Reporting Period	Classification	Generated
2026-06-28 (24h)	TLP:CLEAR	2026-06-29

1. Executive Summary

The pipeline processed 84 reports from 11 named sources across two correlation batches. The dominant theme is active exploitation of critical vulnerabilities in widely deployed enterprise software: BleepingComputer confirms in-the-wild abuse of SimpleHelp (CVE-2026-48558) to deploy a new cross-platform infostealer named Djinn Stealer, and Oracle E-Business Suite (CVE-2026-46817) is now being weaponised in attacks against financial systems. Wiz separately disclosed a critical Broken Object-Level Authorization (BOLA) flaw in an airline’s GraphQL booking API allowing unauthenticated passenger-record access and modification. Ransomware leak-site activity remains heavy, with Qilin, DragonForce, Stormous, and Anubis collectively responsible for the majority of high-severity entries. On the geopolitical front, the US State Department is offering up to $10 million for information on Russian FSB-linked clusters UNC5792 and UNC4221, which are stealing Signal and WhatsApp backup recovery keys from government and journalist targets.

2. Severity Distribution

Severity	Count	Key Drivers
🔴 CRITICAL	3	SimpleHelp (CVE-2026-48558) + Djinn Stealer; Oracle E-Business Suite (CVE-2026-46817); airline GraphQL BOLA
🟠 HIGH	45	Qilin/DragonForce/Stormous/Anubis ransomware leaks; libssh2, nghttp2, Nmap CVEs; UNC5792/UNC4221 reward; Linux container-escape exploit chatter
🟡 MEDIUM	9	Telegram proxy distribution; Eraleign (APT73) recycled-data claims; FIFA streaming-domain seizures; AI governance gap
🟢 LOW	5	Windows Server 2022 hotpatching extension; Wiz Sensor Workload Scanner GA
🔵 INFO	22	Background ransomware infrastructure telemetry

3. Priority Intelligence Items

3.1 SimpleHelp Critical Flaw (CVE-2026-48558) Exploited to Drop Djinn Stealer

Source: BleepingComputer

Attackers are actively exploiting a critical vulnerability in the SimpleHelp remote-support platform to deploy Djinn Stealer, a previously undocumented cross-platform infostealer that runs on Windows, macOS, and Linux. The exploit allows arbitrary code execution via a crafted request to the SimpleHelp service. Djinn Stealer is designed to harvest browser credentials, cryptocurrency wallet data, and contact information; the parallel “TaskWeaver” malware referenced in source coverage suggests a broader tooling ecosystem. SimpleHelp is widely used by MSPs, making downstream tenant compromise a realistic outcome.

Mapped TTPs: T1071 — Application Layer Protocol; T1204 — User Execution.

SOC Action: Inventory all internet-facing SimpleHelp instances and patch immediately. Query EDR for unusual child processes spawned by the SimpleHelp service account and for outbound connections from SimpleHelp hosts to non-vendor destinations. Hunt for cross-platform stealer artefacts (clipboard hooks, wallet directory enumeration, browser credential store reads).

3.2 Oracle E-Business Suite (CVE-2026-46817) Now Exploited in Attacks

Source: BleepingComputer

Threat intelligence firm Defused has observed in-the-wild exploitation of CVE-2026-46817, a critical flaw in Oracle E-Business Suite that grants unauthorised access to financial data and workflows. Oracle EBS underpins core finance/ERP processes at large enterprises and government entities, so successful exploitation enables data theft, fraudulent transaction insertion, and lateral pivots into adjacent identity and database tiers.

Mapped TTPs: T1190 — Exploitation of Public-Facing Application; T1566 — Phishing (likely follow-on access vector).

SOC Action: Apply Oracle’s emergency advisory patch on all EBS application and middleware tiers. Review EBS audit logs for anomalous logins, AP/AR module changes, and any new admin user creation in the last 14 days. Segment EBS application servers from general user VLANs and require step-up authentication for finance-module access.

3.3 Airline GraphQL BOLA — Unauthenticated Passenger Data Exposure (Wiz)

Source: Wiz

Wiz’s “Red Agent” autonomous testing platform discovered a critical Broken Object-Level Authorization (BOLA) flaw in an airline’s GraphQL booking API. Sequential integer booking identifiers combined with missing resolver-layer authorization checks allowed an anonymous session to read two years of passenger records (names, DOB, billing addresses, masked card data, live itineraries) and to mutate bookings — including altering contact emails to hijack accounts, deleting flight segments, splitting passengers from groups, overriding prices to zero, and issuing refunds to arbitrary accounts. BOLA currently holds the #1 spot on the OWASP API Security Top 10.

Mapped TTPs: T1068 — Exploitation for Privilege Escalation; T1071.001 — Web Protocols; T1105 — Ingress Tool Transfer.

SOC Action: Audit all GraphQL and REST APIs for sequential or guessable identifiers in object lookups. Implement resolver-layer authorization checks that bind every object access to the authenticated principal, not only front-end session tokens. Rate-limit and anomaly-monitor sequential-ID enumeration patterns at the API gateway.

3.4 US Offers $10M for Russian UNC5792 / UNC4221 Targeting Signal and WhatsApp

Source: Recorded Future News

The US State Department’s Rewards for Justice programme is offering up to $10 million for information identifying members of two FSB-, Border Guards-, and military-intelligence-linked clusters tracked as UNC5792 and UNC4221. The FBI warns the campaigns are evolving away from messaging-platform CVEs and toward theft of backup recovery keys, which remain valid even after a victim re-registers the same phone number. Tactics include phishing for verification codes/PINs, impersonating platform support, and altering legitimate Signal group invite pages to redirect victims to attacker-controlled link-pair flows. Ukraine’s SBU disclosed a parallel long-running campaign against officials, military, politicians, and activists across Ukraine, Europe, and the US.

Mapped TTPs: T1566 — Phishing; T1193 — Spearphishing Attachment / Client Execution.

SOC Action: Push internal guidance to high-risk personnel (executives, legal, comms, M&A, government-facing roles): never share Signal/WhatsApp verification codes, PINs, or backup recovery passphrases; verify group invitation links through a side channel; treat unsolicited “support” outreach as hostile by default. Inventory devices linked to executive Signal/WhatsApp accounts and revoke unrecognised sessions.

3.5 Ransomware Surge — Qilin, DragonForce, Stormous, Anubis Dominate Leak Sites

Sources: RansomLook (Qilin), RansomLook (DragonForce), RansomLook (Stormous), RansomLook (Anubis)

Qilin alone accounted for at least 14 new leak-site posts in the period, spanning fashion (Kunert), higher education (Musashino University), telecoms (GSMA), manufacturing (Metal Sur Famin, Lam Soon), retail/services (Bristol Place, 1-800-Dentist, Transcore, NASCO, Axionlog), and others. DragonForce posted five fresh victims across manufacturing, retail, and pharma (medipakpharma.com, stni.co.kr, hwaseng, agroprime, vipimaging). Stormous published a multi-domain dump (>10 GB) against the maglificioliliana.com parent group plus Higuchi Inc. (Japan/USA), eogb.co.uk, eshacloudqa.com, monoprix.tn, and palatineschool.org, exfiltrating Microsoft Dynamics GP, Sage 50, customer databases, contracts, and HR data. Anubis named ESMS Global Limited and Boston Orthotics & Prosthetics, combining ransomware with credential theft via phishing and unpatched-vulnerability access. 3AM (Rust-based, double-extortion via Quick Assist vishing) also posted guardianbarrierservices.com.

Mapped TTPs: T1566 — Phishing (initial access); T1486 — Data Encrypted for Impact; T1041 — Exfiltration Over C2 Channel; T1071 — Application Layer Protocol; T1219 — Remote Access Software (Quick Assist abuse by 3AM).

Indicators of Compromise

Ransomware extensions/markers:
  .threeamtime (3AM ransomware marker 0x666)

Tactics indicators:
  Quick Assist vishing → backdoor staging (3AM)
  Anubis ransom-note delivery via Tor
  DragonForce RaaS affiliate portal (custom-branded payloads)
  Stormous data-dump infrastructure (multiple .onion leak hosts — defanged)

SOC Action: Block or strongly restrict Microsoft Quick Assist (quickassist.exe) for non-IT users via AppLocker/WDAC; alert on any Quick Assist process spawning PowerShell, cmd, or installer binaries. Hunt for .threeamtime extensions and Volume Shadow Copy deletion (vssadmin delete shadows). For Stormous-exposed sectors (manufacturing, retail, food, education), validate offline backups, ensure Microsoft Dynamics GP and Sage 50 admin accounts use phishing-resistant MFA, and rotate any service credentials shared across the affected estate.

3.6 Supporting Vulnerabilities Disclosed (Linux Kernel, libssh2, nghttp2, Nmap)

Source: Microsoft Security Response Center — multiple advisories (MSRC)

Microsoft mirrored a batch of upstream advisories: libssh2 integer overflow and uninitialized-pointer free in the publickey subsystem (CVE-2026-58050, CVE-2026-58051); nghttp2/nghttpx HTTP request/response smuggling via Upgrade with Content-Length (CVE-2026-58055); Nmap integer underflow in IPv6 extension-header parsing (CVE-2026-58058); and Linux-kernel issues in RDMA rereg_mr access checks (CVE-2026-52908), ip6_vti namespace immutability (CVE-2026-52909), and bpf reuseport_cBPF RCU lifetime (CVE-2026-52910). Separately, unverified Telegram chatter referenced an IPV6_FRAG_ESCAPE Linux LPE / jail-and-container-escape exploit — treat as unconfirmed.

SOC Action: Prioritise patching libssh2 (any application embedding it for SFTP/SSH client functionality) and nghttp2-fronted services. Refresh Nmap on scanner hosts. For the Linux LPE/container-escape rumour, monitor kernel CVE feeds and enforce seccomp/AppArmor on multi-tenant nodes until upstream confirms or denies.

4. AI-Identified Correlation Trends

Risk	Trend	Supporting Evidence
🔴 CRITICAL	Exploitation of critical vulnerabilities in widely-used software	SimpleHelp CVE-2026-48558 + Djinn Stealer; Oracle EBS CVE-2026-46817
🟠 HIGH	Increased ransomware activity targeting multiple sectors with overlapping TTPs (T1566 phishing → T1071 C2)	Qilin (Kunert, Musashino, Metal Sur, Lam Soon, Bristol Place, GSMA); DragonForce cluster
🟠 HIGH	Ransomware-group sector overlap across education, healthcare, manufacturing	Qilin/Anubis/DragonForce victims in education + healthcare; DragonForce + Eraleign in manufacturing
🟡 MEDIUM	Phishing campaigns leveraging Telegram proxies to anonymise C2 and lure delivery	Multiple @Turbotelproxy and hajhossein.observer-themed proxy posts; UNC5792/UNC4221 Signal/WhatsApp phishing
🟠 HIGH	Nation-state targeting of encrypted-messaging metadata via account-recovery theft (T1566)	UNC5792, UNC4221 — Signal/WhatsApp backup recovery key theft

5. Trending Entities (Pipeline-Wide)

Threat Actors

• The Gentlemen (84 reports) — recent maritime/defence sector targeting; still active across pipeline window.
• Qilin (76 reports) — RaaS dominating today’s leak-site posts; sectors include education, manufacturing, fashion, telecoms.
• Deadlock (55 reports) — sustained mid-June activity, quiet today.
• Lockbit5 (39 reports) — June-9 onwards; no new posts today.
• Akira (30 reports) — broad-sector double-extortion presence.
• DragonForce (27 reports) — 5 fresh victims today across manufacturing/pharma/retail.
• ShinyHunters / Shinyhunters (20 + 18 reports) — data-broker / dump-shop activity.
• Nova (20 reports) — ongoing ransomware operations.
• Nightspire (18 reports) — RaaS with steady mid-June activity.

Malware Families

• RansomLook (141 reports) — pipeline-source label (parser tag, not a malware family in itself).
• Tox / Tox1 (44 + 64 reports) — protocol used as ransomware affiliate comms (Qilin, Anubis, others).
• Akira ransomware (15 reports) — active across pipeline window.
• Lockbit5 (14 reports) — successor branding chatter.
• Qilin (12 reports) — RaaS payload variants.
• Anubis ransomware (9 reports) — including today’s Boston Orthotics and ESMS Global posts.
• Djinn Stealer (new today) — cross-platform infostealer delivered via SimpleHelp exploit.
• 3AM — Rust-based ransomware (.threeamtime extension), Quick Assist vishing chain.

6. Source Distribution

Source	Reports	URL	Notes
RansomLook	36	link	Ransomware leak-site aggregator; Qilin/DragonForce/Stormous coverage
Unknown (Telegram OSINT)	18	—	Telegram proxy / channel chatter; channel names redacted per policy
BleepingComputer	8	link	Primary coverage of SimpleHelp and Oracle EBS exploitation
Microsoft	7	link	Linux-kernel, libssh2, nghttp2, Nmap CVE advisories
RecordedFutures	4	link	UNC5792/UNC4221 reward; nation-state coverage
Wiz	3	link	Red Agent autonomous testing; airline GraphQL BOLA
SANS	2	link	ISC daily diary
AlienVault	2	link	PasasteSinTAG phishing domain rotation (Chile)
Schneier	2	—	RSA weak-key factorisation research
Wired Security	1	link	General security coverage
Upwind	1	link	AI governance runtime-enforcement commentary

7. Consolidated Recommendations

• 🔴 IMMEDIATE: Patch SimpleHelp (CVE-2026-48558) and Oracle E-Business Suite (CVE-2026-46817) on every instance; hunt for Djinn Stealer indicators (cross-platform credential/wallet exfil) and anomalous EBS finance-module activity within the last 14 days. (Section 3.1, 3.2)
• 🔴 IMMEDIATE: Audit all internal and customer-facing GraphQL and REST APIs for resolver-layer authorization gaps — specifically sequential-ID lookups without per-principal object ownership checks. (Section 3.3)
• 🟠 SHORT-TERM: Restrict or block Microsoft Quick Assist for non-IT staff and alert on quickassist.exe spawning interpreters; this directly mitigates the 3AM ransomware Quick-Assist vishing chain. (Section 3.5)
• 🟠 SHORT-TERM: Brief high-risk personnel (executives, journalists, government-facing staff) on UNC5792/UNC4221 TTPs against Signal and WhatsApp; revoke unrecognised linked devices and never share verification codes or backup recovery passphrases. (Section 3.4)
• 🟡 AWARENESS: Patch libssh2 (CVE-2026-58050/58051), nghttp2 (CVE-2026-58055), and Nmap (CVE-2026-58058); track unverified IPV6_FRAG_ESCAPE Linux LPE chatter. (Section 3.6)
• 🟢 STRATEGIC: Add API resolver-layer authorization, sequential-ID anomaly monitoring, and OWASP API Top-10 coverage to the application-security programme; ransomware response runbooks should assume RaaS affiliate model (multi-brand exfiltration + leak-site extortion). (Sections 3.3, 3.5)

---

This brief was generated entirely by AI from automated threat intelligence collection and correlation pipelines, made up of 84 reports processed across 2 correlation batches. A human analyst reviewed and approved this report before publication, but AI-generated analysis may contain errors in attribution, severity assessment, or indicator extraction. Always verify IOCs, CVE details, and threat actor attribution against primary sources before taking operational action.