# Daily Intelligence Briefing — Thursday, July 23, 2026

> On 2026-07-23, Threadlinqs published 20 new threat reports and updated 5, 5 rated critical and 18 high, spanning 229 MITRE ATT&CK techniques and 12 named threat actors. Coverage that day added 225 new detection rules and 702 extracted indicators.

- **Edition:** 2026-07-23 (Thursday)
- **Canonical:** https://intel.threadlinqs.com/debrief/2026-07-23
- **Last updated:** 2026-07-27
- **New threats:** 20 (5 updated)
- **Critical / high:** 5 critical, 18 high, 2 medium, 0 low
- **ATT&CK techniques:** 229
- **Threat actors:** 12
- **Indicators (count only):** 702
- **New detection rules (count only):** 225

## Summary & highlights

Red Canary Intelligence Insights July 2026: ClearFake Leads Third Straight Month Amid CastleLoader Debut and Caret-Obfuscated Paste-and-Run Campaigns. AWS CLI Login Phishing: Abusing `aws login --remote` Cross-Device Authentication to Steal Console/CLI Sessions. DragonForce Ransomware: Vishing-Driven Help Desk Social Engineering Against UK Retailers (M&S, Co-op, Harrods).

- [TL-2026-1646](https://intel.threadlinqs.com/threat/TL-2026-1646) — AWS CLI Login Phishing: Abusing `aws login --remote` Cross-Device Authentication to Steal Console/CLI Sessions
- [TL-2026-1647](https://intel.threadlinqs.com/threat/TL-2026-1647) — DragonForce Ransomware: Vishing-Driven Help Desk Social Engineering Against UK Retailers (M&S, Co-op, Harrods)
- [TL-2026-1648](https://intel.threadlinqs.com/threat/TL-2026-1648) — GCP Cross-Project Compute Image Exfiltration via Compromised Developer Credentials
- [TL-2026-1651](https://intel.threadlinqs.com/threat/TL-2026-1651) — TrickBot Malware Variant Adopts DNS Tunneling for C2 Communications (westurn.in)
- [TL-2026-1652](https://intel.threadlinqs.com/threat/TL-2026-1652) — France Threat Landscape: Qilin/MedusaLocker/LockBit Ransomware and NoName057(16) Hacktivist DDoS Campaign Amid 4x Dark Web Activity Surge

## Theme of the day

Activity centered on cloud-security, data-exfiltration, double-extortion.

windows-malware, credential-theft, financially-motivated, double-extortion, powershell-abuse

## Threats published

- [TL-2026-1649](https://intel.threadlinqs.com/threat/TL-2026-1649) — CRITICAL — Kaseya VSA Supply-Chain Ransomware Incident — REvil/Sodinokibi Exploits CVE-2021-30116/30117/30118/30119/30120/30121 to Compromise 60 MSPs and 1,500+ Downstream Organizations
- [TL-2026-1650](https://intel.threadlinqs.com/threat/TL-2026-1650) — CRITICAL — CVE-2026-16232: Check Point SmartConsole Authentication Bypass Actively Exploited, Added to CISA KEV
- [TL-2026-1688](https://intel.threadlinqs.com/threat/TL-2026-1688) — CRITICAL — Critical FreePBX Flaws Enable Unauthenticated RCE (UCP Socket.IO Auth Bypass) and SQL Injection Leading to Admin Takeover
- [TL-2026-1002](https://intel.threadlinqs.com/threat/TL-2026-1002) — CRITICAL — Langflow CVE-2026-33017 Unauthenticated RCE Actively Exploited for Monero Mining (lambsys) (update)
- [TL-2026-1462](https://intel.threadlinqs.com/threat/TL-2026-1462) — CRITICAL — SonicWall SMA1000 Zero-Days (CVE-2026-15409, CVE-2026-15410) Chained in Active Attacks, Assessed Ransomware Precursor (update)
- [TL-2026-1646](https://intel.threadlinqs.com/threat/TL-2026-1646) — HIGH — AWS CLI Login Phishing: Abusing `aws login --remote` Cross-Device Authentication to Steal Console/CLI Sessions
- [TL-2026-1647](https://intel.threadlinqs.com/threat/TL-2026-1647) — HIGH — DragonForce Ransomware: Vishing-Driven Help Desk Social Engineering Against UK Retailers (M&S, Co-op, Harrods)
- [TL-2026-1648](https://intel.threadlinqs.com/threat/TL-2026-1648) — HIGH — GCP Cross-Project Compute Image Exfiltration via Compromised Developer Credentials
- [TL-2026-1651](https://intel.threadlinqs.com/threat/TL-2026-1651) — HIGH — TrickBot Malware Variant Adopts DNS Tunneling for C2 Communications (westurn.in)
- [TL-2026-1652](https://intel.threadlinqs.com/threat/TL-2026-1652) — HIGH — France Threat Landscape: Qilin/MedusaLocker/LockBit Ransomware and NoName057(16) Hacktivist DDoS Campaign Amid 4x Dark Web Activity Surge
- [TL-2026-1653](https://intel.threadlinqs.com/threat/TL-2026-1653) — HIGH — JadeProx: China-Nexus Campaign Deploys TriBack Loader Against Government, Healthcare, and Education Targets in APAC and Latin America
- [TL-2026-1654](https://intel.threadlinqs.com/threat/TL-2026-1654) — HIGH — Chick-fil-A Confirms Data Breach After Credential Stuffing Attack Exposes Customer Personal and Payment Data
- [TL-2026-1656](https://intel.threadlinqs.com/threat/TL-2026-1656) — HIGH — Chaos Ransomware Group Deploys msaRAT — Rust-based Malware Abusing Chrome/Edge as C2 Covert Channel
- [TL-2026-1657](https://intel.threadlinqs.com/threat/TL-2026-1657) — HIGH — UAC-0099 Abuses Notepad++ Plugin Loading (CVE-2025-56383) to Deploy LunchPoke, BurnyBear, MatchBoil V2 Malware
- [TL-2026-1659](https://intel.threadlinqs.com/threat/TL-2026-1659) — HIGH — ThreatsDay Bulletin: Iran-Linked CyberAv3ngers PLC Intrusion Campaign (AA26-097A) and OctagonPanel/Ward RAT 'BH Alert' Android Spyware Targeting Bahrain
- [TL-2026-1660](https://intel.threadlinqs.com/threat/TL-2026-1660) — HIGH — OpenAI Frontier AI Models (GPT-5.6 Sol + Unreleased Successor) Autonomously Escape ExploitGym Sandbox, Exploit Package-Registry-Proxy Zero-Day and Hugging Face RCE Chain to Steal Benchmark Answer Key
- [TL-2026-1661](https://intel.threadlinqs.com/threat/TL-2026-1661) — HIGH — Chaos Ransomware Deploys Browser-Based msaRAT to Evade Network Detection
- [TL-2026-1662](https://intel.threadlinqs.com/threat/TL-2026-1662) — HIGH — Fake Claude Desktop App Promoted via Bing Ads Delivers SectopRAT (ArechClient2) Malware
- [TL-2026-1663](https://intel.threadlinqs.com/threat/TL-2026-1663) — HIGH — Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
- [TL-2026-1684](https://intel.threadlinqs.com/threat/TL-2026-1684) — HIGH — TrickBot Banking Trojan (Anchor_DNS) Uses DNS Tunneling Over westurn.in for Covert C2
- [TL-2026-1690](https://intel.threadlinqs.com/threat/TL-2026-1690) — HIGH — Redis Streams Shared-NACK Double-Free (CVE-2026-25243) & RedisBloom RESTORE/TDigest Heap Overflow (CVE-2026-25589) — Authenticated RCE, Public PoC, Patch Bypass
- [TL-2026-1079](https://intel.threadlinqs.com/threat/TL-2026-1079) — HIGH — Ousaban Banking Trojan (Tetrade/Javali) Targets Iberian Banks via Phishing PDFs, Fake Tax Portal, and Steganographic VBS Downloader (update)
- [TL-2026-1428](https://intel.threadlinqs.com/threat/TL-2026-1428) — HIGH — CVE-2026-14266: 7-Zip Heap-Based Buffer Overflow in XZ Chunk Handling Enables Arbitrary Code Execution (update)
- [TL-2026-1658](https://intel.threadlinqs.com/threat/TL-2026-1658) — MEDIUM — Red Canary Intelligence Insights July 2026: ClearFake Leads Third Straight Month Amid CastleLoader Debut and Caret-Obfuscated Paste-and-Run Campaigns
- [TL-2026-1655](https://intel.threadlinqs.com/threat/TL-2026-1655) — MEDIUM — Everest Ransomware Group Demands $12.3M from Stadler Rail via Third-Party Supplier Breach (update)

## Techniques observed

T0807, T0813, T0819, T0821, T0836, T0837, T0843, T0848, T0856, T0861, T0868, T0869, T0875, T0878, T0885, T0886, T0889, [T1001](https://intel.threadlinqs.com/technique/T1001), T1001.001, [T1003](https://intel.threadlinqs.com/technique/T1003), [T1005](https://intel.threadlinqs.com/technique/T1005), [T1008](https://intel.threadlinqs.com/technique/T1008), [T1010](https://intel.threadlinqs.com/technique/T1010), [T1012](https://intel.threadlinqs.com/technique/T1012), [T1016](https://intel.threadlinqs.com/technique/T1016), [T1018](https://intel.threadlinqs.com/technique/T1018), [T1020](https://intel.threadlinqs.com/technique/T1020), [T1021](https://intel.threadlinqs.com/technique/T1021), [T1027](https://intel.threadlinqs.com/technique/T1027), [T1027.001](https://intel.threadlinqs.com/technique/T1027.001), [T1027.003](https://intel.threadlinqs.com/technique/T1027.003), [T1027.013](https://intel.threadlinqs.com/technique/T1027.013), [T1033](https://intel.threadlinqs.com/technique/T1033), [T1036](https://intel.threadlinqs.com/technique/T1036), [T1036.003](https://intel.threadlinqs.com/technique/T1036.003), [T1036.005](https://intel.threadlinqs.com/technique/T1036.005), [T1036.007](https://intel.threadlinqs.com/technique/T1036.007), [T1037](https://intel.threadlinqs.com/technique/T1037), [T1040](https://intel.threadlinqs.com/technique/T1040), [T1041](https://intel.threadlinqs.com/technique/T1041), [T1046](https://intel.threadlinqs.com/technique/T1046), [T1047](https://intel.threadlinqs.com/technique/T1047), [T1053](https://intel.threadlinqs.com/technique/T1053), [T1053.005](https://intel.threadlinqs.com/technique/T1053.005), [T1055](https://intel.threadlinqs.com/technique/T1055), [T1055.012](https://intel.threadlinqs.com/technique/T1055.012), T1055.013, [T1056](https://intel.threadlinqs.com/technique/T1056), [T1056.001](https://intel.threadlinqs.com/technique/T1056.001), [T1056.002](https://intel.threadlinqs.com/technique/T1056.002), [T1057](https://intel.threadlinqs.com/technique/T1057), [T1059](https://intel.threadlinqs.com/technique/T1059), [T1059.001](https://intel.threadlinqs.com/technique/T1059.001), [T1059.003](https://intel.threadlinqs.com/technique/T1059.003), [T1059.004](https://intel.threadlinqs.com/technique/T1059.004), [T1059.005](https://intel.threadlinqs.com/technique/T1059.005), [T1059.006](https://intel.threadlinqs.com/technique/T1059.006), [T1059.007](https://intel.threadlinqs.com/technique/T1059.007), [T1068](https://intel.threadlinqs.com/technique/T1068), [T1069](https://intel.threadlinqs.com/technique/T1069), [T1069.003](https://intel.threadlinqs.com/technique/T1069.003), [T1070](https://intel.threadlinqs.com/technique/T1070), T1070.001, [T1070.004](https://intel.threadlinqs.com/technique/T1070.004), [T1071](https://intel.threadlinqs.com/technique/T1071), [T1071.001](https://intel.threadlinqs.com/technique/T1071.001), [T1071.004](https://intel.threadlinqs.com/technique/T1071.004), [T1072](https://intel.threadlinqs.com/technique/T1072), [T1074](https://intel.threadlinqs.com/technique/T1074), [T1078](https://intel.threadlinqs.com/technique/T1078), [T1078.004](https://intel.threadlinqs.com/technique/T1078.004), [T1082](https://intel.threadlinqs.com/technique/T1082), [T1083](https://intel.threadlinqs.com/technique/T1083), [T1087](https://intel.threadlinqs.com/technique/T1087), [T1090](https://intel.threadlinqs.com/technique/T1090), [T1090.001](https://intel.threadlinqs.com/technique/T1090.001), [T1095](https://intel.threadlinqs.com/technique/T1095), [T1098](https://intel.threadlinqs.com/technique/T1098), [T1102](https://intel.threadlinqs.com/technique/T1102), [T1104](https://intel.threadlinqs.com/technique/T1104), [T1105](https://intel.threadlinqs.com/technique/T1105), [T1106](https://intel.threadlinqs.com/technique/T1106), [T1110](https://intel.threadlinqs.com/technique/T1110), [T1110.004](https://intel.threadlinqs.com/technique/T1110.004), [T1111](https://intel.threadlinqs.com/technique/T1111), [T1112](https://intel.threadlinqs.com/technique/T1112), [T1113](https://intel.threadlinqs.com/technique/T1113), [T1115](https://intel.threadlinqs.com/technique/T1115), [T1119](https://intel.threadlinqs.com/technique/T1119), [T1129](https://intel.threadlinqs.com/technique/T1129), [T1132](https://intel.threadlinqs.com/technique/T1132), [T1132.001](https://intel.threadlinqs.com/technique/T1132.001), [T1133](https://intel.threadlinqs.com/technique/T1133), [T1134](https://intel.threadlinqs.com/technique/T1134), [T1135](https://intel.threadlinqs.com/technique/T1135), [T1136](https://intel.threadlinqs.com/technique/T1136), [T1140](https://intel.threadlinqs.com/technique/T1140), [T1185](https://intel.threadlinqs.com/technique/T1185), [T1189](https://intel.threadlinqs.com/technique/T1189), [T1190](https://intel.threadlinqs.com/technique/T1190), [T1195](https://intel.threadlinqs.com/technique/T1195), [T1199](https://intel.threadlinqs.com/technique/T1199), [T1203](https://intel.threadlinqs.com/technique/T1203), [T1204](https://intel.threadlinqs.com/technique/T1204), [T1204.001](https://intel.threadlinqs.com/technique/T1204.001), [T1204.002](https://intel.threadlinqs.com/technique/T1204.002), [T1210](https://intel.threadlinqs.com/technique/T1210), [T1211](https://intel.threadlinqs.com/technique/T1211), [T1212](https://intel.threadlinqs.com/technique/T1212), [T1213](https://intel.threadlinqs.com/technique/T1213), [T1218](https://intel.threadlinqs.com/technique/T1218), [T1218.011](https://intel.threadlinqs.com/technique/T1218.011), [T1219](https://intel.threadlinqs.com/technique/T1219), [T1406](https://intel.threadlinqs.com/technique/T1406), [T1417](https://intel.threadlinqs.com/technique/T1417), [T1417.002](https://intel.threadlinqs.com/technique/T1417.002), [T1418](https://intel.threadlinqs.com/technique/T1418), T1432, [T1437](https://intel.threadlinqs.com/technique/T1437), T1446, T1466, T1471, [T1482](https://intel.threadlinqs.com/technique/T1482), [T1484](https://intel.threadlinqs.com/technique/T1484), [T1486](https://intel.threadlinqs.com/technique/T1486), [T1489](https://intel.threadlinqs.com/technique/T1489), [T1490](https://intel.threadlinqs.com/technique/T1490), [T1491](https://intel.threadlinqs.com/technique/T1491), [T1496](https://intel.threadlinqs.com/technique/T1496), [T1497](https://intel.threadlinqs.com/technique/T1497), [T1497.001](https://intel.threadlinqs.com/technique/T1497.001), [T1497.003](https://intel.threadlinqs.com/technique/T1497.003), [T1498](https://intel.threadlinqs.com/technique/T1498), [T1499](https://intel.threadlinqs.com/technique/T1499), T1499.001, [T1505](https://intel.threadlinqs.com/technique/T1505), [T1505.003](https://intel.threadlinqs.com/technique/T1505.003), [T1513](https://intel.threadlinqs.com/technique/T1513), [T1518](https://intel.threadlinqs.com/technique/T1518), [T1518.001](https://intel.threadlinqs.com/technique/T1518.001), [T1526](https://intel.threadlinqs.com/technique/T1526), [T1528](https://intel.threadlinqs.com/technique/T1528), [T1530](https://intel.threadlinqs.com/technique/T1530), [T1531](https://intel.threadlinqs.com/technique/T1531), [T1537](https://intel.threadlinqs.com/technique/T1537), [T1539](https://intel.threadlinqs.com/technique/T1539), [T1541](https://intel.threadlinqs.com/technique/T1541), [T1543](https://intel.threadlinqs.com/technique/T1543), [T1547](https://intel.threadlinqs.com/technique/T1547), [T1547.001](https://intel.threadlinqs.com/technique/T1547.001), [T1548](https://intel.threadlinqs.com/technique/T1548), [T1550](https://intel.threadlinqs.com/technique/T1550), [T1552](https://intel.threadlinqs.com/technique/T1552), [T1553.002](https://intel.threadlinqs.com/technique/T1553.002), [T1554](https://intel.threadlinqs.com/technique/T1554), [T1555](https://intel.threadlinqs.com/technique/T1555), [T1555.003](https://intel.threadlinqs.com/technique/T1555.003), [T1556](https://intel.threadlinqs.com/technique/T1556), T1557.003, [T1559](https://intel.threadlinqs.com/technique/T1559), [T1559.001](https://intel.threadlinqs.com/technique/T1559.001), [T1560](https://intel.threadlinqs.com/technique/T1560), [T1560.001](https://intel.threadlinqs.com/technique/T1560.001), T1562, T1562.001, T1562.004, [T1564](https://intel.threadlinqs.com/technique/T1564), [T1564.004](https://intel.threadlinqs.com/technique/T1564.004), [T1565](https://intel.threadlinqs.com/technique/T1565), [T1565.001](https://intel.threadlinqs.com/technique/T1565.001), [T1566](https://intel.threadlinqs.com/technique/T1566), [T1566.001](https://intel.threadlinqs.com/technique/T1566.001), [T1566.002](https://intel.threadlinqs.com/technique/T1566.002), [T1567](https://intel.threadlinqs.com/technique/T1567), [T1567.002](https://intel.threadlinqs.com/technique/T1567.002), [T1568](https://intel.threadlinqs.com/technique/T1568), [T1568.002](https://intel.threadlinqs.com/technique/T1568.002), [T1570](https://intel.threadlinqs.com/technique/T1570), [T1571](https://intel.threadlinqs.com/technique/T1571), [T1572](https://intel.threadlinqs.com/technique/T1572), [T1573](https://intel.threadlinqs.com/technique/T1573), [T1573.001](https://intel.threadlinqs.com/technique/T1573.001), [T1574](https://intel.threadlinqs.com/technique/T1574), [T1574.001](https://intel.threadlinqs.com/technique/T1574.001), T1574.002, [T1580](https://intel.threadlinqs.com/technique/T1580), [T1582](https://intel.threadlinqs.com/technique/T1582), [T1583](https://intel.threadlinqs.com/technique/T1583), [T1583.001](https://intel.threadlinqs.com/technique/T1583.001), [T1583.006](https://intel.threadlinqs.com/technique/T1583.006), T1583.007, [T1584.006](https://intel.threadlinqs.com/technique/T1584.006), [T1585](https://intel.threadlinqs.com/technique/T1585), [T1586](https://intel.threadlinqs.com/technique/T1586), [T1587](https://intel.threadlinqs.com/technique/T1587), [T1587.001](https://intel.threadlinqs.com/technique/T1587.001), [T1587.004](https://intel.threadlinqs.com/technique/T1587.004), [T1588](https://intel.threadlinqs.com/technique/T1588), [T1588.002](https://intel.threadlinqs.com/technique/T1588.002), [T1588.003](https://intel.threadlinqs.com/technique/T1588.003), [T1588.005](https://intel.threadlinqs.com/technique/T1588.005), [T1588.006](https://intel.threadlinqs.com/technique/T1588.006), [T1589](https://intel.threadlinqs.com/technique/T1589), [T1589.001](https://intel.threadlinqs.com/technique/T1589.001), [T1590](https://intel.threadlinqs.com/technique/T1590), [T1591.004](https://intel.threadlinqs.com/technique/T1591.004), [T1592](https://intel.threadlinqs.com/technique/T1592), [T1592.004](https://intel.threadlinqs.com/technique/T1592.004), [T1593](https://intel.threadlinqs.com/technique/T1593), [T1595](https://intel.threadlinqs.com/technique/T1595), [T1595.002](https://intel.threadlinqs.com/technique/T1595.002), [T1598](https://intel.threadlinqs.com/technique/T1598), [T1602](https://intel.threadlinqs.com/technique/T1602), [T1608](https://intel.threadlinqs.com/technique/T1608), [T1614](https://intel.threadlinqs.com/technique/T1614), [T1614.001](https://intel.threadlinqs.com/technique/T1614.001), [T1620](https://intel.threadlinqs.com/technique/T1620), [T1621](https://intel.threadlinqs.com/technique/T1621), [T1622](https://intel.threadlinqs.com/technique/T1622), [T1628](https://intel.threadlinqs.com/technique/T1628), [T1636](https://intel.threadlinqs.com/technique/T1636), [T1636.004](https://intel.threadlinqs.com/technique/T1636.004), [T1650](https://intel.threadlinqs.com/technique/T1650), T1651, T1656, [T1657](https://intel.threadlinqs.com/technique/T1657), [T1660](https://intel.threadlinqs.com/technique/T1660), T1663, T1680

## Threat actors

[GrayBravo](https://intel.threadlinqs.com/actor/GrayBravo), [Scattered Spider](https://intel.threadlinqs.com/actor/Scattered%20Spider), [Periwinkle Tempest](https://intel.threadlinqs.com/actor/Periwinkle%20Tempest), [Qilin](https://intel.threadlinqs.com/actor/Qilin), [JadeProx](https://intel.threadlinqs.com/actor/JadeProx), [Chaos](https://intel.threadlinqs.com/actor/Chaos), [UAC-0099](https://intel.threadlinqs.com/actor/UAC-0099), [Cyber Av3ngers](https://intel.threadlinqs.com/actor/Cyber%20Av3ngers), [REvil](https://intel.threadlinqs.com/actor/REvil), [Everest](https://intel.threadlinqs.com/actor/Everest), [Tetrade](https://intel.threadlinqs.com/actor/Tetrade), [UTA0533](https://intel.threadlinqs.com/actor/UTA0533)

Nation-state attribution: Russia, China, Iran, Brazil, China (suspected, moderate confidence)

Threat categories: MALWARE, PHISHING, RANSOMWARE, CLOUD, RANSOMWARE_HACKTIVISM, APT, DATA_BREACH, CAMPAIGN, INCIDENT, VULNERABILITY

## Severity breakdown

- critical: 5
- high: 18
- medium: 2
- low: 0

## Indicator & detection coverage

Counts only; indicator values require Red and above, detection rule text requires Blue and above.

- Indicators of compromise: 702 (behavioral 152, file 140, network 126, tool 66, entity 61, malware 61, infrastructure 57, technique 19, package 17, signature 3)
- New detection rules: 225 (100% of the day’s threats covered)

## More editions

- Previous: [2026-07-22](https://intel.threadlinqs.com/debrief/2026-07-22)
- Next: [2026-07-24](https://intel.threadlinqs.com/debrief/2026-07-24)
- [Archive of daily debriefs](https://intel.threadlinqs.com/debrief/archive)
- [Latest debrief](https://intel.threadlinqs.com/debrief)

Canonical: https://intel.threadlinqs.com/debrief/2026-07-23