Wednesday, 12 August 2026

A German federal- and state-funded memorial foundation is rebuilding its entire IT from scratch after ransomware — all seven sites offline, data assumed exfiltrated, no actor named

The Stiftung Brandenburgische Gedenkstätten — a public-law foundation funded by the Brandenburg state ministry for science and culture and by the federal government's commissioner for culture and media, operating seven memorial sites including the former Sachsenhausen and Ravensbrück concentration camps — published press release Nr. 42/2026 on 2026-08-11 stating that it "ist Opfer eines sogenannten Ransomware-Angriffs geworden" ("has become the victim of a so-called ransomware attack") (Stiftung Brandenburgische Gedenkstätten, 2026-08-11). The attack was detected on 5 August; attackers reached the internal IT systems, encrypted parts of the systems and data with dedicated software, and left a ransom note demanding payment for decryption. The foundation states that "Nach aktuellem Stand muss davon ausgegangen werden, dass Daten von den Angreifern heruntergeladen wurden" — on current assessment it must be assumed that data was downloaded by the attackers before encryption. Its director describes the entire IT system as currently non-functional. heise online corroborates the disclosure independently (heise online, 2026-08-11).

All seven memorial-site locations and the central business office are affected. The foundation's IT department disconnected every internet and network connection immediately, and the foundation reported the incident to the Zentrale Ansprechstelle Cybercrime at the Brandenburg state police and filed a breach notification with the Brandenburg data-protection authority within the statutory window. Physical visits to the memorials continue; booking delays for educational programmes are expected. No source names a threat actor or ransomware family, no leak-site listing had surfaced as of this run, and neither the foundation nor heise states how the attackers got in.

The transferable part is the recovery decision, not the victim. The foundation is rebuilding its IT systems from scratch rather than restoring from backups, explicitly to deny the attacker a route back in, and is doing so with an external incident-response provider recommended by the BSI (Stiftung Brandenburgische Gedenkstätten, 2026-08-11). The foundation expects the systems to be available again in a few days ("in einigen Tagen"), with delays to educational-programme bookings until then. For a small public body the rebuild is still the more expensive of the two options — it trades a longer outage for the certainty that restored infrastructure is not carrying the intruder's persistence — and it is the correct default when data theft is assumed and the dwell time is unknown, because a backup taken during an undetected intrusion restores the foothold along with the files.

Triage: with no actor, family or vector disclosed, there is nothing here to match an alert against — the entry is a sector-pattern and recovery-posture record, and any attempt to bind it to a specific intrusion set would be invention.

ShieldBreak — a public proof-of-concept defeats Microsoft's July fix for the RoguePlanet Defender flaw, claims 100% reliability where the original was a coin flip, and now covers Windows Server 2025

The pseudonymous researcher Nightmare Eclipse published ShieldBreak, a proof-of-concept described as defeating the patch Microsoft shipped five weeks earlier for a Windows Defender privilege-escalation flaw (Cyber Kendra, 2026-08-12). Rapid7 places the drop late on Patch Tuesday itself, continuing what it describes as a pattern of the past few months (Rapid7, 2026-08-11). Rapid7, covering the same release in its Patch Tuesday analysis, records the researcher describing ShieldBreak as a full patch bypass for RoguePlanet — the entry in the same series that Microsoft patched as CVE-2026-50656 in July, a month after its public disclosure — and notes that both are elevation-of-privilege-to-SYSTEM vulnerabilities in Defender (Rapid7, 2026-08-11).

Two claims are what make this worth acting on rather than filing. RoguePlanet was a race condition whose reliability varied sharply between machines — the researcher called it hit or miss in June — while "ShieldBreak is listed with a 100 percent success rate". And where the June exploit did not run on Windows Server because standard users cannot mount ISO images there, ShieldBreak is listed as tested on Windows Server 2025 alongside Windows 11 25H2 and the Canary channel (Cyber Kendra, 2026-08-12). Both of those are the researcher's own claims: Cyber Kendra states that "No patch exists for ShieldBreak, and no vendor has reproduced it publicly yet", and that Microsoft had not commented at publication. Treat the reliability figure and the server coverage as unverified until someone reproduces them — but treat the existence of working exploit code as established, because that is what the release consists of.

The target is the Microsoft Malware Protection Engine, the scanner behind Defender, which runs as SYSTEM; RoguePlanet abused improper link resolution before file access to spawn a SYSTEM shell on fully updated machines, was rated Important at CVSS 7.8, and was fixed in engine build 1.1.26060.3008 on 2026-07-09. Analysts who dissected RoguePlanet in June described an attack chain built on NTFS junctions, opportunistic locks and the Windows Error Reporting QueueReporting scheduled task, which Cyber Kendra reads as suggesting ShieldBreak reworks the same plumbing rather than opening a new front (Cyber Kendra, 2026-08-12) — that is an inference in the reporting, not a stated finding, and no technical analysis of ShieldBreak itself has been published.

The reason a local privilege-escalation PoC from this particular persona deserves more than a backlog ticket is the track record the same reporting sets out: of the previously disclosed flaws in the series, three — BlueHammer (CVE-2026-33825), RedSun (CVE-2026-41091) and UnDefend (CVE-2026-45498) — were exploited in real-world intrusions before fixes landed and all three ended up in CISA's Known Exploited Vulnerabilities catalog (Cyber Kendra, 2026-08-12). This is also the second time a fix in this class has fallen: Microsoft hardened Defender's internal file-handling APIs in mid-May and RoguePlanet was rewritten to defeat that.

Compensating controls, not patching, are the available lever. The one the reporting names as strongest for this bug class is application allowlisting — ThreatLocker found it blocked RoguePlanet by default (Cyber Kendra, 2026-08-12). Detection concepts follow the RoguePlanet chain rather than ShieldBreak's unpublished internals, so they are hypotheses to hunt with rather than confirmed signatures for this variant: in filesystem and process telemetry, reparse-point or junction creation by a standard-user process inside a path the Defender engine subsequently touches, and unexpected execution lineage from the Windows Error Reporting scheduled task, are the observable steps that chain described. Because the escalation ends in a SYSTEM process spawned by an engine that legitimately runs as SYSTEM all day, the parent-process shape alone will not separate this from routine scanning activity — the preceding filesystem manipulation by an unprivileged account is where the discriminator lives.

CVE-2026-20349 — Cisco Secure Firewall ASA/FTD: one crafted HTTP request to the Remote Access SSL VPN reloads the device, exploitation confirmed, no workaround and a three-day KEV deadline

Cisco published advisory cisco-sa-asaftd-vpn-dos-dzv4mQFF on 2026-08-11 at 16:39 GMT covering CVE-2026-20349, and states plainly that "In August 2026, the Cisco Product Security Incident Response Team (PSIRT) became aware of active exploitation of this vulnerability" (Cisco PSIRT, 2026-08-11). The flaw is insufficient error checking when the Remote Access SSL VPN service on Secure Firewall ASA and Secure Firewall Threat Defense processes HTTP requests: an unauthenticated remote attacker sends a crafted HTTP request to that service and causes the device to reload, producing a denial of service. Cisco scores it CVSS 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) under CWE-244, rates the advisory High, and states "There are no workarounds that address this vulnerability" (Cisco PSIRT, 2026-08-11).

The exposure question is a configuration question, and Cisco makes it checkable rather than leaving it to guesswork. Three features enable the SSL listen sockets the attack reaches: IKEv2 remote-access VPN with client services (crypto ikev2 enable <interface> client-services port <ports>), SSL VPN (webvpn enable <interface>), and Zero Trust Network Access (zero-trust enable, FTD only) (Cisco PSIRT, 2026-08-11). A device with none of them configured is not affected regardless of version. Affected releases are ASA 9.16, 9.18, 9.20, 9.22, 9.23 and 9.24 and FTD 7.0, 7.2, 7.4, 7.6, 7.7 and 10.0, with per-train hot fixes listed in the advisory; Cisco confirms Secure Firewall Management Center is not affected. One deployment footnote worth carrying into the change ticket: the ASA hot fixes for the 9.16 and 9.18 trains use a release-numbering format beginning 89, and Cisco tells customers installing those to move to ASDM 7.24.1.374 because earlier ASDM releases do not recognise that format.

CISA added CVE-2026-20349 to its Known Exploited Vulnerabilities catalog on 2026-08-11 with a 14 August due date, and catalogues it as a heap-inspection weakness (CISA, 2026-08-11). The US federal deadline is not this constituency's clock, but the listing itself is the jurisdiction-agnostic part: it is independent confirmation that the flaw is being used, on a class of device — the remote-access VPN gateway — where an outage is a availability incident for every remote worker at once.

Two things keep this at high rather than critical. Cisco scopes the impact to a device reload with no confidentiality or integrity effect in its own vector string, and names no exploiting cluster or targeted sector. What makes it worth acting on inside the week anyway is the combination the advisory itself documents: unauthenticated, single-request, no workaround, on a service whose whole purpose is to be reachable from the internet. Detection here is unusually blunt and unusually reliable — the exploitation signal is the impact. Repeated unexplained reloads or crash-dump generation on an internet-facing ASA/FTD, particularly clustered around inbound HTTP requests to the SSL VPN listener rather than around a configuration change or a scheduled reload, is the hunt; syslog reload events correlated against the VPN service's request logs will separate a exploitation attempt from an operator-initiated reboot, because the latter carries a corresponding administrative session and the former does not.

CVE-2026-58231 — SAP Commerce Cloud: an unauthenticated request to the Data Hub Adapter import endpoint reaches arbitrary code execution (CVSS 10.0), and the fix needs a rebuild and redeploy

SAP's August 2026 Security Patch Day of 2026-08-11 released 28 new security notes plus one GitHub security advisory, with two updates to previously released notes (SAP SE, 2026-08-11); Onapsis, counting the cycle its own way, puts it at thirty-three notes including five HotNews and nine High Priority (Onapsis Research Labs, 2026-08-11). The one that changes an exposure picture rather than a patch schedule is CVE-2026-58231, carried by SAP Security Note 3771065 at CVSS 10.0: an improper-authorization flaw in the Data Hub Adapter of SAP Commerce Cloud. Onapsis, which worked with SAP on eleven of the notes in this cycle, describes the cause as insufficient authorization checks combined with insufficient input validation, and the outcome as arbitrary code execution with compromise of internal components (Onapsis Research Labs, 2026-08-11). The reason this ranks above a routine critical: Commerce Cloud is the platform behind public storefronts, so the vulnerable component sits on the internet side of the estate by design, and the score's pre-auth, no-interaction profile means reaching it takes a crafted request rather than a foothold.

Remediation for this one is not a patch install. Onapsis states customers must patch to the fixed Commerce Cloud release levels referenced in the note and then rebuild and redeploy the updated version, and that the interim exposure reduction available today is an IP filter set restricting access to the vulnerable endpoint (Onapsis Research Labs, 2026-08-11). Any organisation whose change process treats "SAP note applied" as equivalent to "fixed" will record this as remediated while the storefront is still reachable. The same rebuild-and-redeploy requirement applies to CVE-2026-42945 (CVSS 8.1), a buffer overflow affecting Commerce Cloud public-cloud deployments fronted by NGINX, per SAP Security Note 3773203 (SAP SE, 2026-08-11).

Three further notes Onapsis classes as HotNews matter to different estates. CVE-2026-44772 (CVSS 9.9, Note 3765948) and CVE-2026-44758 (CVSS 9.1, Note 3758900) are code-injection flaws in SAP Manufacturing Integration and Intelligence reaching arbitrary command execution on the underlying host; Onapsis states the lower score on the second reflects a higher privilege requirement, and that the fix removes the vulnerable servlet component in both cases rather than hardening it (Onapsis Research Labs, 2026-08-11). CVE-2026-34265 (CVSS 9.8, Note 3714806) is the one to weigh against internal network exposure rather than internet exposure: "Logical errors in DIAG protocol parsing allow an unauthenticated attacker to generate memory corruptions" in the Application Server ABAP kernel, with potential disclosure of sensitive system information or a crash of the instance (Onapsis Research Labs, 2026-08-11). DIAG is the SAP GUI presentation protocol, so the affected listener is one that ordinarily faces user workstations, and the affected kernel list spans KRNL64NUC/KRNL64UC and KERNEL builds from 7.22 through 9.19 (SAP SE, 2026-08-11). Rounding out the High Priority set, CVE-2026-58243 (CVSS 8.8, Note 3772411) covers the SQL Console in SAP ABAP Developer Tools, where support for host expressions inside SQL statements let a low-privileged authenticated user run database operations they should not reach.

No party reports exploitation of any of these. That is the reason none of them carries a critical priority here — but the Data Hub Adapter flaw still demands action ahead of the normal SAP patch cadence, because its own mechanics set the clock: an unauthenticated, no-interaction path to code execution on a component that is internet-facing by product design, disclosed with a CVSS 10.0 and a documented interim network control, is the shape that gets scanned for within days of a patch day. Detection concepts are ordinary but specific: in web and reverse-proxy access logs, surface requests to the Data Hub import path from source addresses outside the integration ranges that legitimately feed it, and treat any such request that precedes an unexplained child process under the Commerce Cloud application account as an incident rather than an anomaly. Discriminating benign from malicious here is easier than usual — legitimate Data Hub imports arrive from a small, enumerable set of integration sources, so the source address and the calling identity, not the request body, are the useful filter. On the ABAP side, a DIAG-parsing memory-corruption attempt surfaces as work-process crashes or short dumps clustered on one instance rather than as an authentication event.

UPDATE — the half-patched SharePoint chain this pipeline flagged in July is now complete and public: CVE-2026-63520 ships, and Rapid7 releases the analysis and proof-of-concept for CVE-2026-55040

UPDATE · originally covered July Patch Tuesday follow-through: a SharePoint pre-auth JWT bypass from a Pwn2Own chain (CVE-2026-55040) and a pre-auth Dynamics 365 RCE Microsoft expects to be exploited (CVE-2026-55944) (2026-07-15)

the entry on July's SharePoint pre-auth JWT bypass covered CVE-2026-55040 as one half of a Pwn2Own chain whose second half was still unpatched, and the W29 outlook carried it as an item in motion — a SharePoint chain half-patched until August. Both halves are now disclosed and one of them has public exploit code. Microsoft's August Patch Tuesday published CVE-2026-63520, a remote code execution vulnerability in SharePoint Server, and Rapid7 — whose Senior Principal Security Researcher Stephen Fewer discovered it — states that "this vulnerability is the second in a pair of exploits which, when chained together, comprise a critical unauthenticated remote code execution vulnerability in a vulnerable SharePoint server" (Rapid7, 2026-08-11). The same post records the second half of the release: "Alongside today's coordinated disclosure of CVE-2026-63520, Rapid7 has now published a detailed technical analysis and proof-of-concept for CVE-2026-55040, the first vulnerability in the chain."

The two records read very differently on their own, which is the point of reading them together. Microsoft classes CVE-2026-63520 as improper input validation (CWE-20), CVSS 8.1 with high attack complexity, severity Important, allowing an unauthorised attacker to execute code over a network (MSRC, 2026-08-11). CVE-2026-55040 is the more severe of the pair on its own terms: "Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network", CWE-1390, CVSS 9.1 with low attack complexity and no privileges or user interaction required, severity Critical (MSRC, 2026-08-11). Microsoft records both as not exploited and not publicly disclosed before their patches, and rates both "Exploitation More Likely". Patches exist for SharePoint Server Subscription Edition, 2019 and 2016 (Rapid7, 2026-08-11).

What moves this ahead of the ordinary patch cycle is not a score but the disclosure state. The authentication-bypass half now has published analysis and working proof-of-concept code, and the code-execution half it chains into was documented the same day — so the research cost of reconstructing an unauthenticated RCE against an unpatched on-premises farm has collapsed to reading two public write-ups. Nothing in either advisory reports exploitation yet; the exposure is the window between publication and patch coverage, on a product class whose internet-facing deployments are collaboration portals rather than obscure infrastructure.

That window matters more than usual for this constituency. Two Swiss public-sector SharePoint compromises were disclosed in the last nine days — the Confederation's own IT provider on 4 August and the canton of Graubünden on 5 August, both on-premises estates and both attributed by the affected bodies to the SharePoint flaws disclosed in mid-July. Neither of those intrusions involves the CVEs here, and nothing in the cited sources connects them; the relevance is the estate, not the incident. An organisation that has just rebuilt or re-imaged SharePoint servers in response to the July wave is exactly the organisation whose new builds may predate both the July and August updates, and whose asset inventory for those hosts is least likely to be current.

Detection concepts are constrained by what has been published: neither Microsoft record describes the vulnerable code path, and this entry does not have Rapid7's technical analysis in hand, so behavioural detail beyond the advisories would be invention. What the advisories do support is exposure work rather than detection work — enumerate on-premises SharePoint farms and their patch levels across Subscription Edition, 2019 and 2016, and treat internet-reachable ones as the priority, since both halves of the chain are network-reachable with no authentication and no user interaction. Where a farm's August update cannot be applied immediately, restricting the server's reachability to authenticated internal networks is the control that does not depend on knowing which request shape to look for.

Builds on: 2026-07-19/weekly-w29-looking-ahead

UPDATE — the N-central exploitation has an actor and a payload: Microsoft assesses Storm-1175 is behind it, deploying a new ransomware strain called StormEncryptor from the day the flaw was disclosed

UPDATE · originally covered N-able N-central Hotfix 2 (2026.3.1.10) is mandatory even for instances that already applied Hotfix 1 — and the attackers reached the managed endpoints, not just the server (2026-08-09)

the N-able N-central authentication-bypass chain this pipeline has tracked through two hotfixes now has an assessed actor and a named payload. Microsoft Threat Intelligence reported that "the Storm-1175 group began deploying a new ransomware strain on August 2 called StormEncryptor", and that the group is likely exploiting CVE-2026-18577 in N-central to obtain access (The Record, 2026-08-10). The hedge is Microsoft's own and matters: "Microsoft has not formally confirmed the access vector, but noted that StormEncryptor deployments began the same day the flaw was disclosed" (The Record, 2026-08-10). The same-day correlation is the evidence; a confirmed vector is not yet on the record.

The Record describes the actor as financially motivated and linked to China, and its prior activity is why the attribution changes a defender's calculus rather than just labelling it (The Record, 2026-08-10). Microsoft's own April 2026 profile of the group — which does not itself make a China attribution — describes high-tempo Medusa ransomware operations against vulnerable web-facing assets, and records the group moving from initial access to data exfiltration and ransomware deployment often within a few days and in some cases within 24 hours (Microsoft Threat Intelligence, 2026-04-06). Its earlier Medusa victims were healthcare, professional services and finance organisations in Australia, Britain and the United States; StormEncryptor is the departure from that tooling (The Record, 2026-08-10). Note what those sectors and countries describe: the group's previous victim set, not confirmed victims of this campaign, for which no count has been disclosed.

Two facts sharpen the exposure picture for anyone whose managed service provider runs N-central. N-able states it detected the original flaw in a zero-day attack on 31 July, though it is unclear whether the actor behind that first intrusion was Storm-1175 — the initial patch was bypassed, forcing an emergency hotfix on 2 August and a second on 6 August with the warning that the first was not enough. And the patch gap is wide: after the fixes were available, Huntress found more than half of reachable N-central cloud servers across its partner base still unpatched, with 28.6% of self-hosted instances exposed (The Record, 2026-08-10). Huntress went as far as suggesting that anyone running N-central in a higher-risk environment where exposure cannot meaningfully be reduced may need to consider turning the tool off, while cautioning that doing so costs central visibility, patching and remote access when they may be needed most.

The structural point is the one this constituency should carry: a single compromised RMM server is a gateway to every endpoint it manages, so one breach at one provider cascades across its whole client base. The Record draws the direct comparison to the 2021 Kaseya intrusion, where REvil compromised around 60 direct customers and subsequently hit roughly 1,500 downstream businesses, and to the 2024 ScreenConnect attacks — in which Microsoft says Storm-1175 was among the actors targeting the product (The Record, 2026-08-10).

UPDATE — the exploited Metabase zero-day now has an identifier: CVE-2026-72898 at CVSS 10.0, on CISA KEV since 11 August, with the affected ranges published per release line

UPDATE · originally covered Metabase: an unauthenticated SQL-injection zero-day gave attackers administrator access to BI instances — exploited since 3 August, and no CVE was ever assigned (2026-08-09)

the entry on Metabase's unauthenticated SQL-injection zero-day closed on the observation that no CVE identifier had been assigned, so a purely CVE-driven patch process would not surface the exposure at all. That gap is now closed in both directions. GitHub Security Advisory GHSA-vwf4-m7j8-wcjf assigns CVE-2026-72898 with a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), and Metabase's own advisory text states that "Metabase has confirmed active exploitation of this vulnerability" and that the flaw "allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance" (Metabase, 2026-08-06). CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-08-11 with a 14 August due date (CISA, 2026-08-11).

The second half of the delta is the affected-version matrix, which the vendor's original blog post did not carry in this form. The advisory lists the affected ranges per release line as >= x.58.0 < x.58.23, >= x.59.0 < x.59.20, >= x.60.0 < x.60.16, >= x.61.0 < x.61.10, >= x.62.0 < x.62.8 and >= x.63.0 < x.63.3, and names the patched versions separately as x.58.24, x.59.21, x.60.17, x.61.11, x.62.9 and x.63.5 — note the two lists do not meet, so a build sitting between an affected upper bound and its patched release is not described either way and should be treated as needing the named patched version (Metabase, 2026-08-06). That turns "upgrade Metabase" into a query an asset inventory can answer, and it is what a scanner needed in order to report anything at all.

Nothing here changes the exposure of an instance that has not been upgraded — the exploitation window has been open since at least 3 August per the earlier coverage, and the interim control is unchanged: block the /api/session/reset_password endpoint if an upgrade cannot happen immediately. What changed is visibility, and that is the operationally useful part. An organisation whose vulnerability management runs off CVE identifiers, SBOM matching or KEV feeds got no signal on this flaw for over a week while it was being exploited; the same tooling will now produce a finding on the next scan cycle. The advisory's post-upgrade guidance also stands and is worth re-reading against what an attacker with administrator access would already have taken: revoke active sessions, audit API keys and administrator accounts, and rotate the stored credentials for every connected data source, because those credentials are what an instance-level compromise reaches.

UPDATE — a private-sector ExfilSquad victim confirms a CRM data-exfiltration claim while disputing its severity, after the group published the data it says it took

UPDATE · originally covered UK Department for Education confirms a breach of two public-facing portals and a police legal database, claimed by ExfilSquad — a five-day-old extortion brand whose other 14 claims look fabricated (2026-07-31)

the ExfilSquad campaign — whose leak-site list a threat-intelligence vendor assessed was more likely fabricated than real, but which contained a genuine UK government breach — has produced its first victim to answer on the record in partial terms. Wesco International, a US industrial and electrical distributor, confirmed to BleepingComputer that it is investigating a claim of CRM data exfiltration by a third party, after ExfilSquad claimed 2.6 million records taken from its cloud CRM environment (BleepingComputer, 2026-08-11). The company's spokesperson states "We have worked with our cloud CRM vendor on the matter, and we do not believe that there is a risk to sensitive data", and the company "found no evidence of ransomware or other malicious software on its IT systems", with no business disruption reported.

Two things happened in sequence and both matter. After the deadline for Wesco to enter ransom negotiations expired, ExfilSquad published the data it says it exfiltrated (BleepingComputer, 2026-08-11) — so this is a completed publication event, not a pending threat. And Wesco's posture is a third distinct response pattern from this campaign's victims: the UK Department for Education and the Police National Legal Database both issued full confirmations with corrected scope, other named victims have said nothing at all, and Wesco concedes the incident while contesting its severity. A triage queue that ingests leak-site feeds now has three calibration points from one actor: confirmed-and-detailed, confirmed-but-disputed, and unanswered.

The technical half needs its hedge stated plainly, because the reporting is careful and it would be easy to over-read. What BleepingComputer says is two separate things: that research from Resecurity and VenariX indicates the group "has targeted in the past improperly configured Microsoft Power Pages data tables", and that while Wesco has not shared how it was breached, "publicly available information indicates that Wesco may be using Microsoft Dynamics 365" (BleepingComputer, 2026-08-11). No source joins those two into a finding that this breach used a Dynamics 365 surface, and no source states the group's targeting has widened. The honest read is that the documented mechanism remains anonymously readable Power Pages data tables — no exploit, no malware, just data a portal was configured to serve to anyone — and that this victim's root cause is undisclosed.

Triage: exfiltration through an over-permissioned anonymous web role produces no exploit signature and no malware, so endpoint and network telemetry will be silent by construction — which is consistent with Wesco finding no ransomware or malicious software on its systems while an incident had nonetheless occurred. What it does produce is bulk read volume against Dataverse tables attributed to the anonymous or portal service identity rather than to a named user; the discriminator against a legitimately public portal is the breadth of tables touched and the sequential, high-rate access pattern, not the identity itself, which is supposed to be reading something.

UPDATE — the LegacyHive profile-hijack technique reported here as having no Microsoft fix now has one: CVE-2026-62832, patched 11 August, publicly disclosed and rated 'Exploitation More Likely'

UPDATE · originally covered LegacyHive: a public Windows technique that redirects a profile's Local AppData into the NT Object Manager namespace via offline hive edits, reproduced on fully patched systems (2026-07-29)

the entry on LegacyHive — the Nightmare Eclipse Windows proof-of-concept that LevelBlue reproduced on a fully patched July-2026 build — recorded that the vendor offered no mitigation for that class of abuse. Microsoft's August Patch Tuesday appears to have closed it. CVE-2026-62832 is described in Microsoft's own record as "Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally", scored CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), rated Important, recorded as publicly disclosed before the fix, not exploited, and assessed as "Exploitation More Likely" (MSRC, 2026-08-11).

Microsoft does not name LegacyHive, and the identification is worth attributing precisely rather than assuming. Rapid7 states that between the public disclosure and the advisory FAQ — which describes an authenticated attacker who has credentials for another account and loads another user's registry hive — "the advisory is a solid match for Nightmare Eclipse's description of LegacyHive" (Rapid7, 2026-08-11). That is an assessment by a third party, not a vendor mapping, which is why this entry carries it as such.

The independent detail that makes the match credible comes from the unofficial patch that preceded the official one. 0patch analysed the flaw in July and describes it in the same terms: the vulnerability lies in the Windows User Profile Service, where a time-of-check-to-time-of-use condition lets a local attacker use a symbolic link to confuse the service into loading any user's registry hive instead of the requesting user's, ending up mounted in the attacker's own registry space with read/write permissions. Its root cause, per 0patch, is an access-check fallback: when the service can open the hive file with full access it mounts it under the requesting user's identity using NtLoadKey3, which supports impersonation, but when it cannot, it falls back to the older NtLoadKeyEx without impersonation — so the hive loads with full access as Local System. The consequence 0patch names is the same one the original entry described from the attacker's side: read the target user's stored secrets, or replace paths to trusted executables and DLLs so they run the next time that user logs in (0patch, 2026-07-20).

For anyone who acted on the July coverage, the practical delta is short. The prerequisite is unchanged and still limits the blast radius — the attacker needs a local session plus credentials for a separate account, so this is a post-compromise escalation step rather than an entry point. The August cumulative update supersedes the 0patch micropatch as the remediation, and estates that deployed the community patch were covered in the interval. No action item ships with this entry: the fix arrives inside the ordinary Patch Tuesday cycle, and the entry exists to correct the record on the earlier "no fix available" framing rather than to open new work.

UPDATE — Project CAV3RN now decides per transaction whether to talk directly or relay through Google Apps Script, and a DNS answer's fourth octet is what makes the choice

UPDATE · originally covered Kaspersky corroborates the Cavern/HOLLOWGRAPH cluster, associates it (low confidence) with OilRig (APT34), and details a DNS AAAA-record C2 config-recovery fallback (2026-07-22)

Kaspersky's GReAT team published a further instalment on Project CAV3RN on 2026-08-11, describing it as "a modular espionage framework used against targets in Israel" and expanding on two earlier publications (Kaspersky Securelist, 2026-08-11). The prior entry here covered the framework's DNS-based C2 fallback and Kaspersky's low-confidence association with OilRig. The delta is a channel-selection design that is worth carrying into detection engineering regardless of who operates it.

Kaspersky states: "The main finding is a complex C2 module that uses DNS A-record responses to choose between direct HTTPS and a Google Apps Script relay for each transaction. The same DNS infrastructure can validate and replace the relay deployment ID, allowing the operator to rotate the Google channel" (Kaspersky Securelist, 2026-08-11). The mechanics are specific enough to hunt on. The communication module is a 64-bit DLL compiled with .NET 8 NativeAOT. Before polling for commands or sending a result, it issues an A-record query for a name built from a short random nonce concatenated with a numeric error state, then a hex-encoded client identifier, under a fixed operator-controlled domain. One exact address is treated as a rejection; otherwise the module reads the fourth octet of the answer and maps it, in combination with the current error state, onto direct HTTPS, the Apps Script relay, an exception, or closing the transaction with no channel at all. A recovered Apps Script deployment ID is written back to the module's on-disk configuration, while other configuration changes pushed by the operator stay in memory. The two channels differ in shape as well as destination. On the direct-HTTPS path the module contacts a configured attacker-controlled address whose endpoint is gated on a custom client-identifier HTTP header, returning a failure response to requests without it and an encoded tasking body to requests carrying it. On the Apps Script path the module instead POSTs a JSON envelope to the deployment URL, with the upstream method and the headers to replay — the same client-identifier value among them — carried as fields inside that JSON body rather than as headers on the request to Google. Tasking comes back base64-encoded and XORed either way.

The second new component is an inter-component broker, a 64-bit Visual C++ DLL that masquerades as the RNP OpenPGP library through a set of rnp_* exports, with one of those exports starting the broker. At startup it creates its control structure, initialises a message dispatcher and scans the host directory for DLLs, grouping candidates by their CompanyName resource and loading the highest-versioned member of each group that exposes four specific named exports. It rescans that directory every second, so a component can be added or upgraded without restarting the host — but only by dropping a higher-versioned DLL under a new path, because replacing a file in place is not detected (Kaspersky Securelist, 2026-08-11).

Triage: high-volume DNS lookups under a single parent domain are also how legitimate telemetry agents, CDN clients and some licence checks behave, so the query volume alone is not the signal. The discriminators the described mechanism supports are the label structure — a short changing nonce plus a stable hex-encoded identifier per host, rather than a service-shaped name — and the tight temporal coupling, with one lookup preceding each outbound connection rather than a periodic refresh independent of traffic. Note what is not available as a discriminator on the relay path: the custom client-identifier travels inside the JSON body of a TLS POST to a legitimate Google endpoint, so it is not visible to header inspection or to anything short of TLS interception at the proxy.

Lazarus burned a Windows AFD.sys zero-day (CVE-2026-68820) on European defence targets — FudModule v3.1 blinds the endpoint, and the C2 is other people's Roundcube and WordPress servers

Check Point Research published the technical analysis behind Microsoft's only exploitation-detected August Patch Tuesday entry on 2026-08-11, and the campaign behind it lands squarely on European defence organisations: the firm states its latest Operation Dream Job wave "focuses on the defense sector in Europe and India" and records "successful targeting observed in Western Europe, including France and Germany", with a compromised organisation headquartered in France subsequently reused by the operators to send spear-phishing to further targets worldwide (Check Point Research, 2026-08-11). Check Point attributes the campaign to the DPRK-linked Lazarus group and is careful about the entry point: it says the exact method used to approach victims in this wave remains unclear, and only assesses — from earlier documented Dream Job activity — that targets were likely approached through professional networking platforms or messaging apps (Check Point Research, 2026-08-11).

Background. Operation Dream Job is a long-running recruitment-lure campaign, and the driver at the centre of this intrusion is repeat ground: Check Point notes that FudModule was reported abusing CVE-2024-38193, a use-after-free in the same afd.sys driver, back in 2024, and that this build's post-exploitation behaviour is otherwise close to the FudModule v3 that Gen Digital documented that year — 94 of its hardcoded ETW-provider kill GUIDs match the first 94 entries of Gen's published 95-GUID list, in identical order (Check Point Research, 2026-08-11). What is new is the exploit chain, not the rootkit.

Two delivery chains run in parallel. In the first, the victim opens an encrypted archive holding a legitimate signed PDF-viewer executable, a malicious libmupdf.dll loaded by side-loading, and an encrypted payload carrying a .pdf extension; launching the executable displays a decoy document — Check Point's example impersonates a Lockheed Martin job description — while the DLL decrypts and runs the MISTPEN in-memory downloader, which uses the Microsoft Graph API against OneDrive to pull further modules. In the second and newer chain, victims receive offers impersonating the privacy-technology company Enveil and download "SecurityPDF", a trojanised MuPDF-based viewer whose File→Open and drag-and-drop paths were modified to look for a fixed marker string in any opened PDF, XOR-decrypt the embedded payload with a single-byte key, write it to %TEMP% and launch it as a child process; that stage reflectively loads the previously undocumented Troy backdoor, a 64-bit DLL with 17 operator commands. Check Point identified at least three websites impersonating Enveil distributing the viewer, some ranking at the top of search results, and states explicitly that Enveil itself was neither targeted nor compromised (Check Point Research, 2026-08-11).

The privilege-escalation step is the part with a CVE. After reconnaissance and persistence modules confirm the host is worth keeping, MISTPEN loads an in-memory local privilege-escalation module targeting afd.sys, the Windows Ancillary Function Driver for WinSock. Microsoft's own record describes the flaw as a use-after-free allowing an authorised attacker to elevate privileges locally, scores it CVSS 7.0 with high attack complexity, and marks it exploited but not publicly disclosed before the patch (MSRC, 2026-08-11). Check Point withholds full detail but describes the mechanism: the driver keeps a small piece of per-socket state, and under specific concurrent conditions two of its own code paths operate on that state simultaneously without synchronisation, so one path can access memory the other has already released — a race that yields a kernel read/write primitive and then SYSTEM. It confirmed on a fully patched Windows 11 system that this is a distinct, previously undocumented bug rather than the superficially similar CVE-2025-60719, and dates in-the-wild use to at least early July 2026; the sample carries an explicit minimum-version check for build 26100 (24H2) with support for 26200 (25H2). Check Point reported the issue on 28 July, Microsoft confirmed it on 31 July, assigned the CVE on 5 August and fixed it on 11 August (Check Point Research, 2026-08-11). CISA added it to the Known Exploited Vulnerabilities catalog on 2026-08-11 (CISA, 2026-08-11); Rapid7, writing before that listing appeared, noted the CVSS stayed at 7.0 largely because a stable exploit has to win the race (Rapid7, 2026-08-11).

What FudModule v3.1 does with SYSTEM is the reason this matters more than a 7.0 suggests. Check Point records the full telemetry teardown carried over from v3 — process, thread and image notify callbacks, object and registry callbacks, minifilter removal by altitude band, termination of the NT Kernel Logger, crash-dump suppression first — plus privileged-handle forgery and a two-hop spawn through services.exe into a SYSTEM msiexec.exe. The dedicated Microsoft Defender stage from v3 is gone; Defender is now blinded through the same generic security-product suppression path as any other vendor. The genuinely new capability is Smart App Control tampering: inside that SYSTEM-level msiexec.exe child, the remote stub zeroes a code-integrity policy state value and invokes NtSetSystemInformation with a specific information class to force an in-place reload of the code integrity policy (Check Point Research, 2026-08-11). The final payload differs by chain — ForestTiger, a backdoor Check Point describes as widely attributed to Lazarus, on the sideloading chain; Troy on the trojanised-viewer chain.

The command-and-control choice is deliberate and is where a defender's network telemetry has a chance. Rather than attacker-registered infrastructure, the operators run through compromised Roundcube webmail and content-management servers, reaching the Roundcube instances by combining leaked credentials with the already-public CVE-2025-49113, and plant RelayShell, a PHP webshell that repurposes those servers as relay nodes. Check Point's stated reasoning is that defence-sector networks are heavily monitored, so blending into ordinary web traffic beats standing up new domains (Check Point Research, 2026-08-11).

Detection concepts follow from the mechanics rather than from indicators. The rootkit stage produces a near-simultaneous collapse of kernel-sourced telemetry — callback registrations dropping, ETW providers stopping, minifilters unregistering — and the discriminator is what preceded it: a signed security product's own uninstaller doing this is routine maintenance, the same pattern following a document-viewer process or a SYSTEM msiexec.exe spawned two hops from services.exe is not. MISTPEN's channel is Microsoft Graph against OneDrive, so the anchor is cloud audit and identity telemetry — an endpoint process that has no business calling Graph authenticating to it — not a network signature, since the destination is legitimate Microsoft infrastructure. On the web-server side, RelayShell never executes operator commands in the request path; it splits into victim and operator modes and passes messages through files on disk, so webshell detections that key on command execution inside the HTTP request will not fire, while repeated small POSTs to a plausible-looking static-asset path plus unexplained file churn in the web root will.

Triage: a burst of ETW provider stops, callback deregistrations and minifilter removals is normal when a security product is being upgraded or uninstalled — check the parent process and the account. A vendor-signed uninstaller running under an admin session at a change window is benign; the same teardown originating from a PDF viewer's process tree, or from a SYSTEM msiexec.exe whose grandparent is services.exe with no corresponding software-deployment record, is the signal. Similarly, Graph API calls to OneDrive are ubiquitous — the discriminator is the calling process, not the destination.