Cyber Threat Brief — July 31 2026
⚠️ This report is AI-generated. Always validate findings.
1. SonicWall Credential Stuffing Campaign — 30+ Orgs Compromised
TL;DR: Active credential stuffing campaign since July 25 has compromised 92 user accounts across 30+ organizations via SonicWall VPN/firewall portals. Five DigitalOcean IPs driving automated credential validation at scale.
What’s New:
- Huntress SOC disclosed July 28; campaign ongoing through at least July 27
- 92 unique accounts compromised: 26 on July 25, 34 on July 26, 32 on July 27
- No post-compromise hands-on-keyboard activity observed yet — credential validation phase
- Same accounts targeted in prior incident May 22, 2026 — indicates credential reuse from earlier breaches
- Pattern consistent with SonicWall SSLVPN compromise spikes in October 2025 and February 2026
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| 157.245.88[.]153 | IPv4 | T1110.004 | Firewall/VPN auth logs | Block |
| 162.243.31[.]111 | IPv4 | T1110.004 | Firewall/VPN auth logs | Block |
| 167.71.150[.]1 | IPv4 | T1110.004 | Firewall/VPN auth logs | Block |
| 209.97.151[.]148 | IPv4 | T1110.004 | Firewall/VPN auth logs | Block |
| 64.227.15[.]20 | IPv4 | T1110.004 | Firewall/VPN auth logs | Block |
| DigitalOcean ASN | ASN | T1583.003 | Network logs | Hunt |
| HTTP/1.0 + Chrome UA | Anomaly | T1071.001 | WAF/proxy logs | Hunt |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Authentication - Brute Force Access Behavior Detected | No SonicWall-specific correlation for multi-org stuffing campaigns |
| Elastic | Credential Stuffing - Multiple Auth Failures Followed by Success | Missing DigitalOcean ASN enrichment |
| Sigma | win_security_susp_failed_logons_single_source.yml | Not applicable to SonicWall VPN — need appliance-specific rule |
Sources: Huntress Threat Advisory
2. TELESHIM APT Campaign — East Asia Targeting Middle East Governments
TL;DR: Undisclosed East Asia-linked actor deploying three novel malware families (TELESHIM, MIXEDKEY, BINDCLOAK) against Middle East government entities using Telegram Bot API for C2, with heavy code obfuscation and environmental keying.
What’s New:
- Zscaler ThreatLabz disclosure July 27 with full technical analysis
- TELESHIM abuses Telegram Bot API for C2 — polls via HTTPS mimicking legitimate browser traffic
- Initial access via ISO file sideloading legitimate ASUSTek RegSchdTask.exe with malicious AsTaskSched.dll
- Environmental keying: decryption key derived from machine volume serial number, preventing sandbox analysis
- Heavy obfuscation: control flow flattening (CFF), mixed boolean arithmetic (MBA), opaque predicates
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| 5c2fe953da53da66fbcbb3be0fd6b63907c10714c337f287b2fc258857bbff6d | SHA-256 (TELESHIM) | T1059 | EDR/AV | Block |
| cert.hypersnet[.]com | Domain (C2) | T1071.001 | DNS/proxy | Block |
| AsTaskSched.dll | Filename (sideload) | T1574.002 | Sysmon EID 7 | Hunt |
| RegSchdTask.exe (ASUSTek) | LOLBin proxy | T1036.005 | Process creation | Hunt |
| Telegram Bot API polling | C2 Pattern | T1102.002 | HTTPS/TLS logs | Hunt for api.telegram.org from non-user processes |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No detection for Telegram Bot API C2 abuse or ASUSTek DLL sideloading |
| Elastic | Suspicious DLL Loaded via Side-Loading (generic) | Does not cover ASUSTek-specific sideloading path |
| Sigma | proc_creation_win_sideload_asustek.yml — None | Need rule for RegSchdTask.exe loading unsigned DLLs |
Sources: Zscaler ThreatLabz Part 1, The Hacker News
3. Sapphire Sleet npm Supply Chain Attribution — debug/chalk/axios
TL;DR: Amazon Threat Intelligence attributed the 2025-2026 npm supply chain compromises of debug, chalk, and axios (combined 1B+ weekly downloads) to North Korea’s Sapphire Sleet (BlueNoroff). Social engineering of maintainers, not typosquatting.
What’s New:
- Amazon published attribution July 29-30 linking four package compromises to single DPRK actor
- September 2025 debug/chalk hijack affected ~10% of cloud environments within 2 hours
- March 2026 axios compromise (100M+ weekly downloads) via same actor
- Methodology: phishing via npm-lookalike domain to steal maintainer credentials, then publishing poisoned updates from trusted accounts
- Wallet-draining scripts embedded in 18+ packages; post-install hooks for automatic execution
- typo-crypto (March 2025) served as testing ground before escalation
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Post-install hooks in npm packages | Execution technique | T1195.001 | CI/CD pipeline logs | Audit npm install scripts |
| npm-lookalike phishing domains | Social engineering | T1566.002 | Email/DNS logs | Hunt |
| Cryptocurrency wallet-draining functions | Payload | T1496 | EDR/process monitoring | Hunt for crypto wallet API calls from Node.js |
| debug versions 4.3.5-4.3.6 (malicious) | Package version | T1195.002 | SBOM/dependency scan | Audit |
| chalk versions 5.3.1-5.3.2 (malicious) | Package version | T1195.002 | SBOM/dependency scan | Audit |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | None | No detection for malicious npm post-install hook execution |
| Elastic | None | No supply chain package integrity monitoring |
| Sigma | None | Need rule for suspicious npm postinstall script spawning shells or network connections |
Sources: BleepingComputer, The Hacker News
Status Updates
- CVE-2026-20316 (Cisco FMC): Federal CISA KEV deadline TOMORROW August 1. Zero-day exploitation via hardcoded credential ongoing. Original brief.
- CVE-2026-6875 (ServiceNow): Active exploitation ongoing since July 18. Two sandbox-escape gadget chains confirmed. Fortune 500 and critical infrastructure victims. Still NOT on CISA KEV despite confirmed mass exploitation. Original brief.
- CVE-2026-12569 (PTC Windchill/Cl0p): Cl0p extortion campaign ongoing via support@cryptohox[.]com. JSP webshells and flst.txt recon active. Original brief.
- LegacyHive-Windows-LPE: UNPATCHED zero-day. ACROS Security released free 0patch micropatches July 20. Microsoft still has not assigned CVE or released fix. Original brief.