Wednesday, 22 July 2026

Everest ransomware breaches a Stadler Rail supplier data-exchange platform, demands CHF 10 million — the Swiss rail manufacturer refuses to pay

Stadler Rail disclosed on 2026-07-21 that unauthorised parties gained access, in mid-July, to a data-exchange platform Stadler uses with an (unnamed) supplier, and that the Everest ransomware/extortion group claimed the intrusion and demanded a CHF 10 million ransom (swissinfo.ch, 2026-07-21). Stadler states it does not pay ransoms under any circumstances, has filed a criminal complaint with Thurgau cantonal police, and reports that its own IT systems were unharmed, no security-relevant or personal data was stolen, and worldwide rail-vehicle production and in-service fleets are unaffected — the accessed information belonged to the supplier and is described as not security-relevant (Swiss IT Magazine, 2026-07-21).

Everest is a Russian-speaking, closed-group double-extortion operation that emerged in December 2020, with a code-level connection to the BlackByte ransomware family; it has run hybrid Initial Access Broker services since November 2021 and a corporate-insider recruitment programme offering cash/profit-sharing since October 2023, and its documented infection vectors are internet-exposed RDP without MFA, vulnerable VPN endpoints, and credentials bought from other brokers (Halcyon, 2025-11-19). Per the same profile the group claimed, in October 2025, attacks on critical infrastructure including a European national electricity transmission operator, aviation systems affecting multiple European airports (Heathrow, Brussels and Berlin), and telecommunications networks — recurring targeting of the European critical-infrastructure and transport space, though those victim claims are the group's own leak-site assertions and are unconfirmed by the named organisations.

South Korea's Foreign Ministry: a ~10-month zero-day intrusion into the Diplomatic Academy's e-learning platform exposed records on nearly all diplomats

South Korea's Ministry of Foreign Affairs disclosed on 2026-07-21 that attackers exploited a previously unknown zero-day in the server software behind the Korea National Diplomatic Academy's (KNDA) online training/e-learning platform, combined with security-configuration weaknesses, to seize control of the server between April and May 2025 (The Korea Herald, 2026-07-21). The intrusion evaded the Academy's routine security checks (in place since the platform's 2022 deployment) and was only discovered in early February 2026, after another government agency flagged suspicious activity; the server was then taken offline and the (unnamed) software vendor released a patch once the flaw was identified during the investigation. Public disclosure followed roughly five months after internal discovery.

Exposed data covers up to ~10,000 records of current and former diplomats, overseas-mission officials and embassy/consulate administrative staff — including names, user IDs, email addresses and encrypted passwords, but not resident-registration numbers, phone numbers, home addresses or photographs (DailySecu, 2026-07-21; Seoul Shinmun, 2026-07-22). Officials say there is not yet sufficient technical evidence to attribute the intrusion but have not ruled out state-backed groups, including North Korea.

Kaspersky documents living-off-the-land BitLocker extortion across two Latin America incidents; the second self-identifies as 'XEntry Team'

Kaspersky's GERT incident-response team documented two 2026 extortion incidents in Latin America that abuse native Windows BitLocker for encryption-for-impact rather than deploying a conventional ransomware family — a living-off-the-land model that leaves no bespoke encryptor for signature-based detection (Kaspersky, 2026-07-21). In the first case (Colombia, June), initial access was an internet-exposed RDP service on a host attached to an 8 TB store of mission-critical data; after manipulating credentials the attacker enabled BitLocker on the drive and demanded roughly USD 3,000. In the second case (Mexico, May) — whose victims' screens displayed "Hacked by XEntry Team" — initial access was a misconfigured Microsoft SQL Server whose xp_cmdshell extended stored procedure allowed OS command execution; the operators established persistence through legitimate RMM suites (ManageEngine Endpoint Central, Mesh Agent, Tactical RMM) and web shells, then used Group Policy Objects to push BitLocker activation and encryption tasks across domain-joined systems. Both incidents delivered ransom notes through victims' office printers. Kaspersky notes similarities in the ransom-note wording and delivery method that may link the two cases but states the notes "do not reveal a clear connection between the actors" — so treat them as a shared technique cluster, with "XEntry Team" naming the Mexico intrusion specifically. Kaspersky places the approach in the ShrinkLocker BitLocker-abuse lineage, driven here by an RDP or MSSQL foothold and, in the branded case, an RMM-and-GPO admin workflow rather than a self-contained binary.

CVE-2026-0770 — Langflow: CISA confirms active exploitation of an unauthenticated exec_globals RCE the same day a 15-CVE batch (incl. unauthenticated account creation) is patched in 1.10.1

CISA added CVE-2026-0770 (CVSS 9.8) to its Known Exploited Vulnerabilities catalog on 2026-07-21, confirming in-the-wild exploitation of a flaw that Zero Day Initiative disclosed as an unpatched zero-day on 2026-01-09 (CISA, 2026-07-21). The flaw sits in the POST /api/v1/validate/code endpoint: the exec_globals parameter is passed to Langflow's code-validation handler and executed via Python exec() without sandboxing, giving code execution in the context of root (Zero Day Initiative, 2026-01-09). Exploitation is unauthenticated only where the operator runs AUTO_LOGIN=true and has retained Langflow's documented default credentials — a deployment misconfiguration, which is why the durable fix is disabling AUTO_LOGIN or rotating the default account rather than a version bump.

The same day, NCSC-NL published NCSC-2026-0251 covering 15 further CVEs across IBM Langflow OSS 1.0.0 through 1.10.0, all fixed in 1.10.1 (NCSC-NL, 2026-07-21). The batch includes an unauthenticated missing-authentication flaw (CVE-2026-9202, CVSS 9.8) that lets an attacker create unlimited accounts on any instance and — where the documented NEW_USER_IS_ACTIVE=true option is set — immediately activate them to reach RCE endpoints, bypassing AUTO_LOGIN restrictions entirely; a path-traversal arbitrary file write in the APIRequest "Save to File" feature via unsanitised Content-Disposition filenames (CVE-2026-8859, CVSS 9.9); a code-injection flaw in the Policies/ToolGuard component whose guard-field validation covered only the main code field and not dynamic CodeInput fields (CVE-2026-9135, CVSS 9.9); an SSRF from insecure defaults (CVE-2026-7754); RCE via insufficient validation of MCP server configuration files (CVE-2026-7755); and unsafe deserialization in the AsyncDiskCache class reachable through apply_tweaks() parameter override (CVE-2026-8476). Langflow has repeatedly drawn CISA KEV listings in 2026 — earlier additions include CVE-2026-33017 and CVE-2026-55255 — reflecting how the platform's exposure as a self-hosted AI-agent orchestrator holding embedded credentials and broad system permissions keeps drawing both attackers and researchers.

Zimbra Collaboration Suite 10.1.20 — permanent fix for an SNMP command-injection RCE plus four stored-XSS bugs; NCSC-CH and BSI both flag the release

Zimbra shipped Collaboration Suite (ZCS) 10.1.20 on 2026-07-20, fixing nine security issues; NCSC-CH and BSI CERT-Bund both flagged the release on 2026-07-21 (NCSC-CH, 2026-07-21; BSI CERT-Bund, 2026-07-21). The headline flaw is a command-injection vulnerability in Zimbra's SNMP monitoring component, exploitable when SNMP notifications are enabled, that lets an attacker execute arbitrary OS commands on the mail server; Zimbra describes 10.1.20 as the permanent fix for a vulnerability it first disclosed in a 26 June 2026 advisory and has withheld a CVE identifier and technical specifics "in line with industry best practices" pending wider patch adoption (Zimbra, 2026-07-20; The Hacker News, 2026-07-21). Four stored cross-site-scripting bugs in the Classic Web Client round out the un-CVE'd issues: malicious attachment filenames, crafted fields, and rendered attachments can each trigger script execution inside a victim's authenticated webmail session.

Three issues received CVE identifiers, listed in BSI's advisory: CVE-2026-50055, CVE-2026-10631 and CVE-2026-50054 — all three currently RESERVED on NVD/MITRE. The Hacker News maps CVE-2026-50055 to the mail-forwarding restriction bypass (letting an authenticated attacker exfiltrate mail even where forwarding restrictions are enforced) (The Hacker News, 2026-07-21); the other two correspond to the release's EWS-extension access-control and mailbox-delegation authorization fixes described in Zimbra's own advisory, but the cited sources do not state which CVE maps to which issue. The release also fixes an SSRF in Zimbra's Nextcloud integration. This is the second Zimbra security release inside two weeks, following ZCS 10.1.19's 10 July fix for a separate Classic Web Client crafted-email code-execution bug.

CVE-2026-50522 — SharePoint Server pre-auth deserialization RCE moves to active exploitation via public PoC; attackers steal machine keys for persistent forged authentication

UPDATE · originally covered July Patch Tuesday follow-through: a SharePoint pre-auth JWT bypass from a Pwn2Own chain (CVE-2026-55040) and a pre-auth Dynamics 365 RCE Microsoft expects to be exploited (CVE-2026-55944) (2026-07-15)

The July 2026 SharePoint patch cluster carried CVE-2026-50522, a deserialization-of-untrusted-data RCE that all sources had assessed as not-yet-exploited (Microsoft flagged only an "increased likelihood"). That changed on 2026-07-21: NCSC-NL updated advisory NCSC-2026-0237 to report, per watchTowr, that public exploit code for CVE-2026-50522 was published and the flaw is now actively exploited against on-premises SharePoint, with attackers stealing machine keys for long-term access (NCSC-NL, 2026-07-21).

watchTowr detailed the chain (relayed via BleepingComputer): a malicious .NET BinaryFormatter payload is delivered as the cookie of a forged SecurityContextToken in a WS-Federation sign-in response posted to SharePoint's /_trust/default.aspx endpoint; a successfully processed payload executes code and lets the attacker exfiltrate the server's machine keys, which are then used to forge valid ASP.NET authentication tokens/ViewState — giving persistent, re-authenticatable access that survives patching unless the keys are rotated (BleepingComputer, 2026-07-21). A PowerShell PoC (attributed by BleepingComputer to researcher "Janggggg") went public on 2026-07-20, and watchTowr's Attacker Eye honeypots captured successful compromises within hours (BleepingComputer, 2026-07-21); Security Affairs corroborates that the public PoC triggered active exploitation (Security Affairs, 2026-07-21). No authentication is required for the initial RCE.

Kaspersky corroborates the Cavern/HOLLOWGRAPH cluster, associates it (low confidence) with OilRig (APT34), and details a DNS AAAA-record C2 config-recovery fallback

UPDATE · originally covered HOLLOWGRAPH: a Cavern-framework backdoor that turns a compromised Microsoft 365 calendar into a Graph-API dead-drop C2 (2026-07-21)

The HOLLOWGRAPH entry documented an Iran-linked backdoor that used Microsoft Graph and far-future Outlook calendar events as its command-and-control channel. Kaspersky GReAT has now published independent analysis of the same toolset — which Check Point tracks as "Cavern Manticore" — detailing a new communication module (AzureCommunication.dll) that replaces the earlier HTTP/WebSocket component with Microsoft Graph, exchanging RSA-OAEP-SHA256 + AES-256-GCM-encrypted commands and results as attachments inside far-future Outlook calendar events (a fixed 2050-05-13 window) keyed to a controller-generated agent ID (Kaspersky, 2026-07-21; Check Point Research, 2026-07-06).

The new element beyond prior reporting is a resilience layer: when Graph authentication or tenant validation fails, the module recovers replacement connection settings (TenantId, ClientId, ClientSecret, UserEmail) via DNS AAAA responses from attacker-controlled nameservers, encoding length markers and 14-byte chunks in specially formatted subdomains. On attribution, Kaspersky retains its low-confidence assessment that Project CAV3RN is associated with OilRig (APT34) — a link it first drew in a previous report — noting the new module shares behavioural patterns with previously reported OilRig tooling (Microsoft-hosted-service C2, attachment-based command exchange, a secondary cloud-C2 recovery mechanism) while explicitly identifying no direct code reuse or infrastructure overlap (Kaspersky, 2026-07-21). Treat the OilRig association as an analytic lead, not a settled attribution.