunt |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No rule for Graph API calendar abuse as C2; need SPL for OAuth app creating events on foreign mailbox |
| Elastic | None | No rule for M365 Graph API application-context calendar manipulation |
| Sigma | None | No rule for DNS AAAA tunneling to single domain with high-entropy subdomains |
Sources: Group-IB Blog, The Hacker News, BleepingComputer
2. Hermes AI Agent Autonomous Post-Exploitation — Thai Finance Ministry
TL;DR: Threat actor ran open-source Hermes AI agent in unattended “YOLO” mode to automate post-exploitation at Thailand’s Ministry of Finance, with a novel Go implant (“Hades”) staged alongside.
What’s New:
- Hunt.io and researcher Bob Diachenko disclosed July 24 after discovering 3 exposed open directories on Hong Kong-hosted server (July 9-13)
- 585 files / 470 MB of attack code, stolen creds, and Hermes agent output logs
- Hermes ran automated privilege escalation, kernel vuln scanning, service enumeration, and filesystem searches — all without human approval
- Undisclosed Go-based implant “Hades” identified alongside traditional tooling (suo5 HTTP tunnels, webshells)
- Hardcoded credentials targeting mail infrastructure and Apache Hadoop in custom scripts
- ThaiCERT and National Cyber Security Agency notified July 15; no breach confirmation from Ministry
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
hermes process with --yolo or --auto flags | AI agent indicator | T1059 | EDR process telemetry | Hunt |
| suo5 HTTP tunnel binaries | Tunneling tool | T1572 | EDR / web proxy logs | Block |
| Hades Go implant (hashes pending full IOC release) | Custom backdoor | T1587.001 | EDR hash monitoring | Hunt |
| Open directory server (Hong Kong infrastructure) | Staging infra | T1583.003 | Threat intel feeds | Block |
| Hardcoded creds in scripts targeting Hadoop/mail | Credential abuse | T1078.001 | EDR file content scanning | Hunt |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No rule for AI agent process execution; need detection for autonomous scripting tools with approval-bypass flags |
| Elastic | None | No suo5 tunnel detection; generic web proxy tunneling rules may partially cover |
| Sigma | None | No rule for Hermes agent execution patterns |
Sources: Hunt.io Blog, The Hacker News, BleepingComputer
3. Redis Emergency Patches — Authenticated RCE via Double-Free + Heap Overflow
TL;DR: Redis shipped 7 emergency security releases July 23 fixing authenticated RCE across Redis 6.2 through 8.8 via stream consumer-group NACK double-free and RedisBloom TDigest heap overflow.
What’s New:
- Researcher Chaofan Shou published PoCs for stock Redis 6.2.22, 7.4.9, 8.6.4, and 8.8.0
- Stream consumer-group shared-NACK path frees the same heap chunk twice — reliable code execution primitive for authenticated attackers
- Separate heap overflow in bundled RedisBloom TDigest module provides alternative exploitation path
- Redis released 7 patched versions on July 23 covering all affected branches
- No CVEs assigned for July batch yet (existing May CVE-2026-25243/CVE-2026-25589 cover earlier related issues)
- Kimi K3 AI agent reportedly used to discover some of these issues, though claims are unverified
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
XREADGROUP + XCLAIM with rapid NACK cycling | Exploit trigger | T1210 | Redis slowlog / command monitor | Hunt |
| TDigest module commands with oversized payloads | Heap overflow trigger | T1210 | Redis slowlog / command monitor | Hunt |
| Redis versions 6.2.22, 7.4.9, 8.6.4, 8.8.0 (unpatched) | Vulnerable software | — | Asset inventory | Patch |
| Anomalous Redis child processes (shell spawns) | Post-exploitation | T1059 | EDR / auditd | Alert |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No Redis-specific exploitation rule |
| Elastic | None | No Redis command abuse detection |
| Sigma | proc_creation_lnx_susp_child_process_from_redis.yml (partial, if exists) | No rule for double-free trigger patterns in Redis stream commands |
Sources: The Hacker News, Redis Security Releases
4. Adobe Acrobat Chrome Extension UXSS — CVE-2026-48294
TL;DR: Cross-origin data disclosure flaw in Adobe Acrobat Chrome extension (329M installs) let malicious sites read WhatsApp Web conversations, session tokens, and authenticated content across all origins. Patched via auto-update.
What’s New:
- Guardio researcher Shaked Biner discovered flaw in extension version 26.5.2.1 (released June 3)
- CVSS 7.4 — bypasses browser same-origin policy; single visit to malicious site exfiltrates cookies, DOM content, and session data from any logged-in origin
- Demonstrated reading WhatsApp Web conversations, including encrypted message content visible in the DOM
- 329 million Chrome browser installs affected
- Adobe patched in 26.5.2.3 over the same weekend as disclosure; auto-update deployed
- Codenamed “HermeticReader” by Guardio
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Adobe Acrobat extension version < 26.5.2.3 | Vulnerable software | T1189 | Chrome enterprise management / EDR browser inventory | Patch verify |
| Cross-origin XMLHttpRequest from Acrobat extension context | Exploit behavior | T1185 | Chrome extension audit logs | Hunt |
Extension ID efaidnbmnnnibpcajpcglclefindmkaj version check | Version verification | — | Group Policy / MDM | Verify |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No Chrome extension version monitoring rule |
| Elastic | None | No browser extension UXSS detection |
| Sigma | None | No rule for cross-origin data access via browser extensions |
Sources: BleepingComputer, SecurityWeek, Malwarebytes
Status Updates
- CVE-2026-50522 (SharePoint pre-auth deserialization RCE): Federal CISA KEV deadline passed July 25. Active exploitation via BinaryFormatter at
/_trust/default.aspx. Machine key theft for long-term persistence. 4th actively exploited SharePoint CVE this month. THN - CVE-2026-16232 (Check Point SmartConsole auth bypass): Federal CISA KEV deadline passed July 25. Zero-day auth bypass via application token. 5 attacker IPs published. CISA
- CVE-2026-6875 (ServiceNow AI Platform pre-auth RCE): Still NOT on CISA KEV. Active exploitation ongoing since July 18. Second sandbox-escape gadget chain bypasses original PoC defenses. Fortune 500 and critical infrastructure victims. BleepingComputer