# Daily Intelligence Briefing — Monday, August 10, 2026

> On 2026-08-10, Threadlinqs published 17 new threat reports and updated 3, 7 rated critical and 9 high, spanning 151 MITRE ATT&CK techniques and 4 named threat actors. Coverage that day added 180 new detection rules and 355 extracted indicators.

- **Edition:** 2026-08-10 (Monday)
- **Canonical:** https://intel.threadlinqs.com/debrief/2026-08-10
- **Last updated:** 2026-08-15
- **New threats:** 17 (3 updated)
- **Critical / high:** 7 critical, 9 high, 4 medium, 0 low
- **ATT&CK techniques:** 151
- **Threat actors:** 4
- **Indicators (count only):** 355
- **New detection rules (count only):** 180

## Summary & highlights

Claude-Powered OpenClaw AI Agent Autonomously Exploits Gym Booking API Authorization Flaw. Claude-Powered AI Agent (OpenClaw) Autonomously Exploits Broken Access Control Flaw in Gym Booking API. Royal Navy K3 Scout Drone Cameras Found Transmitting Heartbeat Signals to China-Based IP Address.

- [TL-2026-1966](https://intel.threadlinqs.com/threat/TL-2026-1966) — WSUS NTLM Relay Attack Chain Enables Malicious Update Deployment via SUSDB Stored Procedures
- [TL-2026-1968](https://intel.threadlinqs.com/threat/TL-2026-1968) — CSS Bomb Attacks: CSS-Based Trust-Boundary Bypass Leaks Webmail Passwords and Tokens (Outlook, Gmail, Yahoo, AOL, Fastmail, Proton Mail)
- [TL-2026-1970](https://intel.threadlinqs.com/threat/TL-2026-1970) — Payroll Pirates (Storm-2755) Abuse Microsoft Graph for HR/Finance Staff Recon After AiTM Account Compromise
- [TL-2026-1971](https://intel.threadlinqs.com/threat/TL-2026-1971) — WordPress Supply Chain Attack via BdThemes Promotional API Feed Poisoning (Element Pack, Prime Slider, and 5 More Plugins)
- [TL-2026-1973](https://intel.threadlinqs.com/threat/TL-2026-1973) — UAC-0145 (Sandworm subcluster) trojanizes WireGuard VPN client "SopraVPN" in fake IT recruitment campaign impersonating Sopra Steria Bulgaria

## Theme of the day

Activity centered on abc-news, active-directory, agentic-ai.

credential-theft, authentication-bypass, defense-evasion, privilege-escalation, active-exploitation

## Threats published

- [TL-2026-1967](https://intel.threadlinqs.com/threat/TL-2026-1967) — CRITICAL — Origin-Validation Bypass in Connective (Nitro Software Belgium) eID Browser Extension Enables PIN Theft, Signature Forgery, and Drive-By RCE Across 2M+ Belgian Users
- [TL-2026-1969](https://intel.threadlinqs.com/threat/TL-2026-1969) — CRITICAL — Metabase Zero-Day (GHSA-vwf4-m7j8-wcjf): Unauthenticated SQL Injection via /api/session/reset_password Exploited to Steal Database Credentials
- [TL-2026-1974](https://intel.threadlinqs.com/threat/TL-2026-1974) — CRITICAL — Unauthenticated SQL Injection Zero-Day in Metabase (CVSS 10.0, GHSA-vwf4-m7j8-wcjf) Exploited to Steal Framework, Tally, and LexisNexis Customer Data
- [TL-2026-1980](https://intel.threadlinqs.com/threat/TL-2026-1980) — CRITICAL — Metabase Unauthenticated SQL Injection Zero-Day (GHSA-vwf4-m7j8-wcjf, CVSS 10.0) Exploited to Steal Connected Database Credentials
- [TL-2026-1830](https://intel.threadlinqs.com/threat/TL-2026-1830) — CRITICAL — N-able N-central Authentication Bypass (CVE-2026-18577) Actively Exploited for Admin Takeover (update)
- [TL-2026-1842](https://intel.threadlinqs.com/threat/TL-2026-1842) — CRITICAL — Pass-ta-key: Novel Attack Surface in Google Password Manager Synced Passkey Authentication (update)
- [TL-2026-1925](https://intel.threadlinqs.com/threat/TL-2026-1925) — CRITICAL — CVE-2026-65400: macOS Screen Sharing Authentication Bypass Grants Unauthenticated Root Access (update)
- [TL-2026-1966](https://intel.threadlinqs.com/threat/TL-2026-1966) — HIGH — WSUS NTLM Relay Attack Chain Enables Malicious Update Deployment via SUSDB Stored Procedures
- [TL-2026-1968](https://intel.threadlinqs.com/threat/TL-2026-1968) — HIGH — CSS Bomb Attacks: CSS-Based Trust-Boundary Bypass Leaks Webmail Passwords and Tokens (Outlook, Gmail, Yahoo, AOL, Fastmail, Proton Mail)
- [TL-2026-1970](https://intel.threadlinqs.com/threat/TL-2026-1970) — HIGH — Payroll Pirates (Storm-2755) Abuse Microsoft Graph for HR/Finance Staff Recon After AiTM Account Compromise
- [TL-2026-1971](https://intel.threadlinqs.com/threat/TL-2026-1971) — HIGH — WordPress Supply Chain Attack via BdThemes Promotional API Feed Poisoning (Element Pack, Prime Slider, and 5 More Plugins)
- [TL-2026-1973](https://intel.threadlinqs.com/threat/TL-2026-1973) — HIGH — UAC-0145 (Sandworm subcluster) trojanizes WireGuard VPN client "SopraVPN" in fake IT recruitment campaign impersonating Sopra Steria Bulgaria
- [TL-2026-1976](https://intel.threadlinqs.com/threat/TL-2026-1976) — HIGH — Fake GoogleTranslate Chrome Extension Enables Remote Browser Control and Credential Theft via Rust Loader, AutoIt, and Stealc v2
- [TL-2026-1977](https://intel.threadlinqs.com/threat/TL-2026-1977) — HIGH — TXTBOOK: Dependency Confusion Campaign Drops Sliver via DNS TXT-Record Staging Against T-Bank
- [TL-2026-1979](https://intel.threadlinqs.com/threat/TL-2026-1979) — HIGH — Aeternum Loader Uses Polygon Blockchain Smart Contracts for Resilient C2, Deploys XWorm and XMRig
- [TL-2026-1981](https://intel.threadlinqs.com/threat/TL-2026-1981) — HIGH — DeadLock Ransomware: Rust-Based Encryptor with Decentralized Recovery Infrastructure on Polygon and Session
- [TL-2026-1965](https://intel.threadlinqs.com/threat/TL-2026-1965) — MEDIUM — Claude-Powered OpenClaw AI Agent Autonomously Exploits Gym Booking API Authorization Flaw
- [TL-2026-1972](https://intel.threadlinqs.com/threat/TL-2026-1972) — MEDIUM — Claude-Powered AI Agent (OpenClaw) Autonomously Exploits Broken Access Control Flaw in Gym Booking API
- [TL-2026-1975](https://intel.threadlinqs.com/threat/TL-2026-1975) — MEDIUM — Royal Navy K3 Scout Drone Cameras Found Transmitting Heartbeat Signals to China-Based IP Address
- [TL-2026-1978](https://intel.threadlinqs.com/threat/TL-2026-1978) — MEDIUM — BdThemes WordPress Plugin Supply-Chain Attack Poisons API to Create Rogue Admins

## Techniques observed

[AML.T0051](https://intel.threadlinqs.com/technique/AML.T0051), [T1005](https://intel.threadlinqs.com/technique/T1005), [T1018](https://intel.threadlinqs.com/technique/T1018), [T1021](https://intel.threadlinqs.com/technique/T1021), [T1021.005](https://intel.threadlinqs.com/technique/T1021.005), [T1027](https://intel.threadlinqs.com/technique/T1027), [T1027.010](https://intel.threadlinqs.com/technique/T1027.010), [T1033](https://intel.threadlinqs.com/technique/T1033), [T1036](https://intel.threadlinqs.com/technique/T1036), [T1036.005](https://intel.threadlinqs.com/technique/T1036.005), [T1046](https://intel.threadlinqs.com/technique/T1046), [T1053](https://intel.threadlinqs.com/technique/T1053), [T1053.003](https://intel.threadlinqs.com/technique/T1053.003), [T1053.005](https://intel.threadlinqs.com/technique/T1053.005), [T1055](https://intel.threadlinqs.com/technique/T1055), [T1056](https://intel.threadlinqs.com/technique/T1056), [T1056.001](https://intel.threadlinqs.com/technique/T1056.001), [T1056.002](https://intel.threadlinqs.com/technique/T1056.002), [T1057](https://intel.threadlinqs.com/technique/T1057), [T1059](https://intel.threadlinqs.com/technique/T1059), [T1059.001](https://intel.threadlinqs.com/technique/T1059.001), [T1059.004](https://intel.threadlinqs.com/technique/T1059.004), [T1059.007](https://intel.threadlinqs.com/technique/T1059.007), T1059.010, [T1068](https://intel.threadlinqs.com/technique/T1068), [T1069](https://intel.threadlinqs.com/technique/T1069), [T1070.006](https://intel.threadlinqs.com/technique/T1070.006), [T1071](https://intel.threadlinqs.com/technique/T1071), [T1071.001](https://intel.threadlinqs.com/technique/T1071.001), [T1072](https://intel.threadlinqs.com/technique/T1072), [T1078](https://intel.threadlinqs.com/technique/T1078), [T1078.002](https://intel.threadlinqs.com/technique/T1078.002), [T1078.004](https://intel.threadlinqs.com/technique/T1078.004), [T1082](https://intel.threadlinqs.com/technique/T1082), [T1083](https://intel.threadlinqs.com/technique/T1083), [T1087](https://intel.threadlinqs.com/technique/T1087), [T1087.002](https://intel.threadlinqs.com/technique/T1087.002), T1087.003, [T1087.004](https://intel.threadlinqs.com/technique/T1087.004), [T1090](https://intel.threadlinqs.com/technique/T1090), [T1090.002](https://intel.threadlinqs.com/technique/T1090.002), [T1098](https://intel.threadlinqs.com/technique/T1098), [T1098.005](https://intel.threadlinqs.com/technique/T1098.005), [T1102](https://intel.threadlinqs.com/technique/T1102), [T1105](https://intel.threadlinqs.com/technique/T1105), [T1106](https://intel.threadlinqs.com/technique/T1106), [T1110.001](https://intel.threadlinqs.com/technique/T1110.001), [T1111](https://intel.threadlinqs.com/technique/T1111), [T1112](https://intel.threadlinqs.com/technique/T1112), [T1113](https://intel.threadlinqs.com/technique/T1113), [T1114.002](https://intel.threadlinqs.com/technique/T1114.002), [T1119](https://intel.threadlinqs.com/technique/T1119), [T1133](https://intel.threadlinqs.com/technique/T1133), [T1134](https://intel.threadlinqs.com/technique/T1134), [T1136](https://intel.threadlinqs.com/technique/T1136), [T1136.001](https://intel.threadlinqs.com/technique/T1136.001), [T1136.002](https://intel.threadlinqs.com/technique/T1136.002), [T1140](https://intel.threadlinqs.com/technique/T1140), [T1176](https://intel.threadlinqs.com/technique/T1176), [T1185](https://intel.threadlinqs.com/technique/T1185), [T1187](https://intel.threadlinqs.com/technique/T1187), [T1190](https://intel.threadlinqs.com/technique/T1190), [T1195](https://intel.threadlinqs.com/technique/T1195), [T1195.002](https://intel.threadlinqs.com/technique/T1195.002), [T1195.003](https://intel.threadlinqs.com/technique/T1195.003), T1197, [T1199](https://intel.threadlinqs.com/technique/T1199), [T1203](https://intel.threadlinqs.com/technique/T1203), [T1204](https://intel.threadlinqs.com/technique/T1204), [T1204.001](https://intel.threadlinqs.com/technique/T1204.001), [T1204.002](https://intel.threadlinqs.com/technique/T1204.002), [T1210](https://intel.threadlinqs.com/technique/T1210), [T1211](https://intel.threadlinqs.com/technique/T1211), [T1212](https://intel.threadlinqs.com/technique/T1212), [T1213](https://intel.threadlinqs.com/technique/T1213), [T1217](https://intel.threadlinqs.com/technique/T1217), [T1219](https://intel.threadlinqs.com/technique/T1219), [T1222.002](https://intel.threadlinqs.com/technique/T1222.002), [T1482](https://intel.threadlinqs.com/technique/T1482), [T1485](https://intel.threadlinqs.com/technique/T1485), [T1489](https://intel.threadlinqs.com/technique/T1489), [T1490](https://intel.threadlinqs.com/technique/T1490), [T1496](https://intel.threadlinqs.com/technique/T1496), [T1497](https://intel.threadlinqs.com/technique/T1497), [T1505](https://intel.threadlinqs.com/technique/T1505), [T1505.003](https://intel.threadlinqs.com/technique/T1505.003), [T1518.001](https://intel.threadlinqs.com/technique/T1518.001), [T1526](https://intel.threadlinqs.com/technique/T1526), [T1528](https://intel.threadlinqs.com/technique/T1528), [T1531](https://intel.threadlinqs.com/technique/T1531), [T1538](https://intel.threadlinqs.com/technique/T1538), [T1539](https://intel.threadlinqs.com/technique/T1539), T1542.005, [T1543](https://intel.threadlinqs.com/technique/T1543), [T1546](https://intel.threadlinqs.com/technique/T1546), [T1547](https://intel.threadlinqs.com/technique/T1547), [T1548](https://intel.threadlinqs.com/technique/T1548), T1548.006, [T1550.001](https://intel.threadlinqs.com/technique/T1550.001), [T1552](https://intel.threadlinqs.com/technique/T1552), [T1552.001](https://intel.threadlinqs.com/technique/T1552.001), [T1552.004](https://intel.threadlinqs.com/technique/T1552.004), [T1553.002](https://intel.threadlinqs.com/technique/T1553.002), [T1555](https://intel.threadlinqs.com/technique/T1555), [T1555.003](https://intel.threadlinqs.com/technique/T1555.003), [T1556](https://intel.threadlinqs.com/technique/T1556), [T1556.006](https://intel.threadlinqs.com/technique/T1556.006), [T1557](https://intel.threadlinqs.com/technique/T1557), [T1557.001](https://intel.threadlinqs.com/technique/T1557.001), [T1558](https://intel.threadlinqs.com/technique/T1558), T1562.001, [T1564](https://intel.threadlinqs.com/technique/T1564), [T1564.003](https://intel.threadlinqs.com/technique/T1564.003), [T1564.008](https://intel.threadlinqs.com/technique/T1564.008), [T1565.001](https://intel.threadlinqs.com/technique/T1565.001), [T1566](https://intel.threadlinqs.com/technique/T1566), [T1566.001](https://intel.threadlinqs.com/technique/T1566.001), [T1566.002](https://intel.threadlinqs.com/technique/T1566.002), [T1566.003](https://intel.threadlinqs.com/technique/T1566.003), [T1567](https://intel.threadlinqs.com/technique/T1567), [T1568](https://intel.threadlinqs.com/technique/T1568), [T1569](https://intel.threadlinqs.com/technique/T1569), [T1570](https://intel.threadlinqs.com/technique/T1570), [T1572](https://intel.threadlinqs.com/technique/T1572), [T1573](https://intel.threadlinqs.com/technique/T1573), [T1573.001](https://intel.threadlinqs.com/technique/T1573.001), [T1574](https://intel.threadlinqs.com/technique/T1574), [T1583](https://intel.threadlinqs.com/technique/T1583), [T1583.001](https://intel.threadlinqs.com/technique/T1583.001), [T1583.004](https://intel.threadlinqs.com/technique/T1583.004), [T1583.008](https://intel.threadlinqs.com/technique/T1583.008), [T1584](https://intel.threadlinqs.com/technique/T1584), [T1585](https://intel.threadlinqs.com/technique/T1585), [T1585.001](https://intel.threadlinqs.com/technique/T1585.001), [T1587.001](https://intel.threadlinqs.com/technique/T1587.001), [T1588](https://intel.threadlinqs.com/technique/T1588), [T1589](https://intel.threadlinqs.com/technique/T1589), [T1592.002](https://intel.threadlinqs.com/technique/T1592.002), [T1594](https://intel.threadlinqs.com/technique/T1594), [T1595.002](https://intel.threadlinqs.com/technique/T1595.002), T1595.003, [T1596.005](https://intel.threadlinqs.com/technique/T1596.005), [T1606](https://intel.threadlinqs.com/technique/T1606), [T1608](https://intel.threadlinqs.com/technique/T1608), [T1608.001](https://intel.threadlinqs.com/technique/T1608.001), [T1608.006](https://intel.threadlinqs.com/technique/T1608.006), [T1614](https://intel.threadlinqs.com/technique/T1614), [T1620](https://intel.threadlinqs.com/technique/T1620), [T1657](https://intel.threadlinqs.com/technique/T1657), [T1684.001](https://intel.threadlinqs.com/technique/T1684.001), [T1685](https://intel.threadlinqs.com/technique/T1685)

## Threat actors

[Storm-2755](https://intel.threadlinqs.com/actor/Storm-2755), [UAC-0145](https://intel.threadlinqs.com/actor/UAC-0145), [LenAI](https://intel.threadlinqs.com/actor/LenAI), [DeadLock ransomware operators](https://intel.threadlinqs.com/actor/DeadLock%20ransomware%20operators)

Nation-state attribution: Russia

Threat categories: VULNERABILITY, SUPPLY_CHAIN, PHISHING, MALWARE, RANSOMWARE

## Severity breakdown

- critical: 7
- high: 9
- medium: 4
- low: 0

## Indicator & detection coverage

Counts only; indicator values require Red and above, detection rule text requires Blue and above.

- Indicators of compromise: 355 (network 87, file 78, entity 69, infrastructure 44, tool 30, behavioral 28, malware 9, package 9, technique 1)
- New detection rules: 180 (100% of the day’s threats covered)

## More editions

- Previous: [2026-08-09](https://intel.threadlinqs.com/debrief/2026-08-09)
- Next: [2026-08-13](https://intel.threadlinqs.com/debrief/2026-08-13)
- [Archive of daily debriefs](https://intel.threadlinqs.com/debrief/archive)
- [Latest debrief](https://intel.threadlinqs.com/debrief)

Canonical: https://intel.threadlinqs.com/debrief/2026-08-10