CTI Daily Brief — 2026-07-03

Medtronic notifies ~9 million people of a ShinyHunters-claimed corporate-IT breach — 2.5 months after containment

Medical-device manufacturer Medtronic began notifying customers on 2026-07-02 of a breach the ShinyHunters extortion group first claimed in April. Medtronic's investigation found an unauthorized actor accessed certain corporate IT systems between 2026-04-13 and 2026-04-19 after unusual activity was noticed on 2026-04-15; ShinyHunters listed the company on its leak portal on 2026-04-18 claiming ~9 million records (names, contact details, dates of birth, Social Security numbers, health-related information) and later pulled the entry — consistent with the group's pattern after a ransom is paid (BleepingComputer, 2026-07-02). Medtronic states it found "no evidence" the data was published, and that the compromised corporate systems were segregated from device-operating networks so therapy delivery was unaffected (The Register, 2026-07-02). No initial-access vector is disclosed. This is the same ShinyHunters cluster behind the recent Salesforce/PeopleSoft-adjacent extortion wave (Nissan, NAIC — see prior coverage), but a corporate-IT compromise rather than the SaaS-integration pattern seen elsewhere; the source does not confirm shared tradecraft.

AdaptHealth breached via a social-engineered hijack of a third-party contractor's session [SINGLE-SOURCE]

DME and home-healthcare provider AdaptHealth Corp. (Nasdaq: AHCO) filed an SEC Form 8-K (Item 1.05) on 2026-07-02 disclosing that an actor accessed its cloud-based business applications — including internal patient-management systems and document storage — through "a successful social engineering attack that compromised a user session associated with a third-party contractor" (SEC 8-K, 2026-07-02). The company received an extortion communication on 2026-06-15 and determined materiality on 2026-06-27; confirmed exfiltration includes a stored insurance-billing password file plus patient PII and PHI, though it says SSNs and payment-card data are not held in the affected systems (StockTitan filing digest, 2026-07-02). No threat-actor group is named. The session-hijack-of-a-contractor pattern echoes Scattered-Spider-style help-desk/vishing tradecraft, though the filing does not attribute.

Navient discloses borrower SSN exposure from a ransomware hit on its outside law firm [SINGLE-SOURCE]

Student-loan servicer Navient Corporation (Nasdaq: NAVI) filed a Form 8-K (Item 1.05) on 2026-07-02 disclosing a material incident that did not touch its own systems: on 2026-06-08 it learned a third-party law firm providing services to the company had suffered a ransomware attack against the firm's own systems, and that Company-related borrower data held by the firm — names, dates of birth, addresses and Social Security numbers — was accessed (SEC 8-K, 2026-07-02). Navient found no evidence of access to its own environment and no operational disruption but determined materiality on 2026-06-29 given the volume and sensitivity of the exposed data. No ransomware group is named and no leak-site posting has surfaced; this is the victim's own regulatory disclosure of a fourth-party compromise, and no independent press coverage of the filing was found in-window (single-source — see § 7).

CVE-2026-34038 — Coolify: authenticated command injection to RCE and secrets exfiltration (CVSS 9.9)

Coolify — a widely used open-source self-hosted PaaS / deployment platform (a Heroku/Vercel alternative for organizations running their own CI/CD-to-production pipelines) — fixed a CWE-78 OS command-injection flaw (CVSS 3.1 9.9, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) in ApplicationDeploymentJob.php. The dockerfile_location and pre_deployment_command deployment parameters are passed to a shell without escaping, letting a user with only application "write" permission inject arbitrary OS commands (via ;, &&, backticks) that execute on the underlying host during a deployment; because deployment logs capture command output, exploitation also exfiltrates the application's configured environment secrets (coollabsio GHSA-qqrq-r9h4-x6wp, 2026-07-02). The vendor advisory notes a separate permission-bypass means the attacker does not need explicit "deploy" rights — broad "write" access is enough. BSI CERT-Bund published WID-SEC-2026-2182 the same day citing the GHSA as origin (BSI CERT-Bund, 2026-07-01). Fixed in ≥ v4.0.0-beta.469; ≤ v4.0.0-beta.462 are affected. No in-the-wild exploitation is reported by the vendor or BSI, and the CVE is not yet NVD-enriched. Detection: audit deployment-job logs for shell metacharacters in dockerfile_location/pre_deployment_command submitted by non-admin write-scoped accounts, and flag unexpected child processes off the PHP-FPM/queue-worker tree during a deployment (T1059 / T1190). Hardening: patch, restrict "write" grants to trusted users, and rotate any secrets referenced in deployment env vars that were reachable before patching.

UPDATE: FortiBleed FortiGate credential-harvesting linked to INC Ransom / Lynx deployments; scale revised ~5× up

UPDATE (originally covered 2026-06-18; last daily update 2026-06-24): The new delta is a ransomware connection. SOCRadar's Threat Research Unit reports what it calls the first confirmed link between the FortiBleed FortiGate credential-harvesting operation and actual ransomware deployment — an operational-security lapse on attacker infrastructure exposed logs showing a single operator working negotiation panels for both the INC Ransom and Lynx RaaS operations, with victim data overlapping between the FortiBleed dataset and an INC-linked open directory, and at least 12 ransomware deployments stemming from the harvested access (SOCRadar, 2026-07-01). The campaign's scale (430,000+ targeted firewalls) and Russian-speaking initial-access-broker attribution were already reported in the 2026-06-24 brief and are unchanged; the ransomware-deployment link and the two items below are what is new.

Separately, SOCRadar says the group holds at least one undisclosed Nextcloud zero-day (no CVE assigned, technical detail withheld pending a whitepaper) that it states it is disclosing to Nextcloud responsibly; The Hacker News adds that the exposed staging server also held reconnaissance on ~29,000 Citrix IP addresses, suggesting targeting beyond Fortinet (The Hacker News, 2026-07-02). These are SOCRadar's investigative claims from a single exposed server and are not yet independently corroborated by a second telemetry-holding lab (see § 7). Defender action for FortiGate operators: the newly-confirmed credential-theft-to-ransomware link means any historically internet-exposed FortiGate management/VPN interface should be treated as credential-compromised — rotate local/VPN and downstream domain credentials and hunt the VPN → domain-controller → domain-admin path; Nextcloud operators should track the coordinated disclosure.