# Daily Intelligence Briefing — Wednesday, July 29, 2026

> On 2026-07-29, Threadlinqs published 20 new threat reports and updated 4, 11 rated critical and 10 high, spanning 221 MITRE ATT&CK techniques and 6 named threat actors. Coverage that day added 216 new detection rules and 847 extracted indicators.

- **Edition:** 2026-07-29 (Wednesday)
- **Canonical:** https://intel.threadlinqs.com/debrief/2026-07-29
- **Last updated:** 2026-08-04
- **New threats:** 20 (4 updated)
- **Critical / high:** 11 critical, 10 high, 2 medium, 1 low
- **ATT&CK techniques:** 221
- **Threat actors:** 6
- **Indicators (count only):** 847
- **New detection rules (count only):** 216

## Summary & highlights

AI-Generated Extortion: Fabricated Data-Leak Sites 0APT and ALP-001 Impersonate Ransomware Groups. Nine-Year Fraud Campaign Clones Russian Company Sites to Steal Advance Payments. Research: Android ML Malware Detectors Collapse Without Context-Stage Analysis (PRAXIS vs. Drebin, MalScan, MsDroid, MaskDroid, LAMD, ForeDroid).

- [TL-2026-1751](https://intel.threadlinqs.com/threat/TL-2026-1751) — US FCC Bans Imported Advanced Robots Over Supply-Chain Risk and UniPwn-Class Takeover Vulnerabilities (CVE-2025-35027)
- [TL-2026-1757](https://intel.threadlinqs.com/threat/TL-2026-1757) — Flying Eagle Android RAT: Leaked Source Code Powers 170 Active C2 Servers, Successor "Night Dragon" Emerges
- [TL-2026-1758](https://intel.threadlinqs.com/threat/TL-2026-1758) — Tengu: New Mirai-Variant Botnet Targeting Linux IoT and Android TV Devices via Telnet Brute-Force
- [TL-2026-1806](https://intel.threadlinqs.com/threat/TL-2026-1806) — GitLab Patches 13 Security Flaws (incl. CVE-2026-6267, CVE-2026-12436) Enabling Data Exposure, CI/CD Tampering, and DoS
- [TL-2026-1811](https://intel.threadlinqs.com/threat/TL-2026-1811) — AI-Generated Phishing Shifts to Malware-Free In-Browser AiTM Session Theft

## Theme of the day

remote-code-execution, patch-management, security-advisory, credential-theft, critical-severity

## Threats published

- [TL-2026-1752](https://intel.threadlinqs.com/threat/TL-2026-1752) — CRITICAL — Fastjson2 AutoType Whitelist Bypass Leads to Unauthenticated Remote Code Execution (Fastjson2 <= 2.0.62)
- [TL-2026-1755](https://intel.threadlinqs.com/threat/TL-2026-1755) — CRITICAL — CVE-2026-66066 "KindaRails2Shell": Critical Ruby on Rails Active Storage Flaw Allows Unauthenticated Arbitrary File Read / RCE via libvips Image Processing
- [TL-2026-1756](https://intel.threadlinqs.com/threat/TL-2026-1756) — CRITICAL — CVE-2026-6516: Unauthenticated Remote Code Execution in ManageEngine ADAudit Plus (CVSS 10.0)
- [TL-2026-1759](https://intel.threadlinqs.com/threat/TL-2026-1759) — CRITICAL — CVE-2026-20316: Cisco Secure Firewall Management Center Hard-coded Password Vulnerability Added to CISA KEV
- [TL-2026-1760](https://intel.threadlinqs.com/threat/TL-2026-1760) — CRITICAL — Amazon: North Korea's Sapphire Sleet (Stardust Chollima/UNC1069) Compromises Axios, Debug, Chalk, and Typo-Crypto npm Packages in Supply-Chain Campaign
- [TL-2026-1762](https://intel.threadlinqs.com/threat/TL-2026-1762) — CRITICAL — CVE-2026-59726 (RufRoot): Unauthenticated RCE in Ruflo MCP Bridge Poisons AI Agent Memory
- [TL-2026-1763](https://intel.threadlinqs.com/threat/TL-2026-1763) — CRITICAL — Russian TA488 (Void Blizzard / Laundry Bear) Exploits Exchange OWA Zero-Day (CVE-2026-42897) with OWAReaper Backdoor for Long-Term Mailbox Access
- [TL-2026-1764](https://intel.threadlinqs.com/threat/TL-2026-1764) — CRITICAL — Three Critical VMware Flaws (CVE-2026-59309, CVE-2026-59310, CVE-2026-47876) Allow Auth Bypass, RCE, and VM Escape
- [TL-2026-1767](https://intel.threadlinqs.com/threat/TL-2026-1767) — CRITICAL — Gitea Remote Code Execution via diffpatch Git Hook Installation (CVE-2026-60004)
- [TL-2026-1391](https://intel.threadlinqs.com/threat/TL-2026-1391) — CRITICAL — F5 Patches Multiple NGINX Vulnerabilities: Heap Overflow, Memory Disclosure, and Use-After-Free (CVE-2026-42533, CVE-2026-60005, CVE-2026-56434) (update)
- [TL-2026-1650](https://intel.threadlinqs.com/threat/TL-2026-1650) — CRITICAL — CVE-2026-16232: Check Point SmartConsole Authentication Bypass Actively Exploited, Added to CISA KEV (update)
- [TL-2026-1751](https://intel.threadlinqs.com/threat/TL-2026-1751) — HIGH — US FCC Bans Imported Advanced Robots Over Supply-Chain Risk and UniPwn-Class Takeover Vulnerabilities (CVE-2025-35027)
- [TL-2026-1757](https://intel.threadlinqs.com/threat/TL-2026-1757) — HIGH — Flying Eagle Android RAT: Leaked Source Code Powers 170 Active C2 Servers, Successor "Night Dragon" Emerges
- [TL-2026-1758](https://intel.threadlinqs.com/threat/TL-2026-1758) — HIGH — Tengu: New Mirai-Variant Botnet Targeting Linux IoT and Android TV Devices via Telnet Brute-Force
- [TL-2026-1806](https://intel.threadlinqs.com/threat/TL-2026-1806) — HIGH — GitLab Patches 13 Security Flaws (incl. CVE-2026-6267, CVE-2026-12436) Enabling Data Exposure, CI/CD Tampering, and DoS
- [TL-2026-1811](https://intel.threadlinqs.com/threat/TL-2026-1811) — HIGH — AI-Generated Phishing Shifts to Malware-Free In-Browser AiTM Session Theft
- [TL-2026-1814](https://intel.threadlinqs.com/threat/TL-2026-1814) — HIGH — Russian FSB/GRU Actors (UNC5792, UNC4221) Phish Signal Backup Recovery Keys for Persistent Account Takeover
- [TL-2026-1815](https://intel.threadlinqs.com/threat/TL-2026-1815) — HIGH — SplitVPN (formerly NotVPN) Breach Exposes 58M Connection Logs, 23.4M User Records Despite 'No Logs' Claims
- [TL-2026-1821](https://intel.threadlinqs.com/threat/TL-2026-1821) — HIGH — CVE-2026-66723: Missing Authorization in MWDB Core Remote Instances Proxy API
- [TL-2026-0524](https://intel.threadlinqs.com/threat/TL-2026-0524) — HIGH — DirtyDecrypt / DirtyCBC — Linux Kernel rxgk Root LPE with Public PoC (CVE-2026-31635) (update)
- [TL-2026-1555](https://intel.threadlinqs.com/threat/TL-2026-1555) — HIGH — HollowGraph Malware Abuses Microsoft 365 Calendars for Covert C2 via Graph API (update)
- [TL-2026-1761](https://intel.threadlinqs.com/threat/TL-2026-1761) — MEDIUM — AI-Generated Extortion: Fabricated Data-Leak Sites 0APT and ALP-001 Impersonate Ransomware Groups
- [TL-2026-1765](https://intel.threadlinqs.com/threat/TL-2026-1765) — MEDIUM — Nine-Year Fraud Campaign Clones Russian Company Sites to Steal Advance Payments
- [TL-2026-1753](https://intel.threadlinqs.com/threat/TL-2026-1753) — LOW — Research: Android ML Malware Detectors Collapse Without Context-Stage Analysis (PRAXIS vs. Drebin, MalScan, MsDroid, MaskDroid, LAMD, ForeDroid)

## Techniques observed

[T1001](https://intel.threadlinqs.com/technique/T1001), [T1003](https://intel.threadlinqs.com/technique/T1003), [T1005](https://intel.threadlinqs.com/technique/T1005), [T1007](https://intel.threadlinqs.com/technique/T1007), [T1008](https://intel.threadlinqs.com/technique/T1008), [T1012](https://intel.threadlinqs.com/technique/T1012), [T1016](https://intel.threadlinqs.com/technique/T1016), [T1018](https://intel.threadlinqs.com/technique/T1018), [T1020](https://intel.threadlinqs.com/technique/T1020), [T1021](https://intel.threadlinqs.com/technique/T1021), [T1021.002](https://intel.threadlinqs.com/technique/T1021.002), [T1027](https://intel.threadlinqs.com/technique/T1027), [T1027.002](https://intel.threadlinqs.com/technique/T1027.002), T1029, [T1033](https://intel.threadlinqs.com/technique/T1033), [T1036](https://intel.threadlinqs.com/technique/T1036), [T1036.004](https://intel.threadlinqs.com/technique/T1036.004), [T1036.005](https://intel.threadlinqs.com/technique/T1036.005), [T1037.004](https://intel.threadlinqs.com/technique/T1037.004), [T1041](https://intel.threadlinqs.com/technique/T1041), [T1046](https://intel.threadlinqs.com/technique/T1046), [T1047](https://intel.threadlinqs.com/technique/T1047), [T1048](https://intel.threadlinqs.com/technique/T1048), [T1049](https://intel.threadlinqs.com/technique/T1049), [T1053](https://intel.threadlinqs.com/technique/T1053), [T1053.003](https://intel.threadlinqs.com/technique/T1053.003), [T1053.005](https://intel.threadlinqs.com/technique/T1053.005), [T1055](https://intel.threadlinqs.com/technique/T1055), [T1056](https://intel.threadlinqs.com/technique/T1056), [T1057](https://intel.threadlinqs.com/technique/T1057), [T1059](https://intel.threadlinqs.com/technique/T1059), [T1059.001](https://intel.threadlinqs.com/technique/T1059.001), [T1059.004](https://intel.threadlinqs.com/technique/T1059.004), [T1059.007](https://intel.threadlinqs.com/technique/T1059.007), [T1068](https://intel.threadlinqs.com/technique/T1068), [T1069](https://intel.threadlinqs.com/technique/T1069), [T1070](https://intel.threadlinqs.com/technique/T1070), T1070.002, [T1070.003](https://intel.threadlinqs.com/technique/T1070.003), [T1071](https://intel.threadlinqs.com/technique/T1071), [T1071.001](https://intel.threadlinqs.com/technique/T1071.001), [T1074.001](https://intel.threadlinqs.com/technique/T1074.001), [T1078](https://intel.threadlinqs.com/technique/T1078), [T1078.001](https://intel.threadlinqs.com/technique/T1078.001), [T1078.002](https://intel.threadlinqs.com/technique/T1078.002), [T1078.004](https://intel.threadlinqs.com/technique/T1078.004), [T1082](https://intel.threadlinqs.com/technique/T1082), [T1083](https://intel.threadlinqs.com/technique/T1083), [T1087](https://intel.threadlinqs.com/technique/T1087), [T1087.002](https://intel.threadlinqs.com/technique/T1087.002), [T1090](https://intel.threadlinqs.com/technique/T1090), [T1090.002](https://intel.threadlinqs.com/technique/T1090.002), [T1098](https://intel.threadlinqs.com/technique/T1098), [T1098.005](https://intel.threadlinqs.com/technique/T1098.005), [T1102](https://intel.threadlinqs.com/technique/T1102), [T1102.002](https://intel.threadlinqs.com/technique/T1102.002), [T1104](https://intel.threadlinqs.com/technique/T1104), [T1105](https://intel.threadlinqs.com/technique/T1105), [T1106](https://intel.threadlinqs.com/technique/T1106), [T1110](https://intel.threadlinqs.com/technique/T1110), [T1110.001](https://intel.threadlinqs.com/technique/T1110.001), [T1110.002](https://intel.threadlinqs.com/technique/T1110.002), [T1111](https://intel.threadlinqs.com/technique/T1111), [T1113](https://intel.threadlinqs.com/technique/T1113), [T1114](https://intel.threadlinqs.com/technique/T1114), [T1119](https://intel.threadlinqs.com/technique/T1119), [T1120](https://intel.threadlinqs.com/technique/T1120), [T1123](https://intel.threadlinqs.com/technique/T1123), [T1125](https://intel.threadlinqs.com/technique/T1125), [T1129](https://intel.threadlinqs.com/technique/T1129), [T1132](https://intel.threadlinqs.com/technique/T1132), [T1132.001](https://intel.threadlinqs.com/technique/T1132.001), [T1133](https://intel.threadlinqs.com/technique/T1133), [T1135](https://intel.threadlinqs.com/technique/T1135), [T1136](https://intel.threadlinqs.com/technique/T1136), [T1140](https://intel.threadlinqs.com/technique/T1140), [T1176](https://intel.threadlinqs.com/technique/T1176), [T1187](https://intel.threadlinqs.com/technique/T1187), [T1189](https://intel.threadlinqs.com/technique/T1189), [T1190](https://intel.threadlinqs.com/technique/T1190), [T1195](https://intel.threadlinqs.com/technique/T1195), [T1195.002](https://intel.threadlinqs.com/technique/T1195.002), [T1199](https://intel.threadlinqs.com/technique/T1199), [T1203](https://intel.threadlinqs.com/technique/T1203), [T1204](https://intel.threadlinqs.com/technique/T1204), [T1204.001](https://intel.threadlinqs.com/technique/T1204.001), [T1210](https://intel.threadlinqs.com/technique/T1210), [T1211](https://intel.threadlinqs.com/technique/T1211), [T1212](https://intel.threadlinqs.com/technique/T1212), [T1213](https://intel.threadlinqs.com/technique/T1213), [T1217](https://intel.threadlinqs.com/technique/T1217), [T1219](https://intel.threadlinqs.com/technique/T1219), [T1406](https://intel.threadlinqs.com/technique/T1406), [T1407](https://intel.threadlinqs.com/technique/T1407), T1412, [T1417](https://intel.threadlinqs.com/technique/T1417), [T1426](https://intel.threadlinqs.com/technique/T1426), [T1429](https://intel.threadlinqs.com/technique/T1429), [T1430](https://intel.threadlinqs.com/technique/T1430), [T1437](https://intel.threadlinqs.com/technique/T1437), T1444, [T1453](https://intel.threadlinqs.com/technique/T1453), T1476, [T1485](https://intel.threadlinqs.com/technique/T1485), [T1486](https://intel.threadlinqs.com/technique/T1486), [T1489](https://intel.threadlinqs.com/technique/T1489), [T1490](https://intel.threadlinqs.com/technique/T1490), [T1496](https://intel.threadlinqs.com/technique/T1496), [T1497](https://intel.threadlinqs.com/technique/T1497), [T1497.001](https://intel.threadlinqs.com/technique/T1497.001), [T1498.001](https://intel.threadlinqs.com/technique/T1498.001), [T1499](https://intel.threadlinqs.com/technique/T1499), T1499.001, [T1499.003](https://intel.threadlinqs.com/technique/T1499.003), [T1499.004](https://intel.threadlinqs.com/technique/T1499.004), [T1505](https://intel.threadlinqs.com/technique/T1505), [T1505.003](https://intel.threadlinqs.com/technique/T1505.003), [T1512](https://intel.threadlinqs.com/technique/T1512), [T1513](https://intel.threadlinqs.com/technique/T1513), [T1516](https://intel.threadlinqs.com/technique/T1516), [T1518](https://intel.threadlinqs.com/technique/T1518), [T1521](https://intel.threadlinqs.com/technique/T1521), [T1526](https://intel.threadlinqs.com/technique/T1526), [T1528](https://intel.threadlinqs.com/technique/T1528), [T1529](https://intel.threadlinqs.com/technique/T1529), [T1530](https://intel.threadlinqs.com/technique/T1530), [T1533](https://intel.threadlinqs.com/technique/T1533), [T1534](https://intel.threadlinqs.com/technique/T1534), [T1539](https://intel.threadlinqs.com/technique/T1539), [T1541](https://intel.threadlinqs.com/technique/T1541), [T1543](https://intel.threadlinqs.com/technique/T1543), [T1543.002](https://intel.threadlinqs.com/technique/T1543.002), [T1546](https://intel.threadlinqs.com/technique/T1546), [T1546.004](https://intel.threadlinqs.com/technique/T1546.004), [T1547](https://intel.threadlinqs.com/technique/T1547), [T1548](https://intel.threadlinqs.com/technique/T1548), [T1550](https://intel.threadlinqs.com/technique/T1550), [T1552](https://intel.threadlinqs.com/technique/T1552), [T1552.001](https://intel.threadlinqs.com/technique/T1552.001), [T1554](https://intel.threadlinqs.com/technique/T1554), [T1555](https://intel.threadlinqs.com/technique/T1555), [T1556](https://intel.threadlinqs.com/technique/T1556), [T1557](https://intel.threadlinqs.com/technique/T1557), [T1560](https://intel.threadlinqs.com/technique/T1560), [T1560.001](https://intel.threadlinqs.com/technique/T1560.001), T1562, T1562.001, T1562.004, [T1564](https://intel.threadlinqs.com/technique/T1564), [T1565](https://intel.threadlinqs.com/technique/T1565), [T1565.001](https://intel.threadlinqs.com/technique/T1565.001), [T1566](https://intel.threadlinqs.com/technique/T1566), [T1566.001](https://intel.threadlinqs.com/technique/T1566.001), [T1566.002](https://intel.threadlinqs.com/technique/T1566.002), [T1566.003](https://intel.threadlinqs.com/technique/T1566.003), [T1566.004](https://intel.threadlinqs.com/technique/T1566.004), [T1567](https://intel.threadlinqs.com/technique/T1567), [T1568](https://intel.threadlinqs.com/technique/T1568), [T1568.002](https://intel.threadlinqs.com/technique/T1568.002), [T1570](https://intel.threadlinqs.com/technique/T1570), [T1571](https://intel.threadlinqs.com/technique/T1571), [T1572](https://intel.threadlinqs.com/technique/T1572), [T1573](https://intel.threadlinqs.com/technique/T1573), [T1573.001](https://intel.threadlinqs.com/technique/T1573.001), [T1573.002](https://intel.threadlinqs.com/technique/T1573.002), [T1574](https://intel.threadlinqs.com/technique/T1574), [T1575](https://intel.threadlinqs.com/technique/T1575), [T1580](https://intel.threadlinqs.com/technique/T1580), [T1583](https://intel.threadlinqs.com/technique/T1583), [T1583.001](https://intel.threadlinqs.com/technique/T1583.001), [T1583.004](https://intel.threadlinqs.com/technique/T1583.004), [T1583.006](https://intel.threadlinqs.com/technique/T1583.006), [T1585](https://intel.threadlinqs.com/technique/T1585), [T1585.001](https://intel.threadlinqs.com/technique/T1585.001), [T1585.002](https://intel.threadlinqs.com/technique/T1585.002), [T1586](https://intel.threadlinqs.com/technique/T1586), [T1587](https://intel.threadlinqs.com/technique/T1587), [T1587.001](https://intel.threadlinqs.com/technique/T1587.001), [T1587.004](https://intel.threadlinqs.com/technique/T1587.004), [T1588](https://intel.threadlinqs.com/technique/T1588), [T1588.002](https://intel.threadlinqs.com/technique/T1588.002), [T1588.005](https://intel.threadlinqs.com/technique/T1588.005), [T1588.006](https://intel.threadlinqs.com/technique/T1588.006), [T1589](https://intel.threadlinqs.com/technique/T1589), [T1589.002](https://intel.threadlinqs.com/technique/T1589.002), [T1590](https://intel.threadlinqs.com/technique/T1590), [T1591](https://intel.threadlinqs.com/technique/T1591), T1591.002, [T1592](https://intel.threadlinqs.com/technique/T1592), [T1592.002](https://intel.threadlinqs.com/technique/T1592.002), [T1594](https://intel.threadlinqs.com/technique/T1594), [T1595](https://intel.threadlinqs.com/technique/T1595), [T1595.002](https://intel.threadlinqs.com/technique/T1595.002), [T1596](https://intel.threadlinqs.com/technique/T1596), T1597, [T1598.003](https://intel.threadlinqs.com/technique/T1598.003), [T1598.004](https://intel.threadlinqs.com/technique/T1598.004), [T1601](https://intel.threadlinqs.com/technique/T1601), [T1602](https://intel.threadlinqs.com/technique/T1602), [T1606](https://intel.threadlinqs.com/technique/T1606), [T1608](https://intel.threadlinqs.com/technique/T1608), [T1608.001](https://intel.threadlinqs.com/technique/T1608.001), [T1608.005](https://intel.threadlinqs.com/technique/T1608.005), [T1609](https://intel.threadlinqs.com/technique/T1609), [T1611](https://intel.threadlinqs.com/technique/T1611), [T1614](https://intel.threadlinqs.com/technique/T1614), [T1622](https://intel.threadlinqs.com/technique/T1622), [T1624](https://intel.threadlinqs.com/technique/T1624), [T1626](https://intel.threadlinqs.com/technique/T1626), [T1628](https://intel.threadlinqs.com/technique/T1628), [T1629](https://intel.threadlinqs.com/technique/T1629), [T1630](https://intel.threadlinqs.com/technique/T1630), T1634, [T1636](https://intel.threadlinqs.com/technique/T1636), [T1646](https://intel.threadlinqs.com/technique/T1646), [T1649](https://intel.threadlinqs.com/technique/T1649), [T1650](https://intel.threadlinqs.com/technique/T1650), [T1655](https://intel.threadlinqs.com/technique/T1655), T1656, [T1657](https://intel.threadlinqs.com/technique/T1657), [T1660](https://intel.threadlinqs.com/technique/T1660)

## Threat actors

[0APT](https://intel.threadlinqs.com/actor/0APT), [Flying Eagle Tech](https://intel.threadlinqs.com/actor/Flying%20Eagle%20Tech), [UNC5792](https://intel.threadlinqs.com/actor/UNC5792), [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet), [TA488](https://intel.threadlinqs.com/actor/TA488), [Cavern backdoor framework](https://intel.threadlinqs.com/actor/Cavern%20backdoor%20framework)

Nation-state attribution: China, Russia, North Korea (DPRK), Iran

Threat categories: RANSOMWARE, FRAUD, THREAT_INTEL, SUPPLY_CHAIN, MALWARE, VULNERABILITY, PHISHING, DATA_BREACH

## Severity breakdown

- critical: 11
- high: 10
- medium: 2
- low: 1

## Indicator & detection coverage

Counts only; indicator values require Red and above, detection rule text requires Blue and above.

- Indicators of compromise: 847 (behavioral 203, file 133, entity 131, network 121, tool 71, infrastructure 64, package 55, technique 42, malware 25, vulnerability 2)
- New detection rules: 216 (100% of the day’s threats covered)

## More editions

- Previous: [2026-07-28](https://intel.threadlinqs.com/debrief/2026-07-28)
- Next: [2026-07-31](https://intel.threadlinqs.com/debrief/2026-07-31)
- [Archive of daily debriefs](https://intel.threadlinqs.com/debrief/archive)
- [Latest debrief](https://intel.threadlinqs.com/debrief)

Canonical: https://intel.threadlinqs.com/debrief/2026-07-29